Use Gitea Actions for Windows validation

.gitea/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Windows tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-and-build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test with Windows PowerShell 5.1
+        shell: powershell
+        run: .\tests\Run-All.ps1
+      - name: Test with PowerShell 7
+        shell: pwsh
+        run: .\tests\Run-All.ps1
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: Build executable
+        shell: powershell
+        run: .\Build-Executable.ps1 -OutputDirectory .\dist\ci -Version 0.0.1
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ms-private-0.0.1
+          path: |
+            dist/ci/ms-private-0.0.1.exe
+            dist/ci/ms-private-0.0.1.exe.sha256
+            dist/ci/SHA256SUMS.txt

.gitlab-ci.yml

@@ -1,32 +0,0 @@
-stages:
-  - test
-  - build
-
-default:
-  tags:
-    - windows
-
-test:windows-powershell:
-  stage: test
-  script:
-    - powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\tests\Run-All.ps1
-
-test:powershell-7:
-  stage: test
-  script:
-    - pwsh.exe -NoProfile -ExecutionPolicy Bypass -File .\tests\Run-All.ps1
-
-build:executable:
-  stage: build
-  needs:
-    - test:windows-powershell
-    - test:powershell-7
-  script:
-    - powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Build-Executable.ps1 -OutputDirectory .\dist\ci -Version 0.0.1
-  artifacts:
-    name: ms-private-0.0.1
-    paths:
-      - dist/ci/ms-private-0.0.1.exe
-      - dist/ci/ms-private-0.0.1.exe.sha256
-      - dist/ci/SHA256SUMS.txt
-    expire_in: 30 days

Build-Release.ps1

@@ -12,8 +12,8 @@ $zipPath=Join-Path $output ("ms-private-$Version.zip")
 if (Test-Path -LiteralPath $zipPath) {throw 'Archive already exists. Choose an empty output directory to avoid overwriting a release.'}
 $root=[IO.Path]::GetFullPath($PSScriptRoot)
 # Explicit source folders: never include local reports, research archives or dependencies.
-$files=@(Get-ChildItem -LiteralPath $root -File | Where-Object { $_.Extension -in @('.ps1','.md') -or $_.Name -in @('.gitignore','.gitattributes','.gitlab-ci.yml') })
-foreach ($folder in @('src','config','tests','docs','ame','native')) {
+$files=@(Get-ChildItem -LiteralPath $root -File | Where-Object { $_.Extension -in @('.ps1','.md') -or $_.Name -in @('.gitignore','.gitattributes') })
+foreach ($folder in @('src','config','tests','docs','.gitea','ame','native')) {
     $files+=@(Get-ChildItem -LiteralPath (Join-Path $root $folder) -Recurse -File -Force | Where-Object { $_.FullName -notmatch '[\\/](bin|obj)[\\/]' })
 }
 $zip=[IO.Compression.ZipFile]::Open($zipPath,[IO.Compression.ZipArchiveMode]::Create)

docs/VALIDATION.md

@@ -6,7 +6,7 @@ Release-candidate update, 2026-09-22: 114 tests pass in each of Windows PowerShe
 
 The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. `Build-Executable.ps1` must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded `requireAdministrator` manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.
 
-These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The GitLab pipeline requires a Windows runner tagged `windows`; a remote pipeline result does not replace the live matrix.
+These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The Gitea Actions workflow requires a Windows runner labelled `windows-latest`; a remote workflow result does not replace the live matrix.
 
 The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.