release-velopack.yml builds in KofTwentyTwo/standards (SLSA Build L3): strict
SemVer tag and channel (dev for prereleases, stable otherwise), gates re-run
(locked restore, -warnaserror Release build, tests, coverage), unpackaged
self-contained publish plus an optional single-file CLI, optional Azure Trusted
Signing over OIDC before vpk pack (off until EX-0002 closes), delta baseline
from the previous release, vpk pack, only this build's assets with a trimmed
releases.<channel>.json feed (as vpk upload builds it), CycloneDX SBOMs of the
published output, SHA256SUMS, provenance and SBOM attestations, then a draft
release published last.
The caller template adds an optional winget job (stable only, token in the
caller's release environment, wingetcreate pinned by URL and SHA-256). Docs:
ci-cd K22-CI-30, releases, README workflow table, and the Windows reference
architecture's pipeline section now describe exactly what the workflow does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandClaude Opus 5.5