From 942b8493062718aca8ec418d3e4f0ea87ee2f6ed Mon Sep 17 00:00:00 2001
From: 0x000 <0x000>
Date: Tue, 22 Sep 2026 21:25:53 -0400
Subject: [PATCH] Use Gitea Actions for Windows validation

---
 .gitea/workflows/test.yml | 31 +++++++++++++++++++++++++++++++
 .gitlab-ci.yml            | 32 --------------------------------
 Build-Release.ps1         |  4 ++--
 docs/VALIDATION.md        |  2 +-
 4 files changed, 34 insertions(+), 35 deletions(-)
 create mode 100644 .gitea/workflows/test.yml
 delete mode 100644 .gitlab-ci.yml

diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
new file mode 100644
index 0000000..85604dc
--- /dev/null
+++ b/.gitea/workflows/test.yml
@@ -0,0 +1,31 @@
+name: Windows tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-and-build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test with Windows PowerShell 5.1
+        shell: powershell
+        run: .\tests\Run-All.ps1
+      - name: Test with PowerShell 7
+        shell: pwsh
+        run: .\tests\Run-All.ps1
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+      - name: Build executable
+        shell: powershell
+        run: .\Build-Executable.ps1 -OutputDirectory .\dist\ci -Version 0.0.1
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ms-private-0.0.1
+          path: |
+            dist/ci/ms-private-0.0.1.exe
+            dist/ci/ms-private-0.0.1.exe.sha256
+            dist/ci/SHA256SUMS.txt
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
deleted file mode 100644
index bb1ef17..0000000
--- a/.gitlab-ci.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-stages:
-  - test
-  - build
-
-default:
-  tags:
-    - windows
-
-test:windows-powershell:
-  stage: test
-  script:
-    - powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\tests\Run-All.ps1
-
-test:powershell-7:
-  stage: test
-  script:
-    - pwsh.exe -NoProfile -ExecutionPolicy Bypass -File .\tests\Run-All.ps1
-
-build:executable:
-  stage: build
-  needs:
-    - test:windows-powershell
-    - test:powershell-7
-  script:
-    - powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Build-Executable.ps1 -OutputDirectory .\dist\ci -Version 0.0.1
-  artifacts:
-    name: ms-private-0.0.1
-    paths:
-      - dist/ci/ms-private-0.0.1.exe
-      - dist/ci/ms-private-0.0.1.exe.sha256
-      - dist/ci/SHA256SUMS.txt
-    expire_in: 30 days
diff --git a/Build-Release.ps1 b/Build-Release.ps1
index a2c1ed8..6d0e539 100644
--- a/Build-Release.ps1
+++ b/Build-Release.ps1
@@ -12,8 +12,8 @@ $zipPath=Join-Path $output ("ms-private-$Version.zip")
 if (Test-Path -LiteralPath $zipPath) {throw 'Archive already exists. Choose an empty output directory to avoid overwriting a release.'}
 $root=[IO.Path]::GetFullPath($PSScriptRoot)
 # Explicit source folders: never include local reports, research archives or dependencies.
-$files=@(Get-ChildItem -LiteralPath $root -File | Where-Object { $_.Extension -in @('.ps1','.md') -or $_.Name -in @('.gitignore','.gitattributes','.gitlab-ci.yml') })
-foreach ($folder in @('src','config','tests','docs','ame','native')) {
+$files=@(Get-ChildItem -LiteralPath $root -File | Where-Object { $_.Extension -in @('.ps1','.md') -or $_.Name -in @('.gitignore','.gitattributes') })
+foreach ($folder in @('src','config','tests','docs','.gitea','ame','native')) {
     $files+=@(Get-ChildItem -LiteralPath (Join-Path $root $folder) -Recurse -File -Force | Where-Object { $_.FullName -notmatch '[\\/](bin|obj)[\\/]' })
 }
 $zip=[IO.Compression.ZipFile]::Open($zipPath,[IO.Compression.ZipArchiveMode]::Create)
diff --git a/docs/VALIDATION.md b/docs/VALIDATION.md
index 273833d..353c46a 100644
--- a/docs/VALIDATION.md
+++ b/docs/VALIDATION.md
@@ -6,7 +6,7 @@ Release-candidate update, 2026-09-22: 114 tests pass in each of Windows PowerShe
 
 The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. `Build-Executable.ps1` must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded `requireAdministrator` manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.
 
-These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The GitLab pipeline requires a Windows runner tagged `windows`; a remote pipeline result does not replace the live matrix.
+These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The Gitea Actions workflow requires a Windows runner labelled `windows-latest`; a remote workflow result does not replace the live matrix.
 
 The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.