From ca357f0adc4ab43460bfd8445d9e9aa129e39d62 Mon Sep 17 00:00:00 2001
From: SG Command <sgcommand@git.warky.dev>
Date: Tue, 13 Oct 2026 19:08:15 +0200
Subject: [PATCH] ci: verify Windows installer build on PRs and fail release on
 upload errors

Refs #33

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/release.yml |  4 +++-
 .github/workflows/ci.yml     | 26 ++++++++++++++++++++++++++
 windows/README.md            |  2 +-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 6172687..51431d3 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -87,10 +87,12 @@ jobs:
 
       - name: Build Windows installer
         run: |
+          set -euo pipefail
           sudo apt-get update
           sudo apt-get install -y nsis
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           makensis -DVERSION="${VERSION#v}" -DEXE="$PWD/relspec-windows-amd64.exe" -DOUT="$PWD/relspec-setup-windows-amd64.exe" windows/installer.nsi
+          test -s relspec-setup-windows-amd64.exe
 
       - name: Build source archives
         run: |
@@ -130,7 +132,7 @@ jobs:
 
           for f in relspec-* relspec_*.tar.gz; do
             echo "Uploading $f..."
-            curl -s -X POST "${UPLOAD_URL}?name=${f}" \
+            curl -sS --fail -X POST "${UPLOAD_URL}?name=${f}" \
               -H "Authorization: token ${GITHUB_TOKEN}" \
               -H "Content-Type: application/octet-stream" \
               --data-binary "@${f}" > /dev/null
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 601e779..7dd53db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,3 +97,29 @@ jobs:
       run: |
         go mod tidy
         git diff --exit-code go.mod go.sum
+
+  installer-windows:
+    name: Windows installer
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.25'
+
+    - name: Install NSIS
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y nsis
+
+    - name: Build installer
+      run: make installer-windows
+
+    - name: Verify installer exists
+      run: |
+        test -s build/relspec-setup-windows-amd64.exe
+        ls -lh build/relspec-setup-windows-amd64.exe
diff --git a/windows/README.md b/windows/README.md
index 25865d1..ca0e6aa 100644
--- a/windows/README.md
+++ b/windows/README.md
@@ -8,7 +8,7 @@ NSIS script: `installer.nsi`. Output: `build/relspec-setup-windows-amd64.exe`.
 make installer-windows
 ```
 
-Needs `makensis` (package `nsis`). CI builds and uploads it on release.
+Needs `makensis` (package `nsis`). CI builds it on every PR (`installer-windows` job); the release workflow uploads it as `relspec-setup-windows-amd64.exe`.
 
 ## Installer