Add CI/CD: auto-build and publish xetup.exe on push to main

- .forgejo/workflows/release.yml: builds Windows exe on Go/script changes,
  deletes and recreates floating 'latest' release with new asset
- web/nginx.conf: /dl now points to .../download/latest/xetup.exe permanently
- runner.go: fix embed.FS path separator (filepath -> path) for Windows compat

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -0,0 +1,63 @@
+name: release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'scripts/**'
+      - 'assets/**'
+      - 'embed.go'
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.23-alpine
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build xetup.exe
+        run: |
+          GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o xetup.exe ./cmd/xetup/
+          echo "Built: $(ls -lh xetup.exe | awk '{print $5}')"
+
+      - name: Publish latest release
+        env:
+          TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          API:   ${{ github.server_url }}/api/v1
+          REPO:  ${{ github.repository }}
+        run: |
+          apk add --no-cache curl jq
+
+          SHORT=$(echo "$GITHUB_SHA" | cut -c1-7)
+
+          # Delete existing 'latest' release (and its tag) to recreate cleanly
+          RID=$(curl -sf -H "Authorization: token $TOKEN" \
+            "$API/repos/$REPO/releases/tags/latest" | jq -r '.id // empty')
+          if [ -n "$RID" ]; then
+            curl -sf -X DELETE -H "Authorization: token $TOKEN" \
+              "$API/repos/$REPO/releases/$RID" || true
+          fi
+          curl -sf -X DELETE -H "Authorization: token $TOKEN" \
+            "$API/repos/$REPO/tags/latest" || true
+
+          # Create new 'latest' release
+          RID=$(curl -sf -X POST \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            "$API/repos/$REPO/releases" \
+            -d "{\"tag_name\":\"latest\",\"name\":\"latest\",\"body\":\"Auto-built from ${SHORT}\",\"prerelease\":true}" \
+            | jq -r '.id')
+
+          # Upload xetup.exe as release asset
+          curl -sf -X POST \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            "$API/repos/$REPO/releases/$RID/assets?name=xetup.exe" \
+            --data-binary @xetup.exe
+
+          echo "Released xetup.exe (commit ${SHORT})"

web/nginx.conf

@@ -14,9 +14,9 @@ server {
         add_header X-Content-Type-Options nosniff always;
     }
 
-    # Permanent shortlink to latest xetup.exe – update on each release
+    # Permanent shortlink to latest xetup.exe – never needs updating
     location = /dl {
-        return 302 https://git.xetup.x9.cz/x9/xetup/releases/download/v0.1.0/xetup.exe;
+        return 302 https://git.xetup.x9.cz/x9/xetup/releases/download/latest/xetup.exe;
     }
 
     # Proxy Forgejo API calls so browser doesn't need CORS or direct access to Forgejo