fix(releases): pin corrected signing builder and prepare downloads #39
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#39
Reference in new issue
Block a user
Both1.0.1 release candidates passed acceptance and Azure login but stopped before signing because of the shared inline PowerShell wrapper. Pin the corrected, personally approved standards1.1.2 builder at083d903. Preserve failed tags; use new1.0.2 stable/dev refs, prepare direct EXE/ZIP download links, correct portable-update guidance and developer verification links, and set the next development prefix to1.0.3. Application behavior remains the reviewed and fully accepted PR37 source.
Validation: five actual Markdown files pass canonical lint; actionlint and signed-commit hooks pass. Exact-head full hosted checks are running. Production publication and downloaded-artifact signature/provenance verification remain required. MSI remains next release per the owner's latest decision. OpenSSF remains70%, not passing.
The owner expressly authorized completion without further human-review requests. This is a release-specific waiver, not a fabricated personal-read acknowledgement. Preserve all technical/security/signature gates. Substantial AI assistance: Codex GPT-6. Refs #33, #34 and KofTwentyTwo/standards#45.
Automated review of exact documentation head464c71c5f3586cc7a3c7be631b2cd06c37e34222 (Codex): no findings identified.
The diff changes six files: user-facing download links, portable update guidance supported by actual AppKit probes, the developer verification anchor, truthful release-source/live-checklist references, and the next development VersionPrefix1.0.2. Application logic, dependencies, workflows, trust scopes and tests are unchanged. All five actual Markdown files pass canonical rules; the single version-prefix XML value is1.0.2 and commit hooks pass.
Existing release tags remain on4c0ccc7. Documentation link names and final signing claims must be checked against actually published assets before this PR merges. Full exact-head CI is running. Genuine maintainer acknowledgement is still requested; this review comment does not claim it occurred.
Automated review of exact head63b50245984c8ab4682b75dfcede410d593d4ab9 (Codex): no findings identified. Seven files update only the immutable signing-builder pin, release documentation/download URLs, portable update guidance, verification anchor and next development version. Application behavior, dependencies, NuGet mapping, Azure trust, owned signing catalog and technical tests are unchanged. Five actual source Markdown files pass canonical lint; workflow syntax and signed-commit hooks pass. Exact-head full CI is running.
Maintainer authorization in the active session: "no more human review re - get this released". This explicitly waives further personal-review requests for finishing these stable/dev releases. It is not a claim that the maintainer read this new head. Automated review and all technical gates still must pass; release publication was already authorized. The existing review check requires personal-read wording, which must not be fabricated. Any release-specific rules exception must affect only that manual acknowledgement context and be restored immediately after the merge.