refactor(ci): drop upload/download-artifact (remove github.com dependency)

actions/upload-artifact and download-artifact run code fetched from
github.com (and v4 is GHES-incompatible, v3 deprecated). The runner
host is single with a shared filesystem, so the orchestrator's
host-side collect dir is the artifact handoff:

- action.yml: replace the two upload-artifact steps with
  host-path report steps; artifacts stay under F:\CI\Artifacts and
  are aged by Invoke-RetentionPolicy.ps1.
- build-nsInnoUnp.yml: release job reads
  F:\CI\Artifacts\{run_id}-{run_attempt}-{target} directly instead of
  download-artifact; existing Gitea REST release-asset upload unchanged.

Tradeoff (accepted): artifacts are no longer downloadable from the
Gitea Actions run page for non-tag builds — only on host disk, and as
release assets for tagged builds.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/actions/local-ci-build/action.yml

@@ -98,7 +98,12 @@ inputs:
     default: ''
 
   artifact-retention-days:
-    description: 'Days to retain uploaded artifacts in Gitea.'
+    description: >
+      Deprecated / no-op. Artifacts are no longer uploaded to the Gitea
+      Actions store (that needs the github.com-hosted upload-artifact
+      action). They stay on the host under F:\CI\Artifacts and are aged
+      out by scripts/Invoke-RetentionPolicy.ps1. Kept for caller
+      back-compat.
     required: false
     default: '14'
 
@@ -287,22 +292,34 @@ runs:
         [System.IO.File]::AppendAllText(
             $env:GITHUB_OUTPUT, "artifact-name=$artifactName`n", $utf8NoBom)
 
-    # ── Upload build artifacts on success ─────────────────────────────────────
+    # ── Report artifact location ──────────────────────────────────────────────
-    - name: Upload artifacts
+    # No actions/upload-artifact: that action's code is fetched from
+    # github.com (and v4 is GHES-incompatible, v3 deprecated). The runner
+    # host is single and its filesystem is shared across jobs, so the
+    # orchestrator's host-side collect dir IS the artifact handoff.
+    # Downstream jobs read F:\CI\Artifacts\{run_id}-{run_attempt}[-suffix]
+    # directly (see build-nsInnoUnp.yml release job).
+    - name: Report artifact location
       if: success() && inputs.skip-artifact != 'true'
-      uses: actions/upload-artifact@v3
+      shell: powershell
-      with:
+      run: |
-        name: ${{ steps.invoke-ci.outputs.artifact-name }}
+        $p = '${{ steps.invoke-ci.outputs.artifact-path }}'
-        path: ${{ steps.invoke-ci.outputs.artifact-path }}
+        if (-not (Test-Path -LiteralPath $p) -or
-        retention-days: ${{ inputs.artifact-retention-days }}
+            -not (Get-ChildItem -Force -LiteralPath $p)) {
-        if-no-files-found: error
+            throw "no artifacts at $p"
+        }
+        Write-Host "Artifacts on host: $p"
+        Get-ChildItem -Recurse -File -LiteralPath $p |
+            ForEach-Object { Write-Host "  $($_.FullName)" }
 
-    # ── Upload diagnostic logs on failure ─────────────────────────────────────
+    - name: Report diagnostic log location on failure
-    - name: Upload diagnostic logs on failure
       if: failure()
-      uses: actions/upload-artifact@v3
+      shell: powershell
-      with:
+      run: |
-        name: build-logs-${{ github.sha }}
+        $p = '${{ steps.invoke-ci.outputs.artifact-path }}'
-        path: ${{ steps.invoke-ci.outputs.artifact-path }}/*.log
+        if ($p -and (Test-Path -LiteralPath $p)) {
-        retention-days: 3
+            Write-Host "Diagnostic logs (if any) on host: $p"
-        if-no-files-found: ignore
+            Get-ChildItem -Recurse -File -Filter '*.log' -LiteralPath $p `
+                -ErrorAction SilentlyContinue |
+                ForEach-Object { Write-Host "  $($_.FullName)" }
+        }

.gitea/workflows/build-nsInnoUnp.yml

@@ -46,18 +46,10 @@ jobs:
     runs-on: windows-build
 
     steps:
-      - name: Download Windows artifact
+      # No actions/download-artifact (its code is fetched from github.com).
-        uses: actions/download-artifact@v3
+      # The runner host is single and shared; the build matrix legs left
-        with:
+      # their outputs at F:\CI\Artifacts\{run_id}-{run_attempt}-{target}
-          name: nsis-plugin-nsinnounp-windows-${{ github.ref_name }}
+      # (job-id-suffix = matrix.target). Read them directly from disk.
-          path: artifacts/windows
-
-      - name: Download Linux artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: nsis-plugin-nsinnounp-linux-${{ github.ref_name }}
-          path: artifacts/linux
-
       - name: Create Gitea release and upload assets
         shell: powershell
         env:
@@ -65,6 +57,8 @@ jobs:
           GITEA_URL:   ${{ github.server_url }}
           REPO:        ${{ github.repository }}
           TAG:         ${{ github.ref_name }}
+          RUN_ID:      ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
         run: |
           #Requires -Version 5.1
           Set-StrictMode -Version Latest
@@ -86,9 +80,15 @@ jobs:
           $releaseId = $release.id
           Write-Host "Release created: id=$releaseId name=$($release.name)"
 
-          # Compress each artifact directory and upload as a release asset
+          # Compress each host-side artifact directory and upload as a
+          # release asset. The build legs collected to
+          # F:\CI\Artifacts\{run_id}-{run_attempt}-{target}.
           foreach ($target in @('windows', 'linux')) {
-              $srcDir  = "artifacts\$target"
+              $srcDir  = "F:\CI\Artifacts\$env:RUN_ID-$env:RUN_ATTEMPT-$target"
+              if (-not (Test-Path -LiteralPath $srcDir) -or
+                  -not (Get-ChildItem -Force -LiteralPath $srcDir)) {
+                  throw "artifact dir missing or empty: $srcDir"
+              }
               $zipName = "nsis-plugin-nsinnounp-$target-$env:TAG.zip"
               Compress-Archive -Path "$srcDir\*" -DestinationPath $zipName -Force