il2ks 0.1.0__tar.gz

il2ks-0.1.0/.dockerignore

@@ -0,0 +1,12 @@
+# The image only needs pyproject.toml, uv.lock, README.md, LICENSE, NOTICE, src/ and docker/docker-entrypoint.sh.
+# Never send the game's real logs or local state to the daemon.
+*
+!pyproject.toml
+!uv.lock
+!README.md
+!LICENSE
+!NOTICE
+!src/**
+!docker/docker-entrypoint.sh
+**/__pycache__
+**/*.pyc

il2ks-0.1.0/.gitattributes

@@ -0,0 +1,2 @@
+# Shell scripts must keep LF endings or bash fails on Windows checkouts
+*.sh text eol=lf

il2ks-0.1.0/.github/scripts/run-installer.ps1

@@ -0,0 +1,40 @@
+# Runs an Inno Setup installer silently with a timeout. It always prints the installer log, the il2ks logs and the process tree
+# afterwards; on a timeout it also kills the installer, so a hang shows where it hangs instead of eating the job's time limit.
+# Usage: run-installer.ps1 -Exe <path> -LogFile <setup log> -Arguments <installer switches...> [-TimeoutSeconds 900]
+param(
+  [Parameter(Mandatory)] [string] $Exe,
+  [Parameter(Mandatory)] [string] $LogFile,
+  [Parameter(Mandatory)] [string[]] $Arguments,
+  [int] $TimeoutSeconds = 900
+)
+$ErrorActionPreference = 'Continue'
+
+function Show-Diagnostics {
+  Write-Host "::group::installer log ($LogFile)"
+  if (Test-Path $LogFile) { Get-Content $LogFile -Tail 150 } else { Write-Host "(no log file)" }
+  Write-Host "::endgroup::"
+  Write-Host "::group::il2ks logs in ProgramData"
+  Get-ChildItem "$env:ProgramData\il2ks" -Recurse -File -ErrorAction SilentlyContinue |
+    Where-Object { $_.FullName -like '*\logs\*' } |
+    ForEach-Object { "== $($_.FullName)"; Get-Content $_.FullName -Tail 30 }
+  Write-Host "::endgroup::"
+  Write-Host "::group::process tree"
+  Get-CimInstance Win32_Process |
+    Where-Object { $_.Name -match 'il2ks|python|cmd|icacls|sc\.exe|netsh|caddy' } |
+    Select-Object ProcessId, ParentProcessId, Name, CommandLine | Format-List | Out-String -Width 250
+  Write-Host "::endgroup::"
+}
+
+$arglist = ($Arguments | ForEach-Object { if ($_ -match '\s') { '"' + $_ + '"' } else { $_ } }) -join ' '
+# No -Wait: that also waits for every process the installer started, and has no timeout.
+$p = Start-Process -FilePath $Exe -ArgumentList $arglist -PassThru
+if (-not $p.WaitForExit($TimeoutSeconds * 1000)) {
+  Write-Host "::error::the installer did not finish within $TimeoutSeconds seconds"
+  Show-Diagnostics
+  Get-CimInstance Win32_Process | Where-Object { $_.Name -like 'il2ks-setup*' } |
+    ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+  throw "installer timed out"
+}
+$p.WaitForExit()
+Show-Diagnostics
+if ($p.ExitCode -ne 0) { throw "installer exit code $($p.ExitCode)" }

il2ks-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,125 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    # The same command agents and pre-commit run (`il2ks dev check`), minus the tests (the jobs below run those):
+    # ruff, format, pyright, import-linter, vulture, makemigrations --check, migration immutability / single leaf,
+    # bump-templates --check, translations check. Full history: the migration guard compares with origin/main.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run il2ks dev check --no-tests --verbose
+
+  test-sqlite:
+    # SQLite is the default test database (TD-19). Windows is the main target platform.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run pytest -m "not perf"  # the budgets of tests/perf have their own job (test-perf)
+
+  test-postgres:
+    # Postgres is dev-side only: one extra job keeps a future switch cheap (TD-04, TD-19).
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: il2ks
+          POSTGRES_PASSWORD: il2ks
+          POSTGRES_DB: il2ks
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U il2ks" --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      IL2KS_TEST_DB: postgres
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run pytest -m "not perf"  # the budgets of tests/perf have their own job (test-perf)
+
+  test-perf:
+    # Query and time budgets of every public page over a seeded world (tests/perf, marker `perf`; OQ-97). Kept out of
+    # the functional jobs so a slow runner never fails them. SQLite first (what ships), then the Postgres service:
+    # Postgres plans queries differently and is where a slow query shows up.
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_USER: il2ks
+          POSTGRES_PASSWORD: il2ks
+          POSTGRES_DB: il2ks
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U il2ks" --health-interval 5s --health-timeout 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run pytest -m perf -n 0
+      - run: uv run pytest -m perf -n 0
+        env:
+          IL2KS_TEST_DB: postgres
+
+  test-e2e:
+    # Browser tests (doc 08): the real app in a child process, driven by Chromium through Playwright. Opt-in locally
+    # (IL2KS_TEST_E2E=1); always on here. Traces and screenshots of failures are kept as an artifact.
+    runs-on: ubuntu-24.04  # Playwright's --with-deps apt step lags behind new Ubuntu releases (ubuntu-latest moves to 26 on 2026-10-19)
+    env:
+      IL2KS_TEST_E2E: "1"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run playwright install --with-deps chromium
+      - run: >-
+          uv run pytest -m e2e --basetemp=e2e-tmp --output=test-results
+          --tracing=retain-on-failure --screenshot=only-on-failure
+      - uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: e2e-failure-${{ github.run_id }}
+          path: |
+            test-results/
+            e2e-tmp/**/server.log
+          if-no-files-found: ignore
+          retention-days: 14
+
+  package:
+    # The wheel must carry templates, static files, catalog data, the example config and the migrations (PyPI path).
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - run: uv run pytest tests/unit/test_packaging.py
+        env:
+          IL2KS_TEST_BUILD: "1"
+
+  docker:
+    # The image of docs/install-docker.md (doc 07 option A): build it (nothing is pushed) and smoke-test it.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: docker build -f docker/Dockerfile -t il2ks:ci .
+      - run: docker compose -f docker/compose.yaml config --quiet
+        env:
+          IL2KS_SERVER_TIMEZONE: UTC
+          IL2KS_LOGS_HOST_DIR: /tmp
+      - run: docker/smoke-test.sh il2ks:ci

il2ks-0.1.0/.github/workflows/loadtest.yml

@@ -0,0 +1,38 @@
+name: Load test
+
+# Manual only (Actions tab -> Load test -> Run workflow): load numbers on a shared runner are too noisy to gate a
+# commit on. Seeds a scratch database, runs Locust against `il2ks web --dev`, uploads the report (docs/performance-testing.md).
+on:
+  workflow_dispatch:
+    inputs:
+      users:
+        description: Concurrent users
+        default: "20"
+      run_time:
+        description: Run time (Locust syntax, e.g. 60s or 3m)
+        default: "60s"
+      missions:
+        description: Missions to seed
+        default: "60"
+
+jobs:
+  loadtest:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+      - name: Seed, serve and load the site
+        run: >-
+          uv run python loadtest/run.py
+          -u "${{ inputs.users }}" -t "${{ inputs.run_time }}" --missions "${{ inputs.missions }}"
+          --html loadtest-report.html | tee loadtest-report.md
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: loadtest-${{ github.run_id }}
+          path: |
+            loadtest-report.html
+            loadtest-report.md
+          if-no-files-found: ignore
+          retention-days: 30

il2ks-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,119 @@
+name: Release
+
+# Pushing a tag like v0.1.0 builds il2ks, proves the wheel works in a clean environment on Linux and Windows, and
+# publishes it to PyPI with trusted publishing (no API token stored anywhere).
+#
+# One-time setup on pypi.org: Your projects -> il2ks -> Publishing -> add a trusted publisher
+#   owner: FGlazov   repository: il2_korea_stats   workflow: release.yml   environment: pypi
+# (for the very first release, add it as a "pending publisher" under Your account -> Publishing).
+# And in GitHub: Settings -> Environments -> New environment "pypi" (optionally require a reviewer there).
+#
+# Release steps: bump __version__ in src/il2ks/__init__.py (the only place), commit, `git tag v<version>`, push the tag.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+
+      - name: The tag must match the package version
+        run: |
+          version="$(uv run python -c 'import il2ks; print(il2ks.__version__)')"
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match il2ks.__version__ ${version}" >&2
+            exit 1
+          fi
+
+      - name: Template versions count again after the first release (TD-25)
+        run: |
+          done="$(uv run python -c 'from il2ks.serving.templateversions import FIRST_RELEASE_DONE; print(FIRST_RELEASE_DONE)')"
+          case "${GITHUB_REF_NAME}" in *a[0-9]*|*b[0-9]*|*rc[0-9]*) echo "pre-release tag: the switch may stay off"; exit 0;; esac
+          if [ "${done}" != "True" ]; then
+            echo "FIRST_RELEASE_DONE is still False in serving/templateversions.py: flip it before tagging (docs/releasing.md)" >&2
+            exit 1
+          fi
+
+      - name: Tests, including the wheel contents check
+        run: uv run pytest -q
+        env:
+          IL2KS_TEST_BUILD: "1"
+
+      - name: Build wheel and sdist
+        run: uv build
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  smoke:
+    # Install the built wheel into a fresh virtual environment, away from the source tree, and make it do real work.
+    needs: build
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+
+      - name: Install the wheel in a clean venv
+        run: |
+          uv venv --python 3.13 smoke-venv
+          if [ "$RUNNER_OS" = "Windows" ]; then BIN=smoke-venv/Scripts; else BIN=smoke-venv/bin; fi
+          echo "BIN=$PWD/$BIN" >> "$GITHUB_ENV"
+          uv pip install --python smoke-venv dist/*.whl  # the folder: `Scripts/python` without `.exe` fails on Windows
+
+      - name: il2ks --help and --version
+        run: |
+          "$BIN/il2ks" --help
+          "$BIN/il2ks" --version
+
+      - name: Smoke test
+        env:
+          IL2KS_DATA_DIR: ${{ github.workspace }}/smoke-data
+        run: |
+          "$BIN/il2ks" manage migrate --noinput
+          "$BIN/il2ks" custom list --builtin | grep "templates/il2ks/base.html" > /dev/null
+          "$BIN/il2ks" caddyfile | grep "reverse_proxy 127.0.0.1:8000" > /dev/null
+          "$BIN/il2ks" service systemd | grep "ExecStart=" > /dev/null
+          "$BIN/il2ks" web --dev --port 18000 > web.log 2>&1 &
+          ok=0
+          for i in $(seq 1 40); do
+            if curl -fsS http://127.0.0.1:18000/ > /dev/null; then ok=1; break; fi
+            sleep 1
+          done
+          cat web.log
+          [ "$ok" = "1" ] || { echo "the site did not answer" >&2; exit 1; }
+          curl -fsS http://127.0.0.1:18000/admin/login/ > /dev/null
+          if [ "$RUNNER_OS" = "Linux" ]; then pkill -f "il2ks web" || true; fi
+
+  publish:
+    needs: smoke
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1

il2ks-0.1.0/.github/workflows/windows-installer.yml

@@ -0,0 +1,232 @@
+name: Windows installer
+
+# Builds dist/il2ks-setup-<version>.exe (packaging/windows, doc 07 option B), smoke-tests it, and on a version tag attaches it
+# to the GitHub release. Not run on every push: it downloads about 90 MB of pinned inputs and takes several minutes.
+#
+#  - tag v*              build + smoke test + release asset (+ the real-service test, which may fail without blocking)
+#  - workflow_dispatch   build + smoke test, uploaded as a workflow artifact; tick "service_test" for the real-service test
+#
+# The smoke test installs into a temp folder with the service and firewall steps switched off (/NOSERVICE /NOFIREWALL), so it
+# changes nothing outside the runner's disposable VM anyway. The service test installs the real service on that VM.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      service_test:
+        description: "Also install the real Windows service on the runner and check start and graceful stop"
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+      - run: uv sync --locked
+
+      - name: The tag must match the package version
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
+        run: |
+          version="$(uv run python -c 'import il2ks; print(il2ks.__version__)')"
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match il2ks.__version__ ${version}" >&2
+            exit 1
+          fi
+
+      - name: Build the installer (pinned inputs, SHA-256 checked)
+        run: uv run python packaging/windows/build.py
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: il2ks-windows-installer
+          path: dist/il2ks-setup-*.exe
+          if-no-files-found: error
+
+  smoke:
+    # Install silently into a temp folder, no service, no firewall; run il2ks from the installed copy; uninstall.
+    needs: build
+    runs-on: windows-latest
+    timeout-minutes: 30  # a silent install that waits for input would otherwise hang for 6 hours
+    steps:
+      - uses: actions/checkout@v7  # only for .github/scripts/run-installer.ps1
+      - uses: actions/download-artifact@v8
+        with:
+          name: il2ks-windows-installer
+          path: installer
+
+      - name: Install silently
+        shell: pwsh
+        run: |
+          $exe = (Get-ChildItem installer\il2ks-setup-*.exe).FullName
+          $app = Join-Path $env:RUNNER_TEMP 'il2ks-app'
+          $logs = Join-Path $env:RUNNER_TEMP 'dserver-logs'
+          $pw = Join-Path $env:RUNNER_TEMP 'il2ks-admin-password.txt'
+          Set-Content -Path $pw -Value 'Correct-Horse-Battery-9' -Encoding ascii
+          New-Item -ItemType Directory -Force $logs | Out-Null
+          "APP=$app" | Out-File -Append -Encoding utf8 $env:GITHUB_ENV
+          $args = @('/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART', '/SP-', "/DIR=$app", "/LOG=$env:RUNNER_TEMP\setup.log",
+                    '/NOSERVICE', '/NOFIREWALL', '/MERGETASKS=!firewall', "/LOGDIR=$logs", '/TIMEZONE=UTC',
+                    '/ADMINUSER=ci', "/ADMINPASSWORDFILE=$pw")
+          .github\scripts\run-installer.ps1 -Exe $exe -LogFile "$env:RUNNER_TEMP\setup.log" -Arguments $args
+          if (Test-Path "$pw") { throw "the installer did not delete the password file" }
+
+      - name: il2ks --version and doctor from the installed copy
+        shell: pwsh
+        run: |
+          & "$env:APP\il2ks.cmd" --version
+          if ($LASTEXITCODE -ne 0) { throw "il2ks --version failed" }
+          $report = & "$env:APP\il2ks.cmd" doctor 2>&1 | Out-String
+          $code = $LASTEXITCODE
+          Write-Output $report
+          # 0 = all OK, 1 = warnings (no missions yet, no domain), 2 = errors: only that fails the job. The GitHub
+          # runner has something listening on port 80 already (shown below), which is the runner's, not ours.
+          Get-NetTCPConnection -LocalPort 80 -State Listen -ErrorAction SilentlyContinue |
+            ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue } | Format-Table Id, ProcessName
+          $errors = ([regex]::Matches($report, '\[ERROR\] ([^\r\n]*)') | ForEach-Object { $_.Groups[1].Value })
+          $unexpected = @($errors | Where-Object { $_ -notmatch '^Port 80 ' })
+          if ($code -ge 2 -and $unexpected.Count -gt 0) { throw "il2ks doctor reported errors: $($unexpected -join '; ')" }
+          if (-not (Test-Path "$env:APP\service\il2ks-service.exe")) { throw "the service wrapper is missing" }
+          if (-not (Test-Path "$env:APP\bin\caddy.exe")) { throw "caddy.exe is missing" }
+          & "$env:APP\bin\caddy.exe" version
+          if (-not (Test-Path "$env:ProgramData\il2ks\il2ks.toml")) { throw "setup did not write il2ks.toml" }
+          if (Get-Service il2ks -ErrorAction SilentlyContinue) { throw "a service was installed despite /NOSERVICE" }
+
+      - name: The site answers (il2ks web --dev from the installed Python)
+        shell: pwsh
+        run: |
+          $proc = Start-Process -FilePath "$env:APP\python\python.exe" -PassThru -NoNewWindow `
+            -ArgumentList '-m', 'il2ks', '--config', "$env:ProgramData\il2ks\il2ks.toml", 'web', '--dev', '--port', '18000'
+          $ok = $false
+          foreach ($i in 1..60) {
+            try { $r = Invoke-WebRequest -UseBasicParsing http://127.0.0.1:18000/ ; $ok = $true; break } catch { Start-Sleep 1 }
+          }
+          Stop-Process -Id $proc.Id -Force
+          if (-not $ok) { throw "the site did not answer" }
+
+      - name: Upgrade over an install with an outdated override warns in the log (silent mode)
+        shell: pwsh
+        run: |
+          # A copy of a built-in page, then its version line set back to v0: as if the new il2ks had changed that page.
+          $cfg = "$env:ProgramData\il2ks\il2ks.toml"
+          & "$env:APP\python\python.exe" -P -m il2ks --config $cfg custom copy il2ks/home.html
+          if ($LASTEXITCODE -ne 0) { throw "custom copy failed" }
+          $file = "$env:ProgramData\il2ks\custom\templates\il2ks\home.html"
+          $text = [IO.File]::ReadAllText($file)
+          $old = [regex]::Match($text, 'il2ks/home\.html v\d+').Value
+          if (-not $old) { throw "the copy has no version line" }
+          [IO.File]::WriteAllText($file, $text.Replace($old, 'il2ks/home.html v0'))
+          & "$env:APP\python\python.exe" -P -m il2ks --config $cfg custom list --problems --fail-on-problems
+          if ($LASTEXITCODE -ne 4) { throw "expected exit code 4 (override out of date), got $LASTEXITCODE" }
+          # Install the same build again over it: an upgrade (il2ks.toml exists), silent, so no message box
+          $exe = (Get-ChildItem installer\il2ks-setup-*.exe).FullName
+          $args = @('/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART', '/SP-', "/DIR=$env:APP", "/LOG=$env:RUNNER_TEMP\upgrade.log",
+                    '/NOSERVICE', '/NOFIREWALL', '/MERGETASKS=!firewall')
+          .github\scripts\run-installer.ps1 -Exe $exe -LogFile "$env:RUNNER_TEMP\upgrade.log" -Arguments $args
+          $report = "$env:ProgramData\il2ks\logs\installer-custom-check.log"
+          if (-not (Test-Path $report)) { throw "no ${report}: the upgrade did not check the customized templates" }
+          Get-Content $report
+          if ((Get-Content $report -Raw) -notmatch 'templates/il2ks/home\.html') { throw "the report does not name the outdated override" }
+          if ((Get-Content "$env:RUNNER_TEMP\upgrade.log" -Raw) -notmatch 'customized file\(s\)') { throw "the installer log has no warning" }
+          exit 0  # $LASTEXITCODE is still 4 from the expected `custom list --fail-on-problems` above
+
+      - name: Uninstall keeps the data
+        shell: pwsh
+        run: |
+          $p = Start-Process -FilePath "$env:APP\unins000.exe" -ArgumentList '/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART' -Wait -PassThru
+          if ($p.ExitCode -ne 0) { throw "uninstaller exit code $($p.ExitCode)" }
+          Start-Sleep 3
+          if (Test-Path "$env:APP\python") { throw "program files are still there" }
+          if (-not (Test-Path "$env:ProgramData\il2ks\il2ks.toml")) { throw "the data folder was deleted" }
+
+  service-test:
+    # The real thing on a disposable runner: register the Windows service, start it, stop it the way Windows does, remove it.
+    # Informational until it has passed on a real runner a few times (continue-on-error), because it cannot be run elsewhere.
+    needs: build
+    if: github.event_name == 'push' || inputs.service_test
+    runs-on: windows-latest
+    timeout-minutes: 30
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v7  # only for .github/scripts/run-installer.ps1
+      - uses: actions/download-artifact@v8
+        with:
+          name: il2ks-windows-installer
+          path: installer
+
+      - name: "Install with the service (own-proxy mode: no ports 80/443 needed)"
+        shell: pwsh
+        run: |
+          $exe = (Get-ChildItem installer\il2ks-setup-*.exe).FullName
+          $logs = Join-Path $env:RUNNER_TEMP 'dserver-logs'
+          $pw = Join-Path $env:RUNNER_TEMP 'il2ks-admin-password.txt'
+          Set-Content -Path $pw -Value 'Correct-Horse-Battery-9' -Encoding ascii
+          New-Item -ItemType Directory -Force $logs | Out-Null
+          $args = @('/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART', '/SP-', "/LOG=$env:RUNNER_TEMP\setup.log", '/NOFIREWALL',
+                    '/HTTPS=external', '/DOMAIN=stats.example.org', "/LOGDIR=$logs", '/TIMEZONE=UTC',
+                    '/ADMINUSER=ci', "/ADMINPASSWORDFILE=$pw")
+          .github\scripts\run-installer.ps1 -Exe $exe -LogFile "$env:RUNNER_TEMP\setup.log" -Arguments $args
+
+      - name: The service is running and the site answers
+        shell: pwsh
+        run: |
+          $svc = Get-Service il2ks
+          if ($svc.Status -ne 'Running') { throw "service status: $($svc.Status)" }
+          $account = (Get-CimInstance Win32_Service -Filter "Name='il2ks'").StartName
+          if ($account -ne 'NT SERVICE\il2ks') { throw "the service runs as '$account', not as its virtual account" }
+          $ok = $false
+          foreach ($i in 1..90) {
+            try {
+              # production mode redirects plain http to https unless the proxy says it already did
+              $r = Invoke-WebRequest -UseBasicParsing -Headers @{ 'X-Forwarded-Proto' = 'https'; Host = 'stats.example.org' } http://127.0.0.1:8000/
+              $ok = $true; break
+            } catch { Start-Sleep 1 }
+          }
+          if (-not $ok) { Get-ChildItem "$env:ProgramData\il2ks\logs" -Recurse | ForEach-Object { "== $($_.FullName)"; Get-Content $_.FullName -Tail 20 }; throw "the site did not answer" }
+
+      - name: Stopping the service stops il2ks gracefully and leaves nothing behind
+        shell: pwsh
+        run: |
+          Stop-Service il2ks
+          Start-Sleep 3
+          $left = Get-Process -Name python, caddy -ErrorAction SilentlyContinue | Where-Object { $_.Path -like "$env:ProgramFiles\il2ks\*" }
+          Get-ChildItem "$env:ProgramData\il2ks\logs" -Filter 'run-*.log' | ForEach-Object { Get-Content $_.FullName -Tail 12 }
+          if ($left) { throw "processes left behind: $($left.Id -join ', ')" }
+          $log = Get-ChildItem "$env:ProgramData\il2ks\logs" -Filter 'run-*.log' | ForEach-Object { Get-Content $_.FullName } | Out-String
+          if ($log -notmatch '"message": "stopped"') { throw "il2ks run did not log a clean stop (it was killed)" }
+          Start-Service il2ks
+
+      - name: Uninstall removes the service
+        shell: pwsh
+        run: |
+          $p = Start-Process -FilePath "$env:ProgramFiles\il2ks\unins000.exe" -ArgumentList '/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART' -Wait -PassThru
+          if ($p.ExitCode -ne 0) { throw "uninstaller exit code $($p.ExitCode)" }
+          Start-Sleep 5
+          if (Get-Service il2ks -ErrorAction SilentlyContinue) { throw "the service is still registered" }
+          if (-not (Test-Path "$env:ProgramData\il2ks\il2ks.toml")) { throw "the data folder was deleted" }
+
+  release:
+    needs: smoke
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # attach the installer to the GitHub release
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: il2ks-windows-installer
+          path: installer
+      - name: Attach the installer to the release (created if the PyPI release workflow has not made one)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh release view "$GITHUB_REF_NAME" > /dev/null 2>&1 || gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes
+          sha256sum installer/*.exe | tee installer/SHA256SUMS.txt
+          gh release upload "$GITHUB_REF_NAME" installer/*.exe installer/SHA256SUMS.txt --clobber