Prompt for Forgejo token during release publishing

app/UPDATES.md

@@ -76,6 +76,16 @@ Remove-Item Env:FORGEJO_PAT
 git pull --ff-only
 ```
 
+For an interactive, double-clickable option, run:
+
+```text
+scripts\Publish-DeckyRelease.cmd
+```
+
+It bypasses PowerShell's script policy only for the publisher process, prompts
+for the version and a hidden personal access token, and leaves the window open
+so any error can be read. The token is not saved.
+
 The publisher creates the `v0.3.0` Forgejo release/tag at `main`, uploads the
 installer, signature, and metadata, then commits the tracked
 `releases/latest.json` through the Forgejo API. The final pull synchronizes that

scripts/Publish-DeckyRelease.cmd

@@ -0,0 +1,24 @@
+@echo off
+setlocal
+title Publish Decky Release
+cd /d "%~dp0.."
+
+echo Decky Forgejo release publisher
+echo.
+echo This creates the Forgejo release, uploads the signed installer,
+echo and updates releases/latest.json for Decky's in-app updater.
+echo.
+
+powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%~dp0Publish-ForgejoRelease.ps1"
+set "DECKY_RESULT=%ERRORLEVEL%"
+
+echo.
+if not "%DECKY_RESULT%"=="0" (
+  echo Publishing failed. The error is shown above.
+  echo No successful release should be assumed until the script says it was published.
+) else (
+  echo Publishing completed successfully.
+)
+echo.
+pause
+exit /b %DECKY_RESULT%

scripts/Publish-ForgejoRelease.ps1

@@ -12,7 +12,13 @@ param(
 )
 
 $ErrorActionPreference = 'Stop'
-if (-not $Token) { throw 'FORGEJO_TOKEN or FORGEJO_PAT is required. Set it only for this PowerShell process.' }
+if (-not $Token) {
+    Write-Host 'A Forgejo personal access token is required to create the release.' -ForegroundColor Cyan
+    Write-Host 'The token is used only by this process and is not saved by Decky.' -ForegroundColor DarkGray
+    $secureToken = Read-Host 'Forgejo personal access token' -AsSecureString
+    $Token = [Net.NetworkCredential]::new('', $secureToken).Password
+}
+if (-not $Token) { throw 'No Forgejo personal access token was entered.' }
 
 $repositoryRoot = Split-Path -Parent $PSScriptRoot
 $releaseDirectory = Join-Path $repositoryRoot "artifacts\release\v$Version"