Add gdlint job + gdlintrc to Gitea CI

Lints scripts/, db/, scenes/ via gdtoolkit==4.* on ubuntu-latest
(Python, no Godot needed), in parallel with the validate job.
addons/ (third-party LOD plugin) and developers/ (sandbox) are
left out. Non-blocking for now: the export jobs still only need
validate, so a lint regression won't break builds while the
Godot-3 leftover code is being cleaned up.

gdlintrc bumps max-line-length from 100 to 140 because Godot
$-style node paths and typed signatures routinely push past 100
without that being a real readability problem.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/README.md

@@ -8,6 +8,7 @@ Workflow defined in [`build.yml`](./build.yml). Triggered on push / PR to
 | Job                  | Image                       | Role                                                                                     |
 |----------------------|-----------------------------|------------------------------------------------------------------------------------------|
 | `validate`           | `barichello/godot-ci:4.6`   | `godot --headless --import` then grep for `SCRIPT ERROR` / `Parse Error`. Uploads `.godot/` cache. |
+| `lint`               | `ubuntu-latest` (Python)    | `gdlint scripts db scenes` via `gdtoolkit==4.*` (Scony). Parallel to `validate`; does not gate exports yet. |
 | `export-desktop`     | `barichello/godot-ci:4.6`   | Matrix: Windows / Linux / macOS. Reuses the import cache, uploads each binary as artifact. |
 | `export-android`     | `barichello/godot-ci:4.6` + JDK 17 + Android SDK installed at runtime | Provisions keystore, writes `editor_settings-4.tres` with SDK / JDK paths, exports APK. |
 
@@ -31,6 +32,21 @@ Artifacts are kept 14 days, accessible from the Gitea run page.
    stored as a Gitea repo secret. Without it, a throwaway keystore is
    generated per run, so the APK signature changes every build.
 
+## Linting
+
+`gdlint` (from Scony's `gdtoolkit`) runs in the `lint` job over `scripts/`,
+`db/`, and `scenes/`. `addons/` (third-party LOD plugin) and `developers/`
+(sandbox) are intentionally excluded.
+
+The job is **non-blocking** today — the export jobs only depend on
+`validate`, so a lint failure prints warnings but still produces binaries.
+Once the codebase is clean, switch the export jobs' `needs: validate` to
+`needs: [validate, lint]` to make lint a hard gate.
+
+Suppress specific rules per-line with `# gdlint: disable=<rule>` or
+project-wide with a `gdlintrc` file at the repo root (see
+[gdtoolkit docs](https://github.com/Scony/godot-gdscript-toolkit/wiki)).
+
 ## Differences from the old `.drone.yml`
 
 - No more Drone, no more Butler — build only, artifacts downloadable from

.gitea/workflows/build.yml

@@ -43,7 +43,28 @@ jobs:
           retention-days: 1
 
   # ---------------------------------------------------------------------------
-  # 2. Desktop exports (Windows / Linux / macOS) — runs in parallel.
+  # 2. Static analysis — gdlint from Scony's gdtoolkit (Python, no Godot).
+  #    Runs in parallel with `validate`. Exports do NOT depend on this job,
+  #    so a lint failure does not block builds while the Godot-3 leftovers
+  #    are still being cleaned up. Once the tree is clean, add this job to
+  #    the `needs:` of the export jobs to make it a hard gate.
+  # ---------------------------------------------------------------------------
+  lint:
+    name: Lint GDScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install gdtoolkit
+        run: |
+          python3 -m pip install --user "gdtoolkit==4.*"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Run gdlint
+        run: gdlint scripts db scenes
+
+  # ---------------------------------------------------------------------------
+  # 3. Desktop exports (Windows / Linux / macOS) — runs in parallel.
   #    macOS preset must be added in the Godot editor before this matrix entry
   #    can succeed (export_presets.cfg currently has none).
   # ---------------------------------------------------------------------------
@@ -93,7 +114,7 @@ jobs:
           retention-days: 14
 
   # ---------------------------------------------------------------------------
-  # 3. Android export — needs JDK + Android SDK on top of the Godot image.
+  # 4. Android export — needs JDK + Android SDK on top of the Godot image.
   #    Provide ANDROID_KEYSTORE_BASE64 as a Gitea secret for a stable signature;
   #    otherwise a fresh debug keystore is generated on each run.
   # ---------------------------------------------------------------------------

gdlintrc

@@ -0,0 +1,7 @@
+# gdtoolkit / gdlint config
+# https://github.com/Scony/godot-gdscript-toolkit/wiki
+
+# Godot $-paths and typed signatures push lines well past 100 cols routinely;
+# 140 keeps the rule as a "no absurdly long line" safety net without forcing
+# constant manual wrapping of node paths.
+max-line-length: 140