ci: one workflow run per change, cancel superseded runs, cache the Gradle distribution

Pushes to feature branches built twice (push and pull request) and Check Codes
repeated the compile in a second workflow. Build now runs only on main, tags and
pull requests, cancels older runs of the same ref, folds checkstyle and
checkTranslations into the single Gradle invocation, caches the wrapper download
and skips apt when xvfb is installed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/check-codes-comment.yml

@@ -1,21 +0,0 @@
-name: Check Codes Comment
-
-# Disabled on this Gitea fork: the upstream flow depends on reviewdog
-# (missing from git.nest.potatolab.uk) and a checkstyle-artifact produced by
-# check-codes.yml. Re-enable only after those actions are mirrored or the
-# comment path is rewritten without reviewdog.
-on:
-  workflow_dispatch:
-
-permissions:
-  actions: read
-  contents: read
-  pull-requests: write
-
-jobs:
-  comment:
-    runs-on: ubuntu-latest
-    if: false
-    steps:
-      - name: Disabled
-        run: echo "check-codes-comment is disabled on this fork"

.github/workflows/check-codes.yml

@@ -1,35 +0,0 @@
-name: Check Codes
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - '**.java'
-      - '**.properties'
-      - '.github/workflows/check-codes.yml'
-  pull_request:
-    paths:
-      - '**.java'
-      - '**.properties'
-      - '.github/workflows/check-codes.yml'
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - name: Setup JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'zulu'
-          java-version: '17'
-          java-package: 'jdk+fx'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
-        with:
-          cache-cleanup: never
-      # Keep only Gradle checks. reviewdog/action-setup is not mirrored on
-      # git.nest.potatolab.uk (404), so PR-comment artifact steps are omitted
-      # for Gitea Actions / act runners.
-      - name: Check Codes
-        run: ./gradlew checkstyle checkTranslations --no-daemon --parallel --stacktrace

.github/workflows/gradle.yml

@@ -1,11 +1,22 @@
 name: Java CI
 
+# Pushes to main and pull requests only. A branch with an open pull request used to build twice
+# (once for the push, once for the pull request), which kept the runners queued.
 on:
   push:
+    branches:
+      - main
+    tags:
+      - '*'
   pull_request:
     paths-ignore:
       - '**.md'
 
+# A newer run for the same pull request or branch replaces the older one.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
 
@@ -23,12 +34,24 @@ jobs:
       uses: gradle/actions/setup-gradle@v5
       with:
         cache-cleanup: never
+        # Only main writes the dependency cache; pull requests read it.
+        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+    # The repository's wrapper downloads Gradle itself, so cache that download too.
+    - name: Cache Gradle distribution
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.gradle/wrapper
+          .gradle/wrapper-neo
+        key: gradle-dist-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/wrapper/GradleWrapperNeo.java') }}
     - name: Install Xvfb
       run: |
-        sudo apt-get update
-        sudo apt-get install -y xvfb
-    - name: Build with Gradle
-      run: xvfb-run --auto-servernum ./gradlew build --no-daemon --parallel
+        # Skip the slow apt update when the runner image already has it.
+        command -v xvfb-run >/dev/null || { sudo apt-get update && sudo apt-get install -y xvfb; }
+    # One Gradle run builds, tests and runs the code and translation checks, so the
+    # project is configured and compiled once instead of in two workflows.
+    - name: Build and check with Gradle
+      run: xvfb-run --auto-servernum ./gradlew build checkstyle checkTranslations --no-daemon --parallel
       env:
         JAVA_TOOL_OPTIONS: -Djava.awt.headless=true
         MICROSOFT_AUTH_ID: ${{ secrets.MICROSOFT_AUTH_ID }}