ci: release through the standards' shared Velopack workflow; publishers fail instead of skip #77

Merged
KofTwentyTwo merged 2 commits from ci/shared-velopack-release into main 2026-10-09 23:03:21 +00:00
2 Commits
Author SHA1 Message Date
james.maesandClaude Fable 5.1 59b0b1a50c ci: switch winget on explicitly through WINGET_PACKAGE_ID
The first winget submission is manual and needs a published stable installer,
so a winget job that always runs would fail the first stable release by design.
The job now runs once the repository variable WINGET_PACKAGE_ID is set (the
standards template's approach) and fails from then on if WINGET_TOKEN is
missing; a deliberate switch, not a silent skip.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-09 17:56:53 -05:00
james.maesandClaude Fable 5.1 46c2c5ac7b ci: release through the standards' shared Velopack workflow; publishers fail instead of skip
The build, pack, SBOM, attestation and GitHub-release steps move to
KofTwentyTwo/standards' release-velopack.yml (pinned to e8ab30f), so the
provenance names a workflow this repository cannot edit (K22-CI-30; closes
exception EX-0004 after the first run). release.yml keeps the tag-on-main check,
the ci gates, and gclo's own publishers (Scoop/Chocolatey manifests PR + choco
push, winget, opt-in NuGet), which run in the tag-restricted `release`
environment and fail when a token or variable is missing rather than skipping.

The locked release publish had never actually run: `-r win-x64 --self-contained
-p:PublishSingleFile=true` changes the restore graph of every project (RID
graph, Microsoft.NET.ILLink.Tasks through the single-file analyzer), so locked
mode rejected the lock files. gclo.Engine, gclo.ViewModels and gclo.Cli now
declare the win-x64 RID and the single-file analyzer, and the lock files carry
both graphs; the exact CLI and app publish commands pass locked mode locally.

The FlaUI suite is a required check on main since today, so the release gates
run it blocking too (the ui-tests-advisory input is gone, #54). Asset names
follow the shared workflow (gclo-cli-win-x64-<version>.zip, Syft SBOMs), release
notes are GitHub's generated notes (New-ReleaseNotes.ps1 removed), and the
LICENSE ships through the project files. RELEASING.md is rewritten around the
required tokens, a rehearsal prerelease, and per-job recovery; ADR 0007 records
the decision.

Closes #76
Closes #54

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
2026-10-09 17:50:15 -05:00