Agent/add free portable release

.github/workflows/release.yml

@@ -7,14 +7,16 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
   release:
-    name: Signed Windows release
+    name: Portable Windows release
     runs-on: windows-latest
     timeout-minutes: 60
 
@@ -46,49 +48,22 @@ jobs:
           cargo clippy --workspace --all-targets --locked -- -D warnings
           cargo test --workspace --locked
 
-      - name: Restore signing certificate
+      - name: Build portable Windows archive
         shell: pwsh
-        env:
-          CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
-        run: |
-          if (-not $env:CERTIFICATE_BASE64) {
-            throw "Repository secret WINDOWS_SIGNING_CERTIFICATE_BASE64 is not configured"
-          }
-          $certificatePath = Join-Path $env:RUNNER_TEMP "termy-signing.pfx"
-          [IO.File]::WriteAllBytes(
-            $certificatePath,
-            [Convert]::FromBase64String($env:CERTIFICATE_BASE64)
-          )
-          "TERMY_CERTIFICATE_PATH=$certificatePath" >> $env:GITHUB_ENV
-
-      - name: Build signed MSIX and update feed
-        shell: pwsh
-        env:
-          WINDOWS_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
-        run: |
-          if (-not $env:WINDOWS_SIGNING_CERTIFICATE_PASSWORD) {
-            throw "Repository secret WINDOWS_SIGNING_CERTIFICATE_PASSWORD is not configured"
-          }
-          $releaseBase = "https://github.com/${{ github.repository }}/releases/latest/download"
-          ./packaging/build-msix.ps1 `
-            -Version $env:TERMY_VERSION `
-            -CertificatePath $env:TERMY_CERTIFICATE_PATH `
-            -PackageUri "$releaseBase/termy-x64.msix" `
-            -AppInstallerUri "$releaseBase/termy.appinstaller" `
-            -StableFileNames
+        run: ./packaging/build-portable.ps1 -Version $env:TERMY_VERSION
 
-      - name: Remove private build staging
-        shell: pwsh
-        run: Remove-Item -LiteralPath dist/msix-staging -Recurse -Force
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: dist/termy-windows-x64.zip
 
       - name: Upload workflow artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: termy-${{ env.TERMY_VERSION }}-windows-x64
           path: |
-            dist/termy-x64.msix
-            dist/termy-x64.msix.sha256
-            dist/termy.appinstaller
+            dist/termy-windows-x64.zip
+            dist/termy-windows-x64.zip.sha256
           if-no-files-found: error
           retention-days: 14
 
@@ -100,27 +75,17 @@ jobs:
           gh release view "${{ github.ref_name }}" *> $null
           if ($LASTEXITCODE -eq 0) {
             gh release upload "${{ github.ref_name }}" `
-              dist/termy-x64.msix `
-              dist/termy-x64.msix.sha256 `
-              dist/termy.appinstaller `
+              dist/termy-windows-x64.zip `
+              dist/termy-windows-x64.zip.sha256 `
               --clobber
           } else {
             gh release create "${{ github.ref_name }}" `
-              dist/termy-x64.msix `
-              dist/termy-x64.msix.sha256 `
-              dist/termy.appinstaller `
+              dist/termy-windows-x64.zip `
+              dist/termy-windows-x64.zip.sha256 `
               --verify-tag `
               --generate-notes `
               --title "Termy $env:TERMY_VERSION"
           }
           if ($LASTEXITCODE -ne 0) {
             throw "GitHub Release publication failed"
           }
-
-      - name: Delete temporary signing certificate
-        if: always()
-        shell: pwsh
-        run: |
-          if ($env:TERMY_CERTIFICATE_PATH -and (Test-Path -LiteralPath $env:TERMY_CERTIFICATE_PATH)) {
-            Remove-Item -LiteralPath $env:TERMY_CERTIFICATE_PATH -Force
-          }

README.md

@@ -9,12 +9,14 @@ the window is closed and stores workspace state in SQLite.
 
 ## Install
 
-Public builds are delivered from GitHub Releases as signed Windows packages. Download and open
-[`termy.appinstaller`](https://github.com/GitNimay/ADE-agentic-coding-environment/releases/latest/download/termy.appinstaller).
-Windows App Installer handles installation and checks for signed updates on launch and in the
-background.
+Download
+[`termy-windows-x64.zip`](https://github.com/GitNimay/ADE-agentic-coding-environment/releases/latest/download/termy-windows-x64.zip),
+extract it to a permanent folder, and run `termy.exe`. Windows 11 x64 is required.
 
-The download becomes available after the first signed release. Windows 11 x64 is required.
+The portable build is free and currently unsigned, so Windows SmartScreen may show an unknown
+publisher warning. Each release includes a SHA-256 checksum and GitHub build-provenance attestation.
+Updates are installed manually by downloading the newer ZIP and replacing `termy.exe`; workspace
+data remains in the user's local application-data directory.
 
 Each workspace supports up to six terminals. Layouts are managed by terminal count: two or three
 terminals form one row, four form a 2x2 grid, five use rows of three and two, and six use a 3x2
@@ -64,7 +66,7 @@ Default shortcuts:
 - `Ctrl+PageUp` / `Ctrl+PageDown`: switch workspace
 - `F2`: rename the active workspace
 
-Build an unsigned development MSIX with
-`powershell -ExecutionPolicy Bypass -File packaging\build-msix.ps1`. It is intentionally unsuitable
-for public installation. Maintainer setup and the signed release process are documented in
+Build a portable ZIP with
+`powershell -ExecutionPolicy Bypass -File packaging\build-portable.ps1`. An optional unsigned
+development MSIX can be built with `packaging\build-msix.ps1`. Maintainer release instructions are in
 [`docs/releasing.md`](docs/releasing.md).