Fix Windows release CI parsing and publish Forgejo via git.avelo.top.

Use pwsh -File with UTF-8 BOM scripts, and default Forgejo uploads to the public domain when LAN IP is unreachable.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/release-windows.yml

@@ -25,7 +25,8 @@ jobs:
       - name: Build release stage
         shell: pwsh
         run: |
-          powershell -ExecutionPolicy Bypass -File ./packaging/build_release.ps1 -CreateVenv
+          # Use pwsh -File (UTF-8). Nested Windows PowerShell 5.1 mis-parses UTF-8 scripts without BOM.
+          & ./packaging/build_release.ps1 -CreateVenv
 
       - name: Install Inno Setup
         shell: pwsh

packaging/README.md

@@ -122,7 +122,7 @@ Do this on the **dev PC on the home LAN** after bumping version:
 
 1. **Build** — `.\packaging\build_release.ps1 -CreateVenv` + Inno Setup → `NetX-Setup-*.exe`
 2. **GitHub** — `.\packaging\publish_release.ps1 -Version x.y.z` (uploads Setup.exe only)
-3. **Forgejo (intranet)** — upload the same Setup.exe to QNAP Forgejo; public `git.avelo.top` is only a reverse proxy to the same instance:
+3. **Forgejo** — upload the same Setup.exe (default: public domain `https://git.avelo.top`):
 
 ```powershell
 # One-time: User env var (never commit the token)
@@ -130,23 +130,22 @@ Do this on the **dev PC on the home LAN** after bumping version:
 [Environment]::SetEnvironmentVariable("NETX_FORGEJO_TOKEN", "your_token", "User")
 # Restart Cursor / open a new terminal so the agent/scripts see it
 
-# Default publishes to LAN Forgejo; public git.avelo.top shows the same Release.
-.\packaging\publish_forgejo_release.ps1 -Version 0.4.0
+# Default: https://git.avelo.top
+.\packaging\publish_forgejo_release.ps1 -Version 0.4.11
 
-# Only when off the home LAN:
-# .\packaging\publish_forgejo_release.ps1 -Version 0.4.0 -ForgejoBase "https://git.avelo.top"
+# Optional when LAN IP is reachable:
+# .\packaging\publish_forgejo_release.ps1 -Version 0.4.11 -ForgejoBase "http://10.0.0.131:3000"
 ```
 
 | Role | URL |
 |------|-----|
-| Publish default (home LAN) | `http://10.0.0.131:3000` (`-ForgejoBase` default) |
-| Clients / remote clone | `https://git.avelo.top` (Caddy → `10.0.0.131:3000`) |
+| Publish default | `https://git.avelo.top` (`-ForgejoBase` default) |
+| Optional LAN | `http://10.0.0.131:3000` |
 | Update probe (default) | GitHub + `https://git.avelo.top/.../releases/latest` |
 
 Verify:
 
-- LAN: http://10.0.0.131:3000/hansjone/netx/releases
-- Public: https://git.avelo.top/hansjone/netx/releases
+- https://git.avelo.top/hansjone/netx/releases
 - Probe: `.\packaging\check_update.ps1` → both `github` and `forgejo` reachable with the new version
 
 Token: `NETX_FORGEJO_TOKEN` (or `FORGEJO_TOKEN`).

packaging/build_release.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$Version = "",
     [string]$OutDir = "",
     [switch]$SkipWebBuild = $false,
@@ -128,13 +128,13 @@ if (Test-Path $winswShip) {
     Copy-Item -Path $winswShip -Destination (Join-Path $winswOut "WinSW-x64.exe") -Force
     Write-Host "==> Bundled WinSW for offline service install"
 } else {
-    Write-Host "[WARN] WinSW missing — offline service install will fail" -ForegroundColor Yellow
+    Write-Host "[WARN] WinSW missing - offline service install will fail" -ForegroundColor Yellow
 }
 New-Item -ItemType Directory -Path (Join-Path $packOut "postgres") -Force | Out-Null
 Copy-Item -Path (Join-Path $PSScriptRoot "postgres\README.md") -Destination (Join-Path $packOut "postgres\README.md") -Force
 
 if (Test-Path (Join-Path $pgsql "bin\pg_ctl.exe")) {
-    Write-Host "==> Copying bundled PostgreSQL (bin/lib/share; skip doc/)"
+    Write-Host '==> Copying bundled PostgreSQL (bin/lib/share; skip doc/)'
     $pgStage = Join-Path $stage "postgres\pgsql"
     New-Item -ItemType Directory -Path $pgStage -Force | Out-Null
     foreach ($sub in @("bin", "lib", "share")) {
@@ -196,7 +196,7 @@ if ($CreateVenv) {
 
     $venvDir = Join-Path $stage ".venv"
     if (Test-Path $venvDir) { Remove-Item -Recurse -Force $venvDir }
-    Write-Host "==> Creating .venv from shipped runtime (--copies)"
+    Write-Host '==> Creating .venv from shipped runtime (--copies)'
     & $rtPy -m venv $venvDir --copies
     if ($LASTEXITCODE -ne 0) { throw "venv_create_failed" }
 

packaging/check_update.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$ProgramRoot = "",
     [string]$DataRoot = "",
     [string]$UpdateUrl = "",

packaging/publish_forgejo_release.ps1

@@ -1,6 +1,6 @@
-param(
+param(
     [string]$Version = "",
-    [string]$ForgejoBase = "http://10.0.0.131:3000",
+    [string]$ForgejoBase = "https://git.avelo.top",
     [string]$Owner = "hansjone",
     [string]$Repo = "netx",
     [string]$Token = "",
@@ -9,14 +9,14 @@ param(
 
 # Publish Windows Setup.exe to Forgejo/Gitea (mirror sync does NOT copy GitHub Release files).
 # Requires a Forgejo token with repo write (Settings → Applications → Generate New Token).
-# Default: home LAN Forgejo. Public git.avelo.top is the same instance (VPS reverse proxy).
+# Default: https://git.avelo.top (public domain). LAN IP only when explicitly reachable.
 #
-# Example (usual — LAN):
+# Example:
 #   $env:NETX_FORGEJO_TOKEN = "..."   # or User env NETX_FORGEJO_TOKEN
-#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.0
+#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.11
 #
-# Away from LAN only (hairpins via VPS):
-#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.0 -ForgejoBase "https://git.avelo.top"
+# Optional LAN (when 10.0.0.131 is reachable):
+#   .\packaging\publish_forgejo_release.ps1 -Version 0.4.11 -ForgejoBase "http://10.0.0.131:3000"
 
 $ErrorActionPreference = "Stop"
 . "$PSScriptRoot\_common.ps1"

packaging/publish_release.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [string]$Version = "",
     [switch]$SkipBuild = $false,
     [switch]$SkipInstaller = $false,

packaging/update_netx.ps1

@@ -1,4 +1,4 @@
-param(
+param(
     [Parameter(Mandatory = $true)]
     [string]$PackagePath,
     [string]$ProgramRoot = "",