ci: rerun every main gate before release publication #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/AppKit#4
Reference in new issue
Block a user
Problem
AppKit and starter release wrappers run build/unit/coverage but omit format, UI and security gates. The starter also lacks gclo's tag-on-main verification (K22-CI-31).
Acceptance criteria
Verify tags belong to main; rerun applicable build, coverage, format, UI, script and security/CodeQL gates before any publishing job; lint workflows and validate live CI.
Scope
AppKit and windows-app-template.
This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.
Implemented locally in AppKit and both starter release variants: tag-on-main ancestry verification; reusable build/unit/coverage/format/UI gates; security and CodeQL before publication; script gates before publication. Main-event check names are preserved. Actionlint and offline zizmor pass. Live release workflow execution is still pending; no release was triggered.
Committed release gate changes locally: AppKit
36886cbaae8810bf9c9a3c85867a2cee51d0ba3d; windows-app-templatea5cbc98cd72e7223a0f61c5c4a237afc0de60efe.Release callers require tag ancestry on main and successful CI, security, CodeQL, and script gates before publication. AppKit also runs its review validator tests. Missing NUGET_USER fails NuGet preflight. Generated CLI/no-CLI app releases retain Velopack stable/dev behavior. Workflow lint and security hooks passed.
Remaining: publish through PRs and observe the gates in GitHub Actions before a new release. Both commits are signed and signed off; neither has been pushed. AI assistance: Codex (GPT-6).
Additional release gate saved in signed commit
ed19eaf69ef3ad3add74c1d42da87011e95afc0e: the NuGet release caller now waits for mutation runs against both library projects. The local tool is pinned to Stryker.NET 5.0.0; failing baseline tests or tool failures block publication, and HTML/JSON evidence is retained. Local complete-project runs, format, PowerShell lint and actionlint/zizmor verification pass. Survivor decisions are documented; scores are advisory and do not replace release review. Live workflow execution remains pending publication of this branch. Substantial AI assistance: Codex (GPT-6).Signed local AppKit commit
a8d9cf7efe5a3ca03c88442d776765ad4de9bc41adds signing and Azure-administration regression gates: 31 combined Pester checks pass, including 21 signing/distribution cases and six identity/tenant/scope/federation safeguards. Signing failure, verification failure, missing Azure configuration, or an unsigned shared builder blocks the next release preflight; no unsigned fallback is permitted. The signing-enabled shared builder is prepared in an isolated standards branch, not published yet.Relevant quality gates and commit hooks pass; no .NET runtime code changed in this commit. Existing latest AppKit evidence remains 161 unit tests, 100% core/updates line coverage and 14 UI tests. Real Azure signing and live CI remain pending; a Microsoft-signed tool verification is not AppKit signing proof. Details and remaining actions are tracked in #12 and
docs/release-signing.md. No push, merge or new release occurred; keep this ticket open for live acceptance evidence.