fix(ci): deploy-client 用 env 传 REF_NAME(防 Actions 注入)+ job.status 同法

安全审查:run: 里内联 ${{ gitea.ref_name }} 有注入风险(恶意 tag 名);改经 env REF_NAME
+ 引用 "$REF_NAME"(同 deploy-server.yml 的 TAG 做法)。notify 的 job.status 同法。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-client.yml

@@ -45,7 +45,8 @@ jobs:
         env:
           RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: bash scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-android.sh "$REF_NAME"
 
       - name: Upload android artifact
         uses: actions/upload-artifact@v3
@@ -53,12 +54,30 @@ jobs:
           name: android
           path: dist/
 
-  # build-windows(runs-on: windows)本轮移除:pangolin 暂无 windows runner。
-  # 待注册 windows runner 后从 git 历史(commit 2698116)恢复该 job + release-deploy
-  # 的 needs/下载步骤 + compile-windows.sh 已就绪。
+  build-windows:
+    runs-on: windows
+    env:
+      GOPROXY: https://goproxy.cn,direct
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile (Windows installer)
+        shell: bash
+        env:
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/compile-windows.sh "$REF_NAME"
+
+      - name: Upload windows artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: windows
+          path: dist/
 
   release-deploy:
-    needs: [build-android]
+    needs: [build-android, build-windows]
     runs-on: mac
     steps:
       - name: Checkout
@@ -70,26 +89,36 @@ jobs:
           name: android
           path: dist/
 
+      - name: Download windows artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: windows
+          path: dist/
+
       - name: Release → Forgejo
         env:
           FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
           FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
-        run: bash scripts/ci/release-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/release-client.sh "$REF_NAME"
 
       - name: Deploy → pangolin1 (downloads/)
         env:
           DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: bash scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+          REF_NAME: ${{ gitea.ref_name }}
+        run: bash scripts/ci/deploy-client.sh "$REF_NAME"
 
       - name: Notify
         if: always()
         env:
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REF_NAME: ${{ gitea.ref_name }}
+          JOB_STATUS: ${{ job.status }}
         run: |
           . scripts/ci/notify.sh
-          if [ "${{ job.status }}" = "success" ]; then
-            notify_ok "client ${{ gitea.ref_name }} released + deployed"
+          if [ "$JOB_STATUS" = "success" ]; then
+            notify_ok "client $REF_NAME released + deployed"
           else
-            notify_fail "client ${{ gitea.ref_name }} pipeline failed"
+            notify_fail "client $REF_NAME pipeline failed"
           fi