Add portable Windows desktop downloads and release uploads

desktop/publish.mjs

@@ -0,0 +1,65 @@
+import { copyFile, mkdir, readFile, writeFile, stat } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+const require = createRequire(import.meta.url);
+const asar = require("@electron/asar");
+const archive = fileURLToPath(
+  new URL("./dist/win-unpacked/resources/app.asar", import.meta.url),
+);
+let privateTerms = [];
+try {
+  const remote = execFileSync("git", ["remote", "get-url", "origin"], {
+    cwd: fileURLToPath(new URL("..", import.meta.url)),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    windowsHide: true,
+  }).trim();
+  const hostname = remote.includes("://")
+    ? new URL(remote).hostname
+    : remote.split("@").pop().split(":")[0];
+  privateTerms = [remote, hostname]
+    .filter(Boolean)
+    .map((term) => term.toLowerCase());
+} catch {
+  /* Source snapshots need no Git metadata. */
+}
+for (const entry of asar.listPackage(archive)) {
+  const name = entry.replace(/^[/\\]+/, "");
+  if (!asar.statFile(archive, name).files) {
+    const content = asar
+      .extractFile(archive, name)
+      .toString("utf8")
+      .toLowerCase();
+    if (privateTerms.some((term) => content.includes(term)))
+      throw new Error(`Private Git reference in desktop archive: ${name}`);
+  }
+}
+console.log("Desktop archive privacy scan passed.");
+const pkg = JSON.parse(
+  await readFile(new URL("./package.json", import.meta.url), "utf8"),
+);
+const file = `MineGeo-${pkg.version}-windows-x64.exe`;
+const source = new URL(`./dist/${file}`, import.meta.url);
+const directory = new URL("../public/desktop/", import.meta.url);
+await mkdir(directory, { recursive: true });
+await copyFile(source, new URL(file, directory));
+const sha256 = createHash("sha256")
+  .update(await readFile(source))
+  .digest("hex");
+await writeFile(new URL(`${file}.sha256`, directory), `${sha256}  ${file}\n`);
+await writeFile(
+  new URL("../shared/desktop-release.json", import.meta.url),
+  JSON.stringify(
+    {
+      version: pkg.version,
+      file: `/desktop/${file}`,
+      bytes: (await stat(source)).size,
+      sha256,
+    },
+    null,
+    2,
+  ) + "\n",
+);
+console.log(`Published ${file} (${sha256})`);