[leoars]

What changed / O que mudou

Part A, release workflow. New .github/workflows/release.yml, triggered only by tags v* or workflow_dispatch, never by pushes to main. Jobs: validate (tag must equal v + installer/release.json Version; Directory.Build.props Version and BuildInfo.cs milestone must match release.json; otherwise the run fails), build (Publish.ps1 -SelfContained with ContinuousIntegrationBuild/Deterministic, then Verify-Package.ps1, Test-Package.ps1, Test-PackageGuides.ps1, unsigned payload uploaded as artifact), sign-binaries (SignPath, skipped unless repository variable SIGNPATH_ENABLED == 'true'), package (New-PackageArchive.ps1, Inno Setup 7.1.1 x64 downloaded from the official jrsoftware release, SHA256 pinned and verified, installed in portable mode, Build-GraphicalInstaller.ps1 -SkipFrozenManifest, informational Test-PackageLaunch.ps1), sign-installer (SignPath, same gate), attest (actions/attest-build-provenance on the final ZIP and installer, only job with id-token/attestations: write), release (SHA256SUMS.txt, EN/pt-BR notes attached, draft + prerelease via gh release create, fails if a release for the tag already exists; only job with contents: write). Every action is pinned by commit SHA with a version comment, as in build.yml.

scripts/Build-GraphicalInstaller.ps1 gains -SkipFrozenManifest: CI builds the payload in the same run, so its manifest hash cannot be the frozen one in release.json; milestone and product version checks are kept and local builds still enforce the frozen hash. Process documented in docs/en|pt-BR/development.md (new "Release" section, gh attestation verify, SignPath variables/secret) and noted in graphical-installer.md.

Part B, SmartScreen. "Windows SmartScreen warning / Aviso do SmartScreen do Windows" added under Install/Instalar in both READMEs and in both getting-started guides, with Get-FileHash only; it states that v0.1.0-alpha.1 was built locally and has checksums but no attestation, and that CI-built releases can additionally be verified with gh attestation verify.

Why / Por quê

Prerequisite for the SignPath Foundation program (automated CI build with origin verification) and for verifiable downloads; the SmartScreen text explains the unsigned alpha honestly in the meantime.

Validation actually run / Validação realmente executada

• Test run of the workflow from this branch, triggered by the build-metadata test tag v0.1.0-alpha.1+ci.1 (not a version tag): https://github.com/leoars/PostgresManagementStudio/actions/runs/41271198752. Outcome, local Verify-Package.ps1/Test-PackageArchive.ps1 of the CI ZIP and Test-GraphicalInstaller.ps1 of the CI installer are reported in the PR comments. The resulting draft and the test tag must be deleted after review (maintainer's authorization).
• scripts/Test-PublicDocumentation.ps1: Valid = True, 15 language pairs, 32 public documents, 190 local links, CommandsMatch = True.
• git diff --check: clean. PowerShell parser on the modified script: 0 errors.
• Not run: SignPath jobs (no account yet); nothing was published and the existing v0.1.0-alpha.1 release was not touched.

Differences from the specification / Diferenças em relação à especificação

• workflow_dispatch cannot be used until the workflow exists on main (GitHub returns 404 for workflows that only exist on a branch), so the test run used a pushed tag with semver build metadata; the validator accepts metadata on either trigger and marks such runs as test drafts.
• Draft release creation uses the gh CLI with GITHUB_TOKEN instead of a third-party release action (one less dependency to pin).
• attest is a separate job from release so that id-token/attestations: write and contents: write never share a job.
• Test-PackageLaunch.ps1 runs on the hosted runner as informational (continue-on-error), because the runner session is not a certified desktop; the release does not depend on it.
• The SmartScreen snippet uses Get-FileHash .\PGMS-* in both languages so that the documentation check (identical PowerShell blocks across languages) passes; the gh attestation verify line is in development.md instead of the README, as the alpha.1 assets have no attestation.

Checklist

• No credentials, personal data, dumps, saved profiles or local artifacts are included. / Sem credenciais, dados pessoais, dumps, perfis salvos ou artefatos locais.
• Tests used only synthetic data and the isolated project cluster. / Testes usaram apenas dados sintéticos e o cluster isolado do projeto. (no database tests in this change)
• Public documentation updated in both docs/en and docs/pt-BR (and both READMEs) when relevant. / Documentação pública atualizada em docs/en e docs/pt-BR (e nos dois READMEs) quando pertinente.
• No SSMS parity or platform certification is claimed beyond what was tested. / Nenhuma paridade com SSMS ou certificação de plataforma declarada além do testado.
• Known limits of the change are stated above. / Limites conhecidos da mudança estão descritos acima.

🤖 Generated with Claude Code

[leoars]

Test run result and local verification of the CI assets

Workflow test run (push of the test tag v0.1.0-alpha.1+ci.1 at a8a72e9): https://github.com/leoars/PostgresManagementStudio/actions/runs/41271198752

Job	Result
Validate tag and declared version	success
Build self-contained payload	success (Verify-Package / Test-Package / Test-PackageGuides inside the job)
Package ZIP and graphical installer	success (Inno Setup 7.1.1 hash-verified; informational smoke on the runner: MainWindowObserved: True, ExitCode: 0)
Sign application binaries (SignPath)	skipped (SIGNPATH_ENABLED not set)
Attest build provenance	success
Sign installer (SignPath)	skipped
Create draft pre-release	success

Resulting draft pre-release v0.1.0-alpha.1+ci.1 (target a8a72e9) carries PGMS-0.1.0-alpha.1-win-x64.zip, PGMS-0.1.0-alpha.1-Setup-x64.exe, package-manifest.json, SHA256SUMS.txt, RELEASE-NOTES.md, RELEASE-NOTES.pt-BR.md. It is a test draft and should be deleted together with the test tag after review; the real v0.1.0-alpha.1 release was not touched.

Local verification of the assets downloaded from the draft (this machine, Windows 11, PowerShell 7):

• SHA256SUMS.txt matches the downloaded ZIP (6a5a0c62…bcf9) and installer (07c37df2…430a).
• gh attestation verify succeeded for both the ZIP and the installer (Sigstore bundle bound to .github/workflows/release.yml@refs/tags/v0.1.0-alpha.1+ci.1, commit a8a72e9, github-hosted runner).
• Verify-Package.ps1 on the extracted ZIP: M1008 SelfContained 521 files Valid=True.
• Test-PackageArchive.ps1: extraction matches the manifest.
• Test-PackageGuides.ps1: Valid=True, bundled guides equal to the sources.
• Test-PackageLaunch.ps1 on the extracted payload: MainWindowObserved=True, bundled coreclr.dll, isolated state, ExitCode=0, Valid=True.
• Test-GraphicalInstaller.ps1 on the CI-built installer: Valid=True, 17 checks (refuses unmanaged/junction targets and locked executable, current-user install, native uninstaller registration, desktop shortcut, installed app opens with bundled runtime, repair in Portuguese, native uninstall preserving user data). Global install not executed.

Differences from the handoff specification and why:

1. workflow_dispatch could not be used for the test run: GitHub returns 404 for a workflow that does not yet exist on the default branch. The run was triggered by pushing a tag with build metadata (+ci.1), which the validate job accepts as a test draft on any trigger.
2. The release is created with gh release create --draft --prerelease --target <sha> instead of a third-party release action, to keep the only third-party actions the pinned ones for Inno Setup/SignPath and attestation.
3. Attestation runs in a separate job (attest) after packaging so the id-token/attestations permissions are confined to it.
4. The packaged-app launch smoke on the hosted runner is informational (continue-on-error) because the runner session is not a certified desktop; it still passed.
5. The SmartScreen snippet uses Get-FileHash (language-neutral) so the EN/pt-BR code blocks stay identical for Test-PublicDocumentation.ps1; the gh attestation verify command lives in docs/*/development.md.
6. Build-GraphicalInstaller.ps1 gained -SkipFrozenManifest for CI, where the payload comes from the same run and cannot match the locally frozen manifest hash in installer/release.json; milestone and product version are still compared.

No merge was performed.