Move the canonical forge to Codeberg, and add Renovate + Weblate (#2)

Makes Codeberg canonical for git, issues, PRs, tags and releases. The self-hosted Gitea instance stays build infrastructure: signing key, F-Droid publishing, release pipeline. Ports the setup Calendula already runs on, adapted where Agendula genuinely differs.

**This PR is its own test.** It is the first PR opened on Codeberg, so a green `CI` check proves the new runner works *and* that the submodule resolves from its new home.

### 1 · Workflows split by directory

Forgejo's lookup is first-match-wins across `.forgejo/` → `.gitea/` → `.github/`, and Gitea cannot see `.forgejo/` at all. So each forge sees exactly one set, with no duplicated files and no expression to keep in sync:

| Directory | Runs on | Contains | Secrets |
| --- | --- | --- | --- |
| `.forgejo/workflows/` | Codeberg | `ci.yaml`, `translations.yaml` | **none** |
| `.gitea/workflows/` | Gitea | `release.yaml`, `renovate.yml` | all of them |

The line is drawn at **secrets, not CI-vs-release** — that is what makes fork PRs safe. Renovate deliberately does *not* move despite opening PRs here; it keeps running where its token already lives and merely talks to Codeberg's API.

CI also gains three fixes: an explicit `SKIP_RE` skip-list that names the build-relevant files in the log, base-ref normalisation, and a fully-qualified `android-actions/setup-android` — Codeberg resolves bare `uses:` refs against `data.forgejo.org`, which does not carry that action.

### 2 · Three release-pipeline safety changes

- `detect` and the Renovate job get an explicit `repository_owner` guard. The directory split only holds while `.forgejo/` is non-empty; empty it and Codeberg would fall back to `.gitea/` and start running these on the contributor-facing runner, without secrets.
- `detect` now reads tags from **Codeberg**, not from the Gitea instance it runs on. Push mirroring is `git push --mirror`, so a tag minted on Gitea is deleted by the next sync until the Codeberg tag push propagates back — asking Gitea inside that window reports "no tag" for an already-shipped release and would cut it twice. It also now fails on any status other than 200/404 rather than reading a transient error as "no tag": a failed job is recoverable, a duplicate release is not.
- **The Codeberg publish step pushes the tag itself** instead of waiting for it to arrive by mirror. That wait was correct while Gitea mirrored *to* Codeberg; under Codeberg-canonical the mirror runs the other way and it would never resolve. Attaching the release to an already-pushed ref (no `target_commitish`) is what avoids the empty-bodied 500s, and the create call retries with backoff because Codeberg 500s on a tag it has only just received. The step stays **fail-loud**, not `continue-on-error` — it reported green through 0.2.1–0.3.2 while never once publishing, and that must not be possible again.

### 3 · Renovate

`renovate.json5` plus a Gitea-side job targeting Codeberg's API. `managerFilePatterns` covers **both** workflow directories, so the pinned Renovate image tag and the action versions in either file keep getting bumped.

Needs two new Gitea secrets: `RENOVATE_TOKEN` (Codeberg bot, repo read/write + PR scope) and `GITHUB_COM_TOKEN` (read-only github.com PAT, for changelog lookups).

### 4 · Weblate

A parity check (`scripts/check_translations.py`) runs on every PR without a path filter, so the required `Translations` status is always reported. Partial translations are expected, so `MissingTranslation` and `MissingQuantity` become informational — `ExtraTranslation` stays fatal. Agendula had no `lint` block at all, so the first locale to land would otherwise have failed the build.

**Settings → App language** now opens a picker carrying a "Help translate" header. That is why it drops floret-kit's `LanguagePickerRow` for a local row: the shared recipe has no `header` slot, and the framing is app-specific rather than a family primitive.

### 5 · Links repointed

In-app Source / License / report-issue URLs, F-Droid metadata, README (now with a Codeberg CI badge), and the docs.

`floret-kit` follows suit — `.gitmodules` points at `codeberg.org/jlmakiola/floret-kit`, so a clone no longer needs to reach the personal Gitea instance to resolve it. The Gitea copy is **kept**: every existing tag records the old submodule URL, so rebuilds of past releases still resolve.

### 6 · Housekeeping

Drops `release-notes.md` — a release-pipeline scratch file that got committed — and gitignores the five others the release job writes into the workspace.

### Not in this PR

The Codeberg → Gitea push mirror, the Weblate component, and the Codeberg bot account (all browser-side). Until the mirror is flipped, merging this does **not** reach the Gitea runner.

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/2

.forgejo/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,23 @@
+---
+name: Bug report
+about: Something doesn't work the way it should
+title: ""
+labels:
+  - bug
+---
+
+### What happened
+
+
+### What you expected
+
+
+### Steps to reproduce
+1.
+2.
+3.
+
+### Environment
+- Agendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.forgejo/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,24 @@
+# Kept enabled so anything that doesn't fit the four templates still has a way
+# in.
+blank_issues_enabled: true
+
+contact_links:
+  - name: Translate Agendula
+    url: https://weblate.dev.jeanlucmakiola.de/engage/agendula/
+    about: >-
+      Translations are managed on Weblate, not here — it owns every values-*
+      file, so a hand-edited translation gets overwritten on the next sync.
+      No coding needed: pick or request a language and translate in the browser.
+
+  - name: Contributing guide
+    url: https://codeberg.org/jlmakiola/agendula/src/branch/main/CONTRIBUTING.md
+    about: >-
+      Before opening a pull request: how to build (there's a submodule), where
+      code goes, and the one architectural rule a change is reviewed against.
+
+  - name: Sync sources and scope
+    url: https://codeberg.org/jlmakiola/agendula/src/branch/main/README.md
+    about: >-
+      Agendula is a front-end over the OpenTasks provider, so it works with
+      DAVx5, SmoothSync, DecSync and friends. Google Tasks and Microsoft To Do
+      are out of scope by design — check here before requesting a backend.

.forgejo/ISSUE_TEMPLATE/crash_report.md

@@ -0,0 +1,27 @@
+---
+name: Crash report
+about: Report a crash. Agendula can capture this for you (Settings → Report a problem, or the prompt after a crash) — it copies the report to your clipboard and prefills this form.
+title: "Crash: "
+labels:
+  - bug
+  - crash
+  - priority:high
+---
+
+<!--
+Thanks for reporting a crash in Agendula!
+
+If the app prefilled this for you, the crash report is already below — just add
+what you were doing and submit. Otherwise, paste the report from your clipboard
+into the code block. The report contains only app/Android/device versions and the
+stack trace — no personal data or calendar content.
+-->
+
+### What happened
+
+
+### Crash report
+
+```
+(paste the crash report here)
+```

.forgejo/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: ""
+labels:
+  - feat
+---
+
+### What would you like Agendula to do?
+
+
+### Why — what problem does it solve?
+
+
+### Anything else
+<!-- mockups, examples from other apps, alternatives you considered -->

.forgejo/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,19 @@
+---
+name: Question
+about: Ask how something works or get help using Agendula
+title: ""
+labels:
+  - question
+---
+
+### Your question
+
+
+### What you've tried
+<!-- so far, if anything -->
+
+
+### Context
+- Agendula version: <!-- Settings → bottom of the screen -->
+- Android version:
+- Device:

.forgejo/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,42 @@
+<!--
+Thanks for contributing to Agendula!
+
+Please skim CONTRIBUTING.md if you haven't:
+https://codeberg.org/jlmakiola/agendula/src/branch/main/CONTRIBUTING.md
+
+Two things it's easy to get wrong:
+  • The one architectural rule — provider column names, `TaskContract`,
+    `ContentResolver` and the authority string never leak above `data/tasks/`.
+  • Don't bump `versionName` / `versionCode`. That bump reaching `main` is what
+    cuts a release, so it belongs only in a release PR.
+-->
+
+### What this changes
+
+
+### Why
+
+<!-- Closes #123 — link the issue this implements or fixes. -->
+
+
+### How it was tested
+
+<!--
+Which of these ran green, and anything you exercised by hand. On-device notes
+are especially useful for UI changes, and for anything touching the provider
+read/write paths (OpenTasks / tasks.org installed).
+
+  ./gradlew lintDebug :app:testDebugUnitTest :app:assembleDebug
+  python3 scripts/check_translations.py
+-->
+
+
+### Checklist
+
+- [ ] `./gradlew lintDebug :app:testDebugUnitTest :app:assembleDebug` passes locally
+- [ ] New domain logic comes with JVM unit tests under `app/src/test/`
+- [ ] Provider details stay inside `data/tasks/`
+- [ ] No `values-*/strings.xml` touched (Weblate owns those; new English strings in `values/` are fine)
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]`, if the change is user-visible
+- [ ] No `versionName` / `versionCode` bump
+- [ ] No planning or design documents committed

.forgejo/workflows/ci.yaml

@@ -0,0 +1,169 @@
+name: CI
+
+# One gate per pull request. Branch pushes no longer trigger CI on their own,
+# so a change is built once on its PR (covering feature -> release/* and
+# release/* -> main) instead of once per push and again on the merge to main.
+# The merge itself is handled by release.yaml, which only does heavy work when
+# the merge actually cuts a release.
+on:
+  pull_request:
+
+# Cancel superseded runs for the same PR.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Single job named `ci` so the required "CI" status check is always reported,
+  # even for docs-only PRs: those just skip the Android build and the job still
+  # succeeds (fast green check) instead of being filtered out and leaving the
+  # required check pending forever.
+  ci:
+    runs-on: docker
+    env:
+      ANDROID_HOME: /opt/android-sdk
+      ANDROID_SDK_ROOT: /opt/android-sdk
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Full history so the base..HEAD diff below has a merge-base.
+          fetch-depth: 0
+          submodules: recursive
+
+      # Cheap, always-on guard: the release build must stay reproducible for the
+      # official F-Droid repo (no AGP VCS-info embedding). Runs regardless of
+      # change scope so a regression can't slip through on a "docs-only" PR.
+      - name: Reproducible-release invariant
+        run: bash scripts/check_reproducible_release.sh
+
+      # Decide whether anything that affects the app build changed. Docs, store
+      # metadata, licence texts and forge housekeeping don't, so those PRs skip
+      # the SDK + Gradle work below but still report a green `ci`.
+      - name: Classify change scope
+        id: scope
+        env:
+          # Deliberately a skip-list, not a build-list: a path nobody thought
+          # about defaults to building. Only paths the Gradle build provably
+          # never reads belong here — note that the workflows themselves, the
+          # `.gitmodules` submodule pointer and `scripts/` are *not* in it.
+          SKIP_RE: '(\.md$|^docs/|^fastlane/|^fdroid-metadata/|^design/|^\.(forgejo|gitea)/ISSUE_TEMPLATE/|^\.editorconfig$|^\.gitattributes$|^\.gitignore$|^LICENSE$)'
+        run: |
+          set -e
+          BASE="${{ github.base_ref }}"
+          # Normally the bare branch name; tolerate a full ref, which would
+          # otherwise make the merge-base lookup fail and quietly degrade this
+          # guard into "always build".
+          BASE="${BASE#refs/heads/}"
+          if [ -z "$BASE" ]; then
+            echo "No base branch on this event — running the full build to be safe."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Full (not --depth=1) base fetch so the merge-base is present even when
+          # the PR branch forked several commits back; a shallow tip has no merge
+          # base with a divergent branch and `git diff base...HEAD` aborts.
+          git fetch --no-tags origin "$BASE"
+          MB=$(git merge-base "origin/$BASE" HEAD 2>/dev/null || true)
+          if [ -z "$MB" ]; then
+            # No common ancestor available — don't risk skipping the build.
+            echo "No merge base with origin/$BASE — running the full build to be safe."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          CHANGED=$(git diff --name-only "$MB" HEAD)
+          echo "Changed files:"; echo "$CHANGED"
+          RELEVANT=$(echo "$CHANGED" | grep -vE "$SKIP_RE" || true)
+          if [ -n "$RELEVANT" ]; then
+            # Naming them makes "why did my docs PR build for four minutes?"
+            # answerable from the log alone.
+            echo "Build-relevant changes:"; echo "$RELEVANT"
+            echo "code=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Docs/metadata-only change — skipping the Android build."
+            echo "code=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Java
+        if: steps.scope.outputs.code == 'true'
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+
+      # Fully qualified on purpose. Codeberg resolves bare `uses:` refs against
+      # data.forgejo.org, Forgejo's own action mirror — actions/checkout,
+      # setup-java and cache all exist there, but android-actions/setup-android
+      # does not, and the job dies with "repository not found". Gitea's instance
+      # defaults to GitHub, which is why this never surfaced before the split.
+      - name: Setup Android SDK
+        if: steps.scope.outputs.code == 'true'
+        uses: https://github.com/android-actions/setup-android@v3
+        with:
+          # Default ("tools platform-tools") drags in the Android Emulator
+          # (~300 MB) which the build never uses.
+          packages: ''
+
+      - name: Setup Android SDK cache
+        if: steps.scope.outputs.code == 'true'
+        uses: actions/cache@v4
+        with:
+          path: /opt/android-sdk
+          key: ${{ runner.os }}-android-sdk-37-36.0.0
+
+      - name: Install Android SDK packages
+        if: steps.scope.outputs.code == 'true'
+        run: |
+          yes | sdkmanager --licenses >/dev/null || true
+          sdkmanager \
+            "platform-tools" \
+            "platforms;android-37.0" \
+            "build-tools;36.0.0"
+
+      - name: Setup Gradle cache
+        if: steps.scope.outputs.code == 'true'
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Grant execute permission for gradlew
+        if: steps.scope.outputs.code == 'true'
+        run: chmod +x ./gradlew
+
+      # No --no-daemon: the daemon lives only as long as this job container
+      # and lets the following steps skip JVM startup + reconfiguration.
+      - name: Lint (debug variant only)
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew lintDebug
+
+      - name: Unit tests
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew testDebugUnitTest
+
+      - name: Assemble debug APK
+        if: steps.scope.outputs.code == 'true'
+        run: ./gradlew assembleDebug
+
+      - name: Trivy filesystem scan
+        if: steps.scope.outputs.code == 'true'
+        run: |
+          set -e
+          SUDO=""
+          if command -v sudo >/dev/null 2>&1; then
+            SUDO="sudo"
+          fi
+          if command -v apt-get >/dev/null 2>&1; then
+            $SUDO apt-get update
+            $SUDO apt-get install -y wget apt-transport-https gnupg lsb-release
+            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | $SUDO tee /usr/share/keyrings/trivy.gpg > /dev/null
+            echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | $SUDO tee /etc/apt/sources.list.d/trivy.list
+            $SUDO apt-get update
+            $SUDO apt-get install -y trivy
+          fi
+          trivy filesystem --severity HIGH,CRITICAL --exit-code 0 .
+        continue-on-error: true

.forgejo/workflows/translations.yaml

@@ -0,0 +1,39 @@
+name: Translations
+
+# Fast, SDK-free parity check for translation resources, so Weblate PRs (which
+# only touch values-*/strings.xml) get quick feedback without the full Android
+# build. The deeper checks still run in CI via lintDebug (ExtraTranslation).
+#
+# Runs on every PR (no path filter) so the required "Translations / check"
+# status is always reported — like the `ci` job. A path-filtered workflow is
+# skipped on unrelated PRs and never posts its status, which leaves that
+# required check pending forever and blocks the merge of any code-only PR into a
+# release/* branch. The check itself is cheap and simply passes when the
+# committed translations are consistent, so always running it costs nothing.
+on:
+  pull_request:
+
+concurrency:
+  group: translations-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ensure python3
+        run: |
+          if ! command -v python3 >/dev/null 2>&1; then
+            if command -v apt-get >/dev/null 2>&1; then
+              apt-get update && apt-get install -y python3
+            elif command -v apk >/dev/null 2>&1; then
+              apk add --no-cache python3
+            fi
+          fi
+          python3 --version
+
+      - name: Check translation parity
+        run: python3 scripts/check_translations.py