Harden app for release readiness

.gitea/workflows/build-windows.yml

@@ -42,6 +42,9 @@ jobs:
       - name: Install dependencies
         run: npm install
 
+      - name: Audit production dependencies
+        run: npm audit --omit=dev --audit-level=high
+
       - name: Build Windows installer
         run: npm run dist:win
 
@@ -58,7 +61,8 @@ jobs:
       - name: Publish to Gitea package registry
         shell: bash
         run: |
-          package_version="$(node -p "require('./package.json').version")-${GITHUB_SHA::7}"
+          app_version="$(node -p "require('./package.json').version")"
+          package_version="${app_version}-${GITHUB_SHA::7}"
 
           for artifact in release/*; do
             [ -f "$artifact" ] || continue
@@ -68,3 +72,18 @@ jobs:
               --upload-file "$artifact" \
               "https://git.wilkensxl.de/api/packages/MrSphay/generic/envhelper/${package_version}/${file_name}"
           done
+
+          latest_url="https://git.wilkensxl.de/api/packages/MrSphay/generic/envhelper/latest"
+          curl --silent --show-error --user "MrSphay:${REGISTRY_TOKEN}" --request DELETE "${latest_url}" || true
+
+          mkdir -p package-latest
+          cp "release/EnvHelper-${app_version}-setup-x64.exe" "package-latest/EnvHelper-setup-x64.exe"
+          cp "release/EnvHelper-${app_version}-portable-x64.exe" "package-latest/EnvHelper-portable-x64.exe"
+
+          for artifact in package-latest/*; do
+            file_name="$(basename "$artifact")"
+            curl --fail-with-body \
+              --user "MrSphay:${REGISTRY_TOKEN}" \
+              --upload-file "$artifact" \
+              "${latest_url}/${file_name}"
+          done