Fix Windows install security warning from Invoke-WebRequest

install.ps1

@@ -109,6 +109,7 @@ if ($Version -eq "latest") {
   try {
     $Response = Invoke-RestMethod -Uri $ApiUrl -Headers @{ "Accept" = "application/vnd.github.v3+json" }
     $Tag = $Response.tag_name
+    $ReleaseAssets = $Response.assets | ForEach-Object { $_.name }
   } catch {
     Write-Output "Install Failed:"
     Write-Output "  Could not determine the latest release from the GitHub API."
@@ -118,6 +119,18 @@ if ($Version -eq "latest") {
   }
 } else {
   $Tag = $Version
+  $ApiUrl = "https://api.github.com/repos/${Repo}/releases/tags/${Tag}"
+
+  try {
+    $Response = Invoke-RestMethod -Uri $ApiUrl -Headers @{ "Accept" = "application/vnd.github.v3+json" }
+    $ReleaseAssets = $Response.assets | ForEach-Object { $_.name }
+  } catch {
+    # GitHub API unreachable (blocked, rate-limited, …) — fall back to probing
+    # candidate artifacts directly with curl.exe HEAD requests. curl.exe ships
+    # with Windows 10 1803+ and is already used for the binary download below.
+    Write-Output "  GitHub API unavailable ($ApiUrl); falling back to direct artifact probing..."
+    $ReleaseAssets = $null
+  }
 }
 
 # ── Resolve artifact name with automatic x64 fallback ────────────────────────
@@ -127,6 +140,12 @@ if ($Version -eq "latest") {
 #   github-code-search-windows-x64-baseline.exe — compatible with any x86-64 CPU
 #   github-code-search-windows-x64.exe           — legacy alias kept for back-compat
 #   github-code-search-windows-arm64.exe         — ARM64
+#
+# Artifact availability is checked against the GitHub release asset list already
+# fetched above — no extra network request needed, and no Invoke-WebRequest
+# which triggers a security warning on Windows PowerShell 5.1.
+# When the API was unreachable ($ReleaseAssets is $null), we fall back to
+# probing candidate URLs with curl.exe HEAD requests instead.
 
 $CandidateTargets = @($Target)
 if ($Target -eq "x64-modern") {
@@ -139,22 +158,30 @@ if ($Target -eq "x64-modern") {
 $Artifact = $null
 foreach ($Candidate in $CandidateTargets) {
   $CandidateArtifact = "${BinaryName}-windows-${Candidate}.exe"
-  $CheckUrl = "https://github.com/${Repo}/releases/download/${Tag}/${CandidateArtifact}"
-  try {
-    # -UseBasicParsing is removed in PowerShell 6+ (pwsh); omit it for compat.
-    $Null = Invoke-WebRequest -Uri $CheckUrl -Method Head -ErrorAction Stop
+  $Found = $false
+  if ($null -ne $ReleaseAssets) {
+    $Found = $ReleaseAssets -contains $CandidateArtifact
+  } else {
+    # Fallback: probe via curl.exe HEAD (no Invoke-WebRequest, no PS5.1 warning).
+    $CheckUrl = "https://github.com/${Repo}/releases/download/${Tag}/${CandidateArtifact}"
+    $null = curl.exe -fsI $CheckUrl 2>$null
+    $Found = $LASTEXITCODE -eq 0
+  }
+  if ($Found) {
     $Artifact = $CandidateArtifact
     $Target = $Candidate
     break
-  } catch {
-    Write-Output "  Variant windows-${Candidate} not found in release ${Tag}, trying next..."
   }
 }
 
 if ($null -eq $Artifact) {
+  $AvailableWindows = if ($null -ne $ReleaseAssets) { $ReleaseAssets | Where-Object { $_ -like "*windows*" } } else { @() }
   Write-Output "Install Failed:"
   Write-Output "  No compatible Windows binary found for ${Tag}."
   Write-Output "  Tried: $($CandidateTargets -join ', ')"
+  if ($AvailableWindows) {
+    Write-Output "  Available Windows assets: $($AvailableWindows -join ', ')"
+  }
   exit 1
 }