fix(ci): 健壮化 Inno Setup 安装 + 部署仅保留最新安装包

- 新增 install-innosetup.ps1：校验下载大小、检查安装程序退出码、双
  Program Files 目录定位 ISCC，修复原内联命令静默成功但没真正装上的问题
  （SYSTEM 账户下 Invoke-WebRequest 无 -UseBasicParsing + 未检查退出码）
- provision/compile-windows.sh 在两个 Program Files 目录查找 ISCC
- deploy.sh 发布安装包到 /opt/jiu/downloads 前先清旧包，仅保留最新版本

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,13 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.10] - 2026-06-04
+## [1.0.11] - 2026-06-04
 
 ### 新功能
 - Windows 客户端改为提供安装程序（Inno Setup 打包的 `jiu-windows-x64-setup.exe`，含中文向导、桌面/开始菜单快捷方式、卸载项），不再是解压版 zip
 
 ### 修复
 - 修复客户端「无法安全下载」：下载地址从内网 HTTP Forgejo（`http://192.168.3.200:3000`，公网不可达且被浏览器拦截）改为同源 HTTPS `https://jiu.51yanmei.com/downloads/...`，Windows、macOS 均生效
+- 修复 Windows runner 安装 Inno Setup 失败：改用健壮的 `install-innosetup.ps1`（校验下载大小 + 检查安装退出码 + 双 Program Files 目录定位 ISCC），替代会静默成功但实际没装上的内联命令
+- 部署时将最新安装包发布到 web 服务（`/opt/jiu/downloads/`，nginx `/downloads/` 提供），仅保留最新版本（清旧放新）
 
 ## [1.0.9] - 2026-06-04
 

scripts/ci/compile-windows.sh

@@ -45,10 +45,13 @@ flutter build windows --release \
 popd > /dev/null
 
 # Package the Release folder into a Windows installer with Inno Setup (ISCC).
-# Inno Setup is installed by provision-windows.sh.
-ISCC="/c/Program Files (x86)/Inno Setup 6/ISCC.exe"
-if [ ! -f "$ISCC" ]; then
-  echo "ERROR: Inno Setup (ISCC) not found at '$ISCC'. Run provision-windows.sh first." >&2
+# Inno Setup is installed by provision-windows.sh; check both Program Files dirs.
+ISCC=""
+for c in "/c/Program Files (x86)/Inno Setup 6/ISCC.exe" "/c/Program Files/Inno Setup 6/ISCC.exe"; do
+  if [ -f "$c" ]; then ISCC="$c"; break; fi
+done
+if [ -z "$ISCC" ]; then
+  echo "ERROR: Inno Setup (ISCC) not found. Run provision-windows.sh first." >&2
   exit 1
 fi
 

scripts/ci/deploy.sh

@@ -131,8 +131,10 @@ mkdir -p /opt/jiu/marketing
 rsync -a --delete /tmp/jiu-marketing-new/ /opt/jiu/marketing/
 rm -rf /tmp/jiu-marketing-new
 
-# Publish desktop client installers to the nginx-served downloads dir
+# Publish desktop client installers to the nginx-served downloads dir.
+# Keep only the latest version: clear old installers, then drop in the new ones.
 mkdir -p /opt/jiu/downloads
+rm -f /opt/jiu/downloads/jiu-windows-* /opt/jiu/downloads/jiu-macos-* 2>/dev/null || true
 [ -f /tmp/jiu-windows-x64-setup.exe ] && mv -f /tmp/jiu-windows-x64-setup.exe /opt/jiu/downloads/ || true
 [ -f /tmp/jiu-macos-x64.zip ] && mv -f /tmp/jiu-macos-x64.zip /opt/jiu/downloads/ || true
 

scripts/ci/install-innosetup.ps1

@@ -0,0 +1,33 @@
+# install-innosetup.ps1 — robust silent install of Inno Setup 6 for the Windows runner.
+# Idempotent: exits 0 immediately if ISCC.exe is already present.
+$ErrorActionPreference = 'Stop'
+
+$candidates = @(
+  "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe",
+  "$env:ProgramFiles\Inno Setup 6\ISCC.exe"
+)
+foreach ($c in $candidates) {
+  if (Test-Path $c) { Write-Output "ISCC already present: $c"; exit 0 }
+}
+
+$url = 'https://jrsoftware.org/download.php/is.exe'
+$out = Join-Path $env:TEMP 'innosetup-installer.exe'
+
+Write-Output "Downloading Inno Setup: $url"
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+# -UseBasicParsing avoids the IE-engine dependency that fails under the SYSTEM account.
+Invoke-WebRequest -Uri $url -OutFile $out -UseBasicParsing
+
+$size = (Get-Item $out).Length
+Write-Output "Downloaded $size bytes"
+if ($size -lt 1000000) { throw "Downloaded file too small ($size bytes) - not a valid installer" }
+
+Write-Output "Installing silently..."
+$p = Start-Process -FilePath $out -ArgumentList '/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-','/NOICONS' -Wait -PassThru
+Write-Output "Installer exit code: $($p.ExitCode)"
+if ($p.ExitCode -ne 0) { throw "Inno Setup installer failed with exit code $($p.ExitCode)" }
+
+foreach ($c in $candidates) {
+  if (Test-Path $c) { Write-Output "ISCC installed: $c"; exit 0 }
+}
+throw "ISCC not found after install (looked in: $($candidates -join ', '))"

scripts/ci/provision-windows.sh

@@ -18,17 +18,16 @@ CUR="${STAMP_DIR}/.flutter-version-win.cur"
 mkdir -p "$STAMP_DIR"
 
 # --- ensure Inno Setup (ISCC) for building the installer (always checked) ---
-ISCC="/c/Program Files (x86)/Inno Setup 6/ISCC.exe"
-if [ ! -f "$ISCC" ]; then
+# ISCC installs to Program Files (x86) (32-bit app); check both to be safe.
+ISCC_X86="/c/Program Files (x86)/Inno Setup 6/ISCC.exe"
+ISCC_X64="/c/Program Files/Inno Setup 6/ISCC.exe"
+if [ ! -f "$ISCC_X86" ] && [ ! -f "$ISCC_X64" ]; then
   echo "==> installing Inno Setup 6 (silent)"
-  # Canonical "latest stable" entry point (redirects to the GitHub release asset).
-  INNO_URL="https://jrsoftware.org/download.php/is.exe"
-  powershell -NoProfile -Command \
-    "Invoke-WebRequest -Uri '${INNO_URL}' -OutFile \"\$env:TEMP\\innosetup.exe\""
-  powershell -NoProfile -Command \
-    "Start-Process -Wait -FilePath \"\$env:TEMP\\innosetup.exe\" -ArgumentList '/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/SP-'"
-  if [ ! -f "$ISCC" ]; then
-    echo "ERROR: Inno Setup install failed — ISCC not found at '$ISCC'." >&2
+  # Robust installer (checks download size + installer exit code) — inline
+  # bash->powershell quoting was the original failure; a .ps1 avoids it.
+  powershell -NoProfile -ExecutionPolicy Bypass -File "${SCRIPT_DIR}/install-innosetup.ps1"
+  if [ ! -f "$ISCC_X86" ] && [ ! -f "$ISCC_X64" ]; then
+    echo "ERROR: Inno Setup install failed — ISCC not found." >&2
     exit 1
   fi
   echo "==> Inno Setup installed."