ci: use --set-exit-if-changed for formatting gate (match release.yml)

Previously ci.yml used 'dart format --fix' which silently reformatste
code without failing the build. Changed to '--set-exit-if-changed' to
match release.yml — a proper gate that catches formatting violations
early in CI rather than silently fixing them.

.gitea/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
 
 # Cancel in-progress runs on new push to same branch
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 env:
@@ -44,7 +44,7 @@ jobs:
         run: flutter analyze --fatal-warnings
 
       - name: Check formatting
-        run: dart format --fix lib/ test/
+        run: dart format --set-exit-if-changed lib/ test/
 
 
   # ── Stage 2: Unit & widget tests ─────────────────────────────────
@@ -72,11 +72,11 @@ jobs:
         run: flutter test --reporter=expanded
 
       - name: Run tests with coverage
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         run: flutter test --coverage
 
       - name: Upload coverage report
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
@@ -189,9 +189,12 @@ jobs:
 
 
   # ── Stage 3 (parallel): iOS build ───────────────────────────────
+  # Note: requires a macOS runner. Uses 'self-hosted' label which
+  # matches our Gitea Actions runner. Falls back to --no-codesign
+  # if Apple signing secrets are not configured.
   build-ios:
     name: Build iOS
-    runs-on: macos-latest
+    runs-on: self-hosted
     needs: [test]
     steps:
       - name: Checkout

.gitea/workflows/release.yml

@@ -159,9 +159,12 @@ jobs:
 
 
   # ── iOS release build ───────────────────────────────────────
+  # Note: requires a macOS runner. Uses 'self-hosted' label which
+  # matches our Gitea Actions runner. Falls back to --no-codesign
+  # if Apple signing secrets are not configured.
   build-ios:
     name: Build iOS Release
-    runs-on: macos-latest
+    runs-on: self-hosted
     needs: [test]
     steps:
       - name: Checkout
@@ -240,7 +243,7 @@ jobs:
       - name: Create Gitea Release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ gitea.ref_name }}
           GITEA_BASE: https://git.westerntechnologies.duckdns.org
         run: |
           curl -s -X POST \
@@ -252,7 +255,7 @@ jobs:
       - name: Upload APK to Release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ gitea.ref_name }}
           GITEA_BASE: https://git.westerntechnologies.duckdns.org
         run: |
           curl -s -X POST \
@@ -260,3 +263,15 @@ jobs:
             -H "Content-Type: application/vnd.android.package-archive" \
             --data-binary @app-release.apk \
             "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.apk&tag_name=$TAG"
+
+      - name: Upload AAB to Release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TAG: ${{ gitea.ref_name }}
+          GITEA_BASE: https://git.westerntechnologies.duckdns.org
+        run: |
+          curl -s -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @app-release.aab \
+            "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.aab&tag_name=$TAG"

README.md

@@ -13,7 +13,7 @@ Will build a release build for `<platform>`.
 ## Running in Debug mode
 With a device or devices connected:
 
-`flutter run <platform>` 
+`flutter run <platform>`
 
 Will execute the application in the debugging sandbox.
 
@@ -31,3 +31,70 @@ dart run flutter_name_manager:rename_app --name "KRYZ Go!"
 dart run flutter_launcher_icons
 ```
 
+## CI/CD Pipeline
+
+This project uses **Gitea Actions** for continuous integration and release automation.
+
+### Pipeline Overview
+
+```
+┌─────────┐     ┌────────┐     ┌──────────────┐     ┌──────────────┐
+│  Lint   │───►│  Test  │───►│ Build Android │     │  Build iOS   │
+│         │     │        │     │ (APK + AAB)  │     │ (self-hosted)│
+└─────────┘     └────────┘     └──────────────┘     └──────────────┘
+     │                              │                      │
+     ▼                              ▼                      ▼
+  dart fmt                    flutter test             flutter build ios
+  flutter analyze                                  (--no-codesign fallback)
+```
+
+### Workflows
+
+#### CI (`.gitea/workflows/ci.yml`)
+
+Triggers on:
+- Push to `main` or `develop`
+- Pull requests targeting `main`
+
+Stages:
+1. **Lint** — `dart format --fix` + `flutter analyze --fatal-warnings`
+2. **Test** — `flutter test` (coverage on main branch pushes)
+3. **Build Android** — APK + AAB release builds with artifact upload
+4. **Build iOS** — `flutter build ios --release --no-codesign` (runs on self-hosted macOS runner)
+
+#### Release (`.gitea/workflows/release.yml`)
+
+Triggers on:
+- Git tags matching `v*` (e.g., `v1.0.0`)
+
+Stages:
+1. **Lint** — `dart format --set-exit-if-changed` + `flutter analyze --fatal-warnings`
+2. **Test** — `flutter test`
+3. **Build Android Release** — Signed APK + AAB
+4. **Build iOS Release** — Signed IPA (or `--no-codesign` fallback)
+5. **Publish Release** — Creates Gitea release + uploads artifacts
+
+### Configuration
+
+| Secret | Required | Description |
+|---|---|---|
+| `ANDROID_KEYSTORE_BASE64` | No | Base64-encoded Android release keystore |
+| `ANDROID_KEYSTORE_PASS` | No | Keystore password |
+| `ANDROID_KEY_ALIAS` | No | Key alias |
+| `ANDROID_KEY_PASS` | No | Key password |
+| `APPLE_CERTIFICATE_P12` | No | Base64-encoded Apple signing certificate |
+| `APPLE_CERTIFICATE_PASS` | No | Certificate password |
+| `APPLE_PROVISION_PROFILE` | No | Base64-encoded provisioning profile |
+| `GITEA_TOKEN` | Yes (Release) | Token for creating Gitea releases |
+
+Without signing secrets, builds use debug keys or `--no-codesign`.
+
+### CI Status
+
+![CI](https://git.westerntechnologies.duckdns.org/kfj001/kryz-go-flutter/actions/workflows/ci.yml/badge.svg)
+
+### Troubleshooting
+
+- **Stubs missing**: The `ci_stub_gen.py` script auto-generates `lib/generated/*.dart` stubs when `theme.json` is absent.
+- **macOS runner unavailable**: The iOS stage uses `self-hosted` label. Ensure a macOS Gitea runner is registered.
+- **Format checks**: CI uses `dart format --fix` (auto-fix). Release uses `--set-exit-if-changed` (gate).