From e9d76cc4a2e0bed119129fede944bfc9fe0570de Mon Sep 17 00:00:00 2001
From: Elijah <elijah.kuntz@gmail.com>
Date: Sun, 19 Jul 2026 19:18:15 -0700
Subject: [PATCH] Prompt for Forgejo token during release publishing

---
 app/UPDATES.md                     | 10 ++++++++++
 scripts/Publish-DeckyRelease.cmd   | 24 ++++++++++++++++++++++++
 scripts/Publish-ForgejoRelease.ps1 |  8 +++++++-
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 scripts/Publish-DeckyRelease.cmd

diff --git a/app/UPDATES.md b/app/UPDATES.md
index 64b5c11..4646a49 100644
--- a/app/UPDATES.md
+++ b/app/UPDATES.md
@@ -76,6 +76,16 @@ Remove-Item Env:FORGEJO_PAT
 git pull --ff-only
 ```
 
+For an interactive, double-clickable option, run:
+
+```text
+scripts\Publish-DeckyRelease.cmd
+```
+
+It bypasses PowerShell's script policy only for the publisher process, prompts
+for the version and a hidden personal access token, and leaves the window open
+so any error can be read. The token is not saved.
+
 The publisher creates the `v0.3.0` Forgejo release/tag at `main`, uploads the
 installer, signature, and metadata, then commits the tracked
 `releases/latest.json` through the Forgejo API. The final pull synchronizes that
diff --git a/scripts/Publish-DeckyRelease.cmd b/scripts/Publish-DeckyRelease.cmd
new file mode 100644
index 0000000..6502488
--- /dev/null
+++ b/scripts/Publish-DeckyRelease.cmd
@@ -0,0 +1,24 @@
+@echo off
+setlocal
+title Publish Decky Release
+cd /d "%~dp0.."
+
+echo Decky Forgejo release publisher
+echo.
+echo This creates the Forgejo release, uploads the signed installer,
+echo and updates releases/latest.json for Decky's in-app updater.
+echo.
+
+powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%~dp0Publish-ForgejoRelease.ps1"
+set "DECKY_RESULT=%ERRORLEVEL%"
+
+echo.
+if not "%DECKY_RESULT%"=="0" (
+  echo Publishing failed. The error is shown above.
+  echo No successful release should be assumed until the script says it was published.
+) else (
+  echo Publishing completed successfully.
+)
+echo.
+pause
+exit /b %DECKY_RESULT%
diff --git a/scripts/Publish-ForgejoRelease.ps1 b/scripts/Publish-ForgejoRelease.ps1
index 6c4570e..0d29d04 100644
--- a/scripts/Publish-ForgejoRelease.ps1
+++ b/scripts/Publish-ForgejoRelease.ps1
@@ -12,7 +12,13 @@ param(
 )
 
 $ErrorActionPreference = 'Stop'
-if (-not $Token) { throw 'FORGEJO_TOKEN or FORGEJO_PAT is required. Set it only for this PowerShell process.' }
+if (-not $Token) {
+    Write-Host 'A Forgejo personal access token is required to create the release.' -ForegroundColor Cyan
+    Write-Host 'The token is used only by this process and is not saved by Decky.' -ForegroundColor DarkGray
+    $secureToken = Read-Host 'Forgejo personal access token' -AsSecureString
+    $Token = [Net.NetworkCredential]::new('', $secureToken).Password
+}
+if (-not $Token) { throw 'No Forgejo personal access token was entered.' }
 
 $repositoryRoot = Split-Path -Parent $PSScriptRoot
 $releaseDirectory = Join-Path $repositoryRoot "artifacts\release\v$Version"