added msi to release pipeline

.gitea/workflows/release.yml

@@ -84,6 +84,10 @@ jobs:
           # reserves the last one, so it carries nothing the tag could tell
           "version=$($tag.Substring(1)).0" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
 
+          # The installer answers to nobody about a fourth number and takes the
+          # tag as it is
+          "plain=$($tag.Substring(1))" | Out-File $env:GITHUB_OUTPUT -Append -Encoding utf8
+
       - name: Show the toolchain
         run: dotnet --info
 
@@ -128,6 +132,12 @@ jobs:
 
           ./Packaging/build-msix.ps1 @arguments
 
+      # The other half of the release: the same application as an ordinary
+      # installer, for handing round outside the Store. Nobody signs it, so
+      # SmartScreen warns about it — see Packaging\installer.iss
+      - name: Build the installer
+        run: ./Packaging/build-installer.ps1 -Version ${{ steps.version.outputs.plain }}
+
       # The artifact is where the package waits to be uploaded to Partner Center
       - name: Keep the package
         uses: actions/upload-artifact@v4
@@ -135,3 +145,52 @@ jobs:
           name: msix-${{ steps.version.outputs.version }}
           path: artifacts/packages/
           if-no-files-found: error
+
+      # The .wixpdb next to each installer is left out on purpose: it is of use
+      # only when something has to be traced back to the WiX source
+      - name: Keep the installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer-${{ steps.version.outputs.plain }}
+          path: artifacts/installers/*.msi
+          if-no-files-found: error
+
+      # Only the installers go into the release. The MSIX stays in the artifacts
+      # of the run: unsigned, it installs nowhere, and its one destination is
+      # Partner Center
+      - name: Publish the release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          # The GITHUB_ names are what Gitea itself hands to the workflow — its
+          # actions repeat those of GitHub, and the addresses in them point at
+          # this Gitea instance. GITHUB_API_URL used not to reach the steps at
+          # all, so the address is put together from the server one when empty
+          $root = if ($env:GITHUB_API_URL) { $env:GITHUB_API_URL } else { "$env:GITHUB_SERVER_URL/api/v1" }
+          $api = "$root/repos/$env:GITHUB_REPOSITORY/releases"
+          $headers = @{ Authorization = "token $env:GITEA_TOKEN" }
+
+          # Gitea makes a release of its own for a pushed tag, so the release is
+          # looked up first and only made when it is not there
+          $release = $null
+          try { $release = Invoke-RestMethod "$api/tags/$env:TAG" -Headers $headers } catch { }
+
+          if (-not $release) {
+              $body = @{ tag_name = $env:TAG; name = $env:TAG; draft = $false; prerelease = $false } | ConvertTo-Json
+              $release = Invoke-RestMethod $api -Method Post -Headers $headers -ContentType 'application/json' -Body $body
+          }
+
+          foreach ($file in Get-ChildItem artifacts/installers -File -Filter *.msi) {
+              # A tag can be pushed again after it was deleted; the old file of
+              # the same name is dropped, otherwise the upload is refused
+              $existing = $release.assets | Where-Object { $_.name -eq $file.Name }
+              foreach ($asset in $existing) {
+                  Invoke-RestMethod "$api/$($release.id)/assets/$($asset.id)" -Method Delete -Headers $headers | Out-Null
+              }
+
+              Write-Host "Uploading $($file.Name)"
+              Invoke-RestMethod "$api/$($release.id)/assets?name=$($file.Name)" -Method Post -Headers $headers -Form @{ attachment = $file } | Out-Null
+          }