feat: one-command installers for macOS, Linux and Windows

deployment/install.sh (curl | bash) and install.ps1 (irm | iex) check for
Docker, install uv when it is missing or older than 0.8 (pinned 0.12.15 via
Astral's installer), install or upgrade the docsgpt package with
`uv tool install`, and hand the terminal to `docsgpt up` with any arguments.
On Linux without Docker the shell installer offers get.docker.com. Both run
entirely inside a function, so a download cut short runs nothing.

Releases attach both scripts next to the Compose file, which is where
docs.ac/install and docs.ac/install.ps1 will point. installer-lint.yml runs
shellcheck and the PowerShell parser; docker-image-verify.yml now installs
through install.sh. README, Quickstart, Docker-Deploying and the changelog
lead with the one-liner.

.github/workflows/ci.yml

@@ -206,9 +206,16 @@ jobs:
           ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
-      - name: Attach the standalone compose file to the release
+      # The installers are served from these assets: docs.ac/install redirects to
+      # releases/latest/download/install.sh (and install.ps1), so the script a
+      # user runs always comes from the newest release.
+      - name: Attach the standalone compose file and the installers to the release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ env.RELEASE_TAG }}
         run: |
-          gh release upload "$TAG" deployment/docker-compose-standalone.yaml --clobber
+          gh release upload "$TAG" \
+            deployment/docker-compose-standalone.yaml \
+            deployment/install.sh \
+            deployment/install.ps1 \
+            --clobber

.github/workflows/docker-image-verify.yml

@@ -23,6 +23,7 @@ on:
       - 'frontend/**'
       - 'scripts/build_frontend.sh'
       - 'deployment/docker-compose-standalone.yaml'
+      - 'deployment/install.sh'
       - 'docsgpt/deploy/**'
       - 'docsgpt/cli.py'
       - 'docsgpt/core/paths.py'
@@ -98,41 +99,29 @@ jobs:
           curl -fsS "$base/settings" | grep -q 'src="/config.js"'
           echo "API and UI served on $base"
 
-      - name: Set up uv
-        if: matrix.variant == ''
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
-        with:
-          # No cache: a cache restored into a job that runs the built image is a poisoning risk.
-          enable-cache: false
-
-      - name: docsgpt up runs the same image from the installed package
+      - name: The installer runs docsgpt up on the same image
         if: matrix.variant == ''
+        env:
+          DOCSGPT_NO_MODIFY_PATH: "1"
         run: |
           set -euo pipefail
           # Same Compose project name as the step above; stop that stack first.
           docker compose -f deployment/docker-compose-standalone.yaml down -v
-          uv build --wheel --out-dir "$RUNNER_TEMP/dist"
-          uv venv "$RUNNER_TEMP/venv"
-          uv pip install --python "$RUNNER_TEMP/venv/bin/python" "$RUNNER_TEMP"/dist/*.whl
-          docsgpt="$RUNNER_TEMP/venv/bin/docsgpt"
-          stack="$RUNNER_TEMP/stack"
-          "$docsgpt" up --yes --dir "$stack" --image-tag verify
-          "$docsgpt" status --dir "$stack"
+          pipx run build --wheel --outdir "$RUNNER_TEMP/dist"
+          export DOCSGPT_PACKAGE="$(ls "$RUNNER_TEMP"/dist/docsgpt-*.whl)"
+          # No uv is set up beforehand, so the installer's pinned uv download runs too.
+          # Without a terminal the installer passes --yes to docsgpt up.
+          bash deployment/install.sh --image-tag verify </dev/null
+          docsgpt="$HOME/.local/bin/docsgpt"
+          stack="$HOME/.docsgpt/server"
+          "$docsgpt" status
           curl -fsS http://127.0.0.1:7091/ | grep -q 'src="/config.js"'
-          # Each secret must appear exactly once with a value: a missing or empty one
-          # falls back to a default silently.
-          check_secrets() {
-            for key in POSTGRES_PASSWORD JWT_SECRET_KEY; do
-              [ "$(grep -Ec "^$key=.+$" "$stack/.env")" -eq 1 ]
-            done
-          }
-          check_secrets
-          secrets=$(grep -E '^(POSTGRES_PASSWORD|JWT_SECRET_KEY)=.+$' "$stack/.env" | sort)
-          # Running up again keeps them; a changed database password locks the stack out of its volume.
-          "$docsgpt" up --yes --dir "$stack" --image-tag verify
-          check_secrets
-          [ "$(grep -E '^(POSTGRES_PASSWORD|JWT_SECRET_KEY)=.+$' "$stack/.env" | sort)" = "$secrets" ]
-          "$docsgpt" uninstall --yes --purge --dir "$stack"
+          grep -q '^POSTGRES_PASSWORD=' "$stack/.env"
+          # Running the installer again upgrades in place and keeps the generated secrets.
+          before=$(grep '^JWT_SECRET_KEY=' "$stack/.env")
+          bash deployment/install.sh --image-tag verify </dev/null
+          [ "$(grep '^JWT_SECRET_KEY=' "$stack/.env")" = "$before" ]
+          "$docsgpt" uninstall --yes --purge
           test ! -e "$stack"
 
       - name: Stack logs

.github/workflows/installer-lint.yml

@@ -0,0 +1,47 @@
+name: Lint the installers
+
+# deployment/install.sh runs as `curl | bash` on macOS (bash 3.2) and Linux, and
+# deployment/install.ps1 as `irm | iex` on Windows; a syntax error in either
+# breaks every install at once. The end-to-end run through install.sh is in
+# docker-image-verify.yml.
+
+on:
+  pull_request:
+    paths:
+      - 'deployment/install.sh'
+      - 'deployment/install.ps1'
+      - '.github/workflows/installer-lint.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'deployment/install.sh'
+      - 'deployment/install.ps1'
+      - '.github/workflows/installer-lint.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: shellcheck install.sh
+        run: |
+          bash -n deployment/install.sh
+          shellcheck --shell=bash deployment/install.sh
+
+      - name: Parse install.ps1
+        shell: pwsh
+        run: |
+          $tokens = $null
+          $errors = $null
+          [System.Management.Automation.Language.Parser]::ParseFile("$PWD/deployment/install.ps1", [ref]$tokens, [ref]$errors) | Out-Null
+          if ($errors.Count) {
+            $errors | ForEach-Object { Write-Host "install.ps1:$($_.Extent.StartLineNumber): $($_.Message)" }
+            exit 1
+          }
+          Write-Host 'install.ps1 parses'