Phase 3: release.yml ships Setup.exe + Velopack auto-update channel

The release workflow now builds both the existing single-file Portable lane AND a Velopack-friendly Setup lane, runs vpk pack to produce DiffViewer-Setup.exe + per-release nupkg packages, and uploads every artifact to the GitHub release in one softprops call. Existing DiffViewer.exe users see one new asset on the release page (Setup.exe) and unchanged behavior for the portable download (renamed to DiffViewer-portable.exe for clarity).

Workflow pipeline (after tag push):

1. dotnet publish in Portable mode -> 150 MB single-file DiffViewer-portable.exe

2. dotnet tool restore (brings in pinned vpk 1.1.1 from .config/dotnet-tools.json)

3. vpk download github -> pulls prior release nupkgs into releases-dir/ for delta computation. Tolerates 'nothing to download' (first release with Velopack has no prior package)

4. dotnet publish in Setup mode -> non-single-file folder layout in publish-setup/

5. vpk pack --shortcuts StartMenuRoot -> produces full + (optionally) delta nupkgs + DiffViewer-win-Setup.exe + RELEASES into releases-dir/. The --shortcuts StartMenuRoot flag avoids the Phase 1 spike finding that Velopack 1.1.1's uninstaller does not clean up the Desktop shortcut

6. Copy / rename artifacts into artifacts/ and upload via softprops/action-gh-release

Per-release assets a user sees on GitHub after this change:

- DiffViewer-portable.exe (single-file, manual updates -- existing behavior, just renamed)

- DiffViewer-Setup.exe (Velopack installer, subscribes to in-app auto-updates)

- DiffViewer-X.Y.Z-full.nupkg (Velopack consumes -- users don't download directly)

- DiffViewer-X.Y.Z-delta.nupkg (Velopack consumes, second release onward)

- RELEASES + releases.win.json + assets.win.json (Velopack metadata)

Why softprops instead of vpk upload github: we need to upload DiffViewer-portable.exe alongside the Velopack artifacts, so a single softprops upload is simpler than two separate upload steps. The in-app updater reads release assets via the GitHub REST API and is agnostic to which CI tool attached them.

README install section now recommends Setup.exe as primary download with the portable option as the no-install alternative. SmartScreen note still applies to both -- code signing comes with Phase 4 once SignPath approves the OSS application submitted in Phase 0.

Tests: 1403 passing, unchanged (this PR doesn't touch production code). dotnet build -c Release succeeds with 0 warnings, 0 errors.

AI-Local-Session: 4519f6b6-393a-4476-8efa-410e5396c3a9

AI-Cloud-Session: 72f9e474-60ab-42c2-b2a0-28fee827cbbb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Geeven Singh

.github/workflows/release.yml

@@ -28,22 +28,117 @@ jobs:
         with:
           dotnet-version: 8.0.x
 
-      - name: Stamp version + publish
+      - name: Stamp version + publish (Portable + Setup)
         shell: pwsh
         run: |
           $version = $env:GITHUB_REF_NAME.TrimStart('v')
           Write-Host "Publishing version: $version"
+          $fileVersion = $version -replace '-.*$', ''
+
+          # Portable: today's single-file 150 MB exe. Built first because
+          # the existing Definition-of-Done check (publish\DiffViewer.exe
+          # must exist) targets this layout.
           dotnet publish DiffViewer\DiffViewer.csproj `
             -c Release `
+            -p:DiffViewerBuildMode=Portable `
             -o publish `
             -p:Version=$version `
-            -p:FileVersion=$($version -replace '-.*$', '') `
+            -p:FileVersion=$fileVersion `
             -p:InformationalVersion=$version
           if (-not (Test-Path 'publish\DiffViewer.exe')) {
-            Write-Error 'publish\DiffViewer.exe not found after publish'
+            Write-Error 'publish\DiffViewer.exe not found after Portable publish'
+            exit 1
+          }
+          # Rename to a friendlier asset name; the upload step references
+          # DiffViewer-portable.exe so users see "what is this" cues from
+          # the filename alone.
+          New-Item -ItemType Directory -Path 'artifacts' -Force | Out-Null
+          Copy-Item -Path 'publish\DiffViewer.exe' -Destination 'artifacts\DiffViewer-portable.exe' -Force
+
+          # Setup: non-single-file folder layout consumed by vpk pack
+          # below. Built into a separate output dir so the two publishes
+          # don't fight over the same files.
+          dotnet publish DiffViewer\DiffViewer.csproj `
+            -c Release `
+            -p:DiffViewerBuildMode=Setup `
+            -o publish-setup `
+            -p:Version=$version `
+            -p:FileVersion=$fileVersion `
+            -p:InformationalVersion=$version
+          if (-not (Test-Path 'publish-setup\DiffViewer.exe')) {
+            Write-Error 'publish-setup\DiffViewer.exe not found after Setup publish'
             exit 1
           }
 
+      - name: Restore dotnet tools (vpk)
+        run: dotnet tool restore
+
+      - name: Download prior release packages (for delta)
+        # First release with Velopack support has no prior nupkgs to
+        # download; vpk download exits non-zero in that case (and any
+        # other transient failure). Tolerate that — vpk pack will then
+        # produce a full-only release, which is exactly the right
+        # outcome for the first Setup release.
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Path 'releases-dir' -Force | Out-Null
+          dotnet vpk download github `
+            --repoUrl https://github.com/${{ github.repository }} `
+            --token $env:GITHUB_TOKEN `
+            --outputDir releases-dir
+
+      - name: Pack Velopack release (vpk pack)
+        shell: pwsh
+        run: |
+          $version = $env:GITHUB_REF_NAME.TrimStart('v')
+          # --shortcuts StartMenuRoot (not the default Desktop+StartMenu)
+          # avoids the Phase 1 spike finding that Velopack 1.1.1's
+          # uninstall does not clean up the Desktop shortcut.
+          dotnet vpk pack `
+            --packId DiffViewer `
+            --packVersion $version `
+            --packDir publish-setup `
+            --mainExe DiffViewer.exe `
+            --outputDir releases-dir `
+            --shortcuts StartMenuRoot `
+            --packTitle DiffViewer `
+            --packAuthors "Geeven Singh"
+          # Sanity-check the expected artifacts are present. The delta
+          # nupkg only exists from the second release onward (no prior
+          # full to diff against on the first one), so its absence is
+          # not an error.
+          if (-not (Test-Path "releases-dir\DiffViewer-win-Setup.exe")) {
+            Write-Error 'DiffViewer-win-Setup.exe missing after vpk pack'
+            exit 1
+          }
+          if (-not (Test-Path "releases-dir\DiffViewer-$version-full.nupkg")) {
+            Write-Error "DiffViewer-$version-full.nupkg missing after vpk pack"
+            exit 1
+          }
+          # Copy / rename for the upload step. We want
+          # DiffViewer-Setup.exe (no win-* infix) as the user-facing
+          # download name.
+          Copy-Item -Path "releases-dir\DiffViewer-win-Setup.exe" -Destination 'artifacts\DiffViewer-Setup.exe' -Force
+          Copy-Item -Path "releases-dir\DiffViewer-$version-full.nupkg" -Destination "artifacts\DiffViewer-$version-full.nupkg" -Force
+          # The delta nupkg is optional (absent on first release).
+          $delta = Get-ChildItem -Path "releases-dir\DiffViewer-$version-delta.nupkg" -ErrorAction SilentlyContinue
+          if ($delta) {
+            Copy-Item -Path $delta.FullName -Destination "artifacts\DiffViewer-$version-delta.nupkg" -Force
+          }
+          # RELEASES + Velopack metadata files are required for the
+          # auto-updater to discover available packages on the
+          # GitHub release page.
+          Copy-Item -Path 'releases-dir\RELEASES' -Destination 'artifacts\RELEASES' -Force
+          if (Test-Path 'releases-dir\releases.win.json') {
+            Copy-Item -Path 'releases-dir\releases.win.json' -Destination 'artifacts\releases.win.json' -Force
+          }
+          if (Test-Path 'releases-dir\assets.win.json') {
+            Copy-Item -Path 'releases-dir\assets.win.json' -Destination 'artifacts\assets.win.json' -Force
+          }
+
       - name: Extract CHANGELOG section
         shell: pwsh
         run: |
@@ -83,6 +178,9 @@ jobs:
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v3
         with:
-          files: publish/DiffViewer.exe
+          # Upload every asset from artifacts/ — Setup.exe + portable.exe
+          # are the user-facing downloads; the *.nupkg files + RELEASES +
+          # *.json files are what the in-app updater consumes silently.
+          files: artifacts/*
           body: ${{ env.RELEASE_BODY }}
           fail_on_unmatched_files: true

CHANGELOG.md

@@ -14,6 +14,16 @@ body. Keep section headings exact and write notes in Markdown.
 
 ### Added
 
+- **`DiffViewer-Setup.exe` installer alongside the existing portable
+  download.** The new installer puts DiffViewer under
+  `%LocalAppData%\DiffViewer\` with a Start Menu shortcut and
+  subscribes to the in-app auto-update channel. No admin / UAC
+  prompt. Per-release artifacts on GitHub now include the Setup
+  installer plus Velopack delta packages, so subsequent updates are
+  typically small downloads (single-digit MB) instead of full ~70 MB
+  redownloads. Existing portable users are unaffected — the portable
+  exe still ships, still self-extracts on first run, and still
+  requires manual re-download for updates.
 - **Auto-update banner gets a "Skip this version" button.** Persists
   the skipped version into `settings.json` so future checks for the
   same version stay quiet across launches. Detection of a newer

README.md

@@ -196,11 +196,25 @@ may take a few extra seconds. Subsequent launches are fast.
 
 ## Install
 
-1. Go to the [Releases page] and download `DiffViewer.exe` from the latest
-   release.
-2. Double-click to launch. Windows SmartScreen may show a warning for the
-   unsigned binary; click **More info** → **Run anyway**. The release exe
-   is not currently code-signed.
+Two download options on the [Releases page]:
+
+1. **`DiffViewer-Setup.exe` (recommended).** Installs to
+   `%LocalAppData%\DiffViewer\`, adds a Start Menu shortcut, and
+   subscribes to **in-app auto-updates** (notification banner when a
+   new release ships; user opts in or out via Settings → Updates).
+   No admin / UAC prompt — Velopack installs per-user.
+2. **`DiffViewer-portable.exe`.** Single-file ~150 MB exe; double-click
+   to run, no install. Updates are **manual** — re-download from the
+   Releases page when a new version ships. Good for thumb-drive use,
+   restricted environments, or "just try it for five minutes."
+
+Both options are functionally identical app-side; the only difference
+is the install / update lifecycle.
+
+Windows SmartScreen may show a warning the first time you launch
+either binary — click **More info** → **Run anyway**. Neither
+artifact is currently code-signed (see
+[CODE_SIGNING_POLICY.md](CODE_SIGNING_POLICY.md)).
 
 ## Build from source