chore: ignore Task cache directory

Task (used by wails3 via Taskfile.yml) stores incremental-build fingerprints under .task/checksum/. Purely local cache — hashes of sources/deps, machine-generated, recreated on next wails3 dev/build. Keep it out of git like node_modules/frontend/dist/build/bin (already ignored). No files were tracked; this just stops it showing as untracked on branches that have run wails3.

.gitea/workflows/release.yml

@@ -80,10 +80,27 @@ jobs:
           go-version: '1.25'
           cache-dependency-path: go.sum
 
+      - name: Cache Go build cache
+        uses: actions/cache@v4
+        with:
+          # setup-go only caches modules (GOMODCACHE). This caches compiled
+          # packages (GOCACHE) so the cgo/WebKit compile goes incremental.
+          # restore-keys gives a close cache instead of a cold one when
+          # go.sum changes. First run after adding this still compiles cold
+          # (it saves); the payoff shows from the second run on.
+          path: ~/.cache/go-build
+          key: go-build-1.25-${{ runner.os }}-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-build-1.25-${{ runner.os }}-
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          # Caches npm's download cache keyed on the frontend lockfile, so
+          # the `npm install` inside `wails build` stops fetching cold.
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
 
       - name: Install Wails Linux build dependencies
         run: |
@@ -94,11 +111,23 @@ jobs:
             libgtk-3-dev libwebkit2gtk-4.1-dev \
             jq
 
+      - name: Cache Wails CLI
+        uses: actions/cache@v4
+        id: wails-cli
+        with:
+          # The compiled CLI binary. Bump the key whenever the @version pin
+          # below changes, or the old CLI will be silently reused.
+          path: ~/go/bin/wails
+          key: wails-v2.15.0-${{ runner.os }}
+
       - name: Install Wails CLI
+        if: steps.wails-cli.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
           go install github.com/wailsapp/wails/v2/cmd/wails@v2.15.0
-          echo "${HOME}/go/bin" >> "${GITHUB_PATH}"
+
+      - name: Add Go bin to PATH
+        run: echo "${HOME}/go/bin" >> "${GITHUB_PATH}"
 
       - name: Write environment.go from secrets
         env:

.gitignore

@@ -23,10 +23,13 @@ go.work
 
 # ---> Wails
 build/bin
+.task/
 node_modules
 frontend/dist
 package.json.md5
-package-lock.json
+# Root-level lockfile only: the frontend lockfile IS tracked so CI installs
+# are reproducible and setup-node's npm cache has something to hash.
+/package-lock.json
 .idea
 .env
 environment.go