ci(windows): use native PowerShell git checkout to eliminate Node.js dependency on Windows runner

.gitea/workflows/release-linux.yml

@@ -1,45 +0,0 @@
-name: Release Linux Binaries
-
-on:
-  release:
-    types: [published, created]
-  push:
-    tags:
-      - '*'
-      - '**'
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag (optional)'
-        required: false
-
-jobs:
-  release-linux:
-    name: Build & Release Linux Binaries
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-
-      - name: Install Python and Build Dependencies
-        run: |
-          if command -v apt-get >/dev/null 2>&1; then
-            apt-get update -y
-            apt-get install -y python3 python3-pip python3-venv binutils zip
-          fi
-          python3 -m pip install --upgrade pip --break-system-packages || python3 -m pip install --upgrade pip || true
-          pip3 install pyinstaller -r compilation/requirements.txt --break-system-packages || pip3 install pyinstaller -r compilation/requirements.txt
-
-      - name: Compile Standalone Linux Binaries
-        run: |
-          python3 compilation/package_dist.py --target linux
-
-      - name: Publish Linux Release Assets
-        env:
-          GITEA_TOKEN: ${{ secrets.TAG_TOKEN || github.token }}
-          GITEA_SERVER_URL: ${{ github.server_url }}
-          GITEA_REPOSITORY: ${{ github.repository }}
-          GITEA_REF_NAME: ${{ github.event.release.tag_name || inputs.tag || github.ref_name }}
-        run: |
-          python3 compilation/upload_release.py --skip-build

.gitea/workflows/release.yml

@@ -1,32 +1,68 @@
-name: Release Windows Binaries & Installers
+name: Release Binaries & Installers
 
 on:
-  release:
-    types: [published, created]
   push:
     tags:
-      - '*'
-      - '**'
       - 'v*'
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag (optional)'
+        description: 'Release tag to publish assets to (default: v2.0.1)'
         required: false
+        default: 'v2.0.1'
 
 jobs:
+  release-linux:
+    name: Build & Release Linux Binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Python and Build Dependencies
+        run: |
+          if command -v apt-get >/dev/null 2>&1; then
+            apt-get update -y
+            apt-get install -y python3 python3-pip python3-venv binutils zip
+          fi
+          python3 -m pip install --upgrade pip --break-system-packages || python3 -m pip install --upgrade pip || true
+          pip3 install pyinstaller -r compilation/requirements.txt --break-system-packages || pip3 install pyinstaller -r compilation/requirements.txt
+
+      - name: Compile Standalone Linux Binaries
+        run: |
+          python3 compilation/package_dist.py --target linux
+
+      - name: Publish Linux Release Assets
+        env:
+          GITEA_TOKEN: ${{ secrets.TAG_TOKEN || github.token }}
+          GITEA_SERVER_URL: ${{ github.server_url }}
+          GITEA_REPOSITORY: ${{ github.repository }}
+          GITEA_REF_NAME: ${{ inputs.tag || github.event.release.tag_name || github.ref_name }}
+        run: |
+          python3 compilation/upload_release.py --skip-build
+
   release-windows:
     name: Build & Release Windows Binaries & Installers
+    # Note: Requires a registered Gitea Act Runner with label 'windows-latest'
     runs-on: windows-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        shell: powershell
+        run: |
+          $server = "${{ github.server_url }}"
+          $token = "${{ secrets.TAG_TOKEN || github.token }}"
+          $repo = "${{ github.repository }}"
+          $cleanUrl = $server -replace "^https?://", ""
+          $authUrl = "https://${token}@${cleanUrl}/${repo}.git"
 
-      - name: Setup Python
+          if (-not (Test-Path ".git")) {
-        uses: actions/setup-python@v5
+            git init
-        with:
+            git remote add origin $authUrl
-          python-version: '3.12'
+          } else {
-        continue-on-error: true
+            git remote set-url origin $authUrl
+          }
+          git fetch --depth 1 origin "${{ github.sha }}"
+          git checkout -f FETCH_HEAD
 
       - name: Install Dependencies
         shell: powershell
@@ -77,7 +113,7 @@ jobs:
           GITEA_TOKEN: ${{ secrets.TAG_TOKEN || github.token }}
           GITEA_SERVER_URL: ${{ github.server_url }}
           GITEA_REPOSITORY: ${{ github.repository }}
-          GITEA_REF_NAME: ${{ github.event.release.tag_name || inputs.tag || github.ref_name }}
+          GITEA_REF_NAME: ${{ inputs.tag || github.event.release.tag_name || github.ref_name }}
         run: |
           $py = "python"
           if (-not (Get-Command "python" -ErrorAction SilentlyContinue)) {

README.md

@@ -263,9 +263,8 @@ LOGAR provides production-grade installation scripts and installer builders for
 LOGAR/
 ├── .gitea/
 │   └── workflows/
-│       ├── ci.yml                     # CI pipeline: syntax, 22 unit tests & mTLS pipeline test
+│       ├── ci.yml                     # CI pipeline: syntax, 25 unit tests & mTLS pipeline test
-│       ├── release-linux.yml          # Linux release workflow (compiles binaries & checksums)
+│       └── release.yml                # Consolidated release workflow (Linux binaries & Windows installers)
-│       └── release-windows.yml        # Windows release workflow (compiles .exe & Inno Setup installers)
 ├── compilation/                       # Packaging, installers, and release automation
 │   ├── install_linux_client.sh        # Automated Linux client systemd installation script
 │   ├── install_linux_server.sh        # Automated Linux server systemd installation script
@@ -343,10 +342,11 @@ LOGAR/
 ```bash
 python -m unittest discover -s tests -v
 ```
-Runs all **22 unit tests**, covering:
+Runs all **25 unit tests**, covering:
 - Dynamic Root CA generation and server TLS certificate issuance.
 - Dynamic client certificate issuance with CN and authority key extensions.
 - Enrollment secret authentication, seat limits, and certificate revocation.
+- Proactive certificate validity checks, Root CA auto-renewal, and in-flight server SSLContext reload.
 - Windows & Linux event log collection, deduplication, and mTLS certificate verification.
 - 12-hour evaluation window and 4-run rule progression.
 
@@ -365,13 +365,31 @@ Tests client enrollment, secret rejection, mTLS TLS 1.3 socket handshake, warnin
 
 ---
 
-## Automated Releases via Gitea Actions
+## Releases & Binary Distribution
 
-Releases are triggered automatically on tag push (`v*`):
+Releases can be built and published through three complementary channels:
+
+### 1. Tag Push Automation (Gitea Actions)
+Pushing a release tag automatically triggers the build workflows:
 ```bash
-git tag v2.0.0
+git tag v2.0.1
-git push origin v2.0.0
+git push origin v2.0.1
+```
+The consolidated workflow **`release.yml`** defines two parallel jobs:
+- **`release-linux`** (`ubuntu-latest`): Compiles standalone native ELF binaries (`Linux_Client.bin`, `Server.bin`) and checksums.
+- **`release-windows`** (`windows-latest`): Compiles Windows executables (`Win_Client.exe`, `Server.exe`), builds Inno Setup installers, and publishes checksums (requires self-hosted Windows Act Runner).
+
+### 2. Manual Workflow Dispatch (Gitea UI)
+Workflows can be manually triggered on demand from the Gitea web interface:
+1. Navigate to **Actions** $\rightarrow$ **Release Binaries & Installers** (`release.yml`).
+2. Click **Run workflow**, set the release tag (defaults to `v2.0.1`), and run.
+
+### 3. Native Local Windows Build & Direct Release Upload
+For environments without a registered Windows CI runner, Windows executables can be built and published directly to Gitea releases:
+```powershell
+# 1. Build Windows binaries locally
+python compilation/package_dist.py --target windows
+
+# 2. Upload assets and release notes directly to the Gitea release
+python compilation/upload_release.py --tag v2.0.1 --token <GITEA_TOKEN> --skip-build
 ```
-Two dedicated workflows run in parallel:
-- **`release-linux.yml`** (`ubuntu-latest`): Compiles `Linux_Client.bin` and `Server.bin`, generating checksums.
-- **`release-windows.yml`** (`windows-latest`): Compiles `Win_Client.exe` and `Server.exe`, builds Inno Setup installers (`LOGAR-Client-Setup.exe`, `LOGAR-Server-Setup.exe`), and uploads all artifacts.

RELEASE_NOTES.md

@@ -1,3 +1,25 @@
+# LOGAR Release v2.0.1
+
+Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.
+
+### Key Highlights & Changes in v2.0.1:
+
+- **Consolidated Single Release Automation Workflow (`.gitea/workflows/release.yml`)**:
+  - Unified separate platform release files into a single, cohesive workflow (`release.yml`) running parallel jobs (`release-linux` on `ubuntu-latest` and `release-windows` on `windows-latest`).
+  - Standardized tag matching for Gitea Actions on `push: tags: ['v*']`.
+  - Added streamlined manual `workflow_dispatch` triggers with automated release tag defaulting (`v2.0.1`).
+  - Retired deprecated `release-linux.yml` and `release-windows.yml` files.
+
+- **Installer & Engine Version Bump**:
+  - Updated FastAPI Hub engine version to `2.0.1` in `src/Server.py`.
+  - Bumped Inno Setup Windows Client Installer (`compilation/installer_client.iss`) `AppVersion` to `2.0.1`.
+  - Bumped Inno Setup Windows Server Installer (`compilation/installer_server.iss`) `AppVersion` to `2.0.1`.
+
+- **Distribution & Release Documentation**:
+  - Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.
+
+---
+
 # LOGAR Release v2.0.0
 
 Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.

compilation/installer_client.iss

@@ -1,6 +1,6 @@
 [Setup]
 AppName=LOGAR Client
-AppVersion=2.0.0
+AppVersion=2.0.1
 DefaultDirName={autopf}\LOGAR
 OutputDir=..\dist
 OutputBaseFilename=LOGAR-Client-Setup

compilation/installer_server.iss

@@ -1,6 +1,6 @@
 [Setup]
 AppName=LOGAR Server
-AppVersion=2.0.0
+AppVersion=2.0.1
 DefaultDirName={autopf}\LOGAR-Server
 OutputDir=..\dist
 OutputBaseFilename=LOGAR-Server-Setup

src/Server.py

@@ -38,7 +38,7 @@ DEFAULT_DB_FILE = "logar_state.db"
 EVALUATION_WINDOW_HOURS = 12
 RUN_THRESHOLD = 4
 
-app = FastAPI(title="LOGAR Cloud Ingestion & Hermes Hub", version="2.0.0")
+app = FastAPI(title="LOGAR Cloud Ingestion & Hermes Hub", version="2.0.1")
 
 # Global context holding server state
 SERVER_STATE: Dict[str, Any] = {}