ci: move the CI to Gitea Actions and cache what is rebuilt

Linux-only runner, so the Windows and macOS legs and GitHub's audit action are
gone. The Rust toolchain, cargo registry and target directories live on the
runner's persistent toolcache volume. release.yml stays under .github and is
not run by Gitea.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -15,17 +15,24 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -D warnings
+  # O runner mantém /opt/hostedtoolcache num volume que sobrevive entre jobs:
+  # a toolchain do rustup, o registry do cargo e o diretório target ficam ali,
+  # então nada disso é baixado ou recompilado do zero a cada execução. Cada job
+  # usa o seu próprio target (flags diferentes invalidariam o de outro job).
+  CARGO_HOME: /opt/hostedtoolcache/cargo
+  RUSTUP_HOME: /opt/hostedtoolcache/rustup
 
 jobs:
   lint:
     name: Formatação e clippy
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/sabia-lint
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
       - uses: actions/setup-node@v7
         with:
           node-version: 22
@@ -34,37 +41,39 @@ jobs:
       - run: cargo fmt --all -- --check
       - run: cargo clippy --workspace --all-targets
 
+  # Windows e macOS saem: o Gitea aqui tem um único runner, Linux arm64.
   test:
-    name: Testes (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-24.04, windows-latest, macos-latest]
+    name: Testes (Linux)
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/sabia-test
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
       - run: cargo test --workspace
 
   audit:
     name: Auditoria de dependências
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: rustsec/audit-check@v2
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@stable
+      # rustsec/audit-check depends on GitHub's checks API. cargo-audit itself
+      # needs nothing but the advisory database, and installing it once into the
+      # persistent CARGO_HOME makes every later run skip the compile.
+      - name: cargo audit
+        run: |
+          command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
+          cargo audit
 
   gui:
     name: Compila o app desktop (Linux)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TARGET_DIR: /opt/hostedtoolcache/cargo-target/sabia-gui
     steps:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: apps/gui/src-tauri
       - uses: actions/setup-node@v7
         with:
           node-version: 22