leoars · Nov 1, 2026 · Nov 1, 2026
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
-    <Version>0.1.0-alpha.1</Version>
+    <Version>0.1.0-alpha.2</Version>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>

diff --git a/README.md b/README.md
@@ -6,7 +6,7 @@ English | [Português (Brasil)](README.pt-BR.md)
 
 **The SQL Server Management Studio experience, for PostgreSQL.** A native Windows client with Object Explorer, F5 to run, execution plans, session monitoring and backup/restore, built for people who already think in SSMS.
 
-**[Download v0.1.0-alpha.1 for Windows x64](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.1)** · Graphical installer (EN/pt-BR) or portable ZIP, .NET runtime included · Works with PostgreSQL 17 and 18
+**[Download v0.1.0-alpha.2 for Windows x64](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.2)** · Graphical installer (EN/pt-BR) or portable ZIP, .NET runtime included · Works with PostgreSQL 17 and 18
 
 ![PGMS editor, Object Explorer and query results](docs/assets/pgms-results-m959.jpg)
 
@@ -43,7 +43,13 @@ PGMS releases are not code-signed yet, so Windows may show "Windows protected yo
 Get-FileHash .\PGMS-* -Algorithm SHA256
 ```
 
-Compare the hashes with `SHA256SUMS.txt` and the installer's `.sha256` file in the release. v0.1.0-alpha.1 was built on the maintainer's machine, so it has checksums but no build provenance attestation; releases produced by the [release workflow](.github/workflows/release.yml) can additionally be verified with `gh attestation verify`. Code signing through the SignPath Foundation open source program is planned.
+Compare the hashes with `SHA256SUMS.txt` in the release. Starting with v0.1.0-alpha.2 the assets are built by the [release workflow](.github/workflows/release.yml) on GitHub Actions and carry a build provenance attestation, so you can also confirm that the ZIP or installer came from that workflow and this repository (requires the [GitHub CLI](https://cli.github.com/)):
+
+```powershell
+gh attestation verify .\PGMS-0.1.0-alpha.2-Setup-x64.exe --repo leoars/PostgresManagementStudio
+```
+
+v0.1.0-alpha.1 was built on the maintainer's machine and has checksums only. Code signing through the SignPath Foundation open source program is planned.
 
 ### Build from source
 

diff --git a/README.pt-BR.md b/README.pt-BR.md
@@ -6,7 +6,7 @@
 
 **A experiência do SQL Server Management Studio, para PostgreSQL.** Cliente nativo Windows com Object Explorer, F5 para executar, planos de execução, monitor de sessões e backup/restore, feito para quem já pensa em SSMS.
 
-**[Baixar v0.1.0-alpha.1 para Windows x64](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.1)** · Instalador gráfico (EN/pt-BR) ou ZIP portátil, runtime .NET incluído · Funciona com PostgreSQL 17 e 18
+**[Baixar v0.1.0-alpha.2 para Windows x64](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.2)** · Instalador gráfico (EN/pt-BR) ou ZIP portátil, runtime .NET incluído · Funciona com PostgreSQL 17 e 18
 
 ![Editor, Object Explorer e resultados do PGMS](docs/assets/pgms-results-m959.jpg)
 
@@ -43,7 +43,13 @@ As releases do PGMS ainda não são assinadas digitalmente, então o Windows pod
 Get-FileHash .\PGMS-* -Algorithm SHA256
 ```
 
-Compare os hashes com o `SHA256SUMS.txt` e com o arquivo `.sha256` do instalador na release. A v0.1.0-alpha.1 foi compilada na máquina do mantenedor, então tem checksums mas não tem atestado de proveniência de build; releases geradas pelo [workflow de release](.github/workflows/release.yml) podem ser verificadas também com `gh attestation verify`. A assinatura de código pelo programa open source da SignPath Foundation está planejada.
+Compare os hashes com o `SHA256SUMS.txt` da release. A partir da v0.1.0-alpha.2 os assets são compilados pelo [workflow de release](.github/workflows/release.yml) no GitHub Actions e trazem atestado de proveniência de build, então você também pode confirmar que o ZIP ou o instalador saiu desse workflow e deste repositório (exige o [GitHub CLI](https://cli.github.com/)):
+
+```powershell
+gh attestation verify .\PGMS-0.1.0-alpha.2-Setup-x64.exe --repo leoars/PostgresManagementStudio
+```
+
+A v0.1.0-alpha.1 foi compilada na máquina do mantenedor e tem apenas checksums. A assinatura de código pelo programa open source da SignPath Foundation está planejada.
 
 ### Compilar a partir do código
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -2,7 +2,7 @@
 
 English | [Português (Brasil)](SECURITY.pt-BR.md)
 
-PGMS is in development. There is no published supported release series or guaranteed response time. Current development and the v0.1.0-alpha.1 pre-release are the starting points for investigation; historical packages do not automatically receive fixes.
+PGMS is in development. There is no published supported release series or guaranteed response time. Current development and the v0.1.0-alpha.2 pre-release are the starting points for investigation; historical packages do not automatically receive fixes.
 
 Do not disclose an unpatched vulnerability or real credentials in a public issue. Use GitHub's **Report a vulnerability** on this repository if private reporting is enabled. If it is unavailable, open an issue asking the maintainer for a private contact channel without including vulnerability details. Never post database dumps, saved profiles, DPAPI payloads, access tokens or private keys.
 

diff --git a/SECURITY.pt-BR.md b/SECURITY.pt-BR.md
@@ -2,7 +2,7 @@
 
 [English](SECURITY.md) | Português (Brasil)
 
-O PGMS está em desenvolvimento. Não há série de releases publicada com suporte nem prazo de resposta garantido. O desenvolvimento atual e a pré-release v0.1.0-alpha.1 são o ponto de partida para investigação; pacotes históricos não recebem correções automaticamente.
+O PGMS está em desenvolvimento. Não há série de releases publicada com suporte nem prazo de resposta garantido. O desenvolvimento atual e a pré-release v0.1.0-alpha.2 são o ponto de partida para investigação; pacotes históricos não recebem correções automaticamente.
 
 Não divulgue vulnerabilidade sem correção ou credenciais reais em uma issue pública. Use **Report a vulnerability** no GitHub deste repositório se o relato privado estiver habilitado. Se estiver indisponível, abra uma issue pedindo ao mantenedor um canal privado, sem detalhes da vulnerabilidade. Nunca publique dumps, perfis salvos, payloads DPAPI, tokens ou chaves privadas.
 

diff --git a/docs/en/distribution.md b/docs/en/distribution.md
@@ -1,4 +1,4 @@
-# PGMS v0.1.0-alpha.1 — portable distribution (M1008)
+# PGMS v0.1.0-alpha.2 — portable distribution (M1008)
 
 English | Português (Brasil): LEIA-ME.md in the package, or docs/pt-BR/distribution.md in the source repository.
 
@@ -14,4 +14,4 @@ Verify integrity with ./Verify-Package.ps1 -PackagePath . in PowerShell 7; manif
 
 Source, bilingual guides and reporting: https://github.com/leoars/PostgresManagementStudio . Original work is MIT; third-party licenses and trademark terms remain separate. PGMS is independent and does not claim full SSMS parity or endorsement.
 
-Optional release installer: Install-PGMS-0.1.0-alpha.1.ps1 requires PowerShell 7, downloads the fixed release ZIP and verifies its pinned SHA256 before invoking managed installation. Use -ArchivePath for an already downloaded archive and -InstallRoot for another managed target. It does not launch the application, change execution policy or install PostgreSQL. Source and checksums are available on the release page.
+Release assets are built by GitHub Actions from a version tag and published as a draft that the maintainer reviews. The release page provides a single SHA256SUMS.txt covering every asset and a build provenance attestation, verifiable with the GitHub CLI: gh attestation verify <asset> --repo leoars/PostgresManagementStudio. A graphical installer EXE (English/pt-BR, current user or all users) is published alongside this ZIP; the v0.1.0-alpha.1 PowerShell download installer is not part of this release.
diff --git a/docs/en/getting-started.md b/docs/en/getting-started.md
@@ -2,7 +2,7 @@
 
 English | [Português (Brasil)](../pt-BR/getting-started.md)
 
-[Download v0.1.0-alpha.1](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.1): [graphical installer](graphical-installer.md), portable ZIP or PowerShell 7 installer. The graphical installer offers current-user and all-users modes and does not require PowerShell. See [release notes](release-notes.md).
+[Download v0.1.0-alpha.2](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.2): [graphical installer](graphical-installer.md), portable ZIP or PowerShell 7 installer. The graphical installer offers current-user and all-users modes and does not require PowerShell. See [release notes](release-notes.md).
 
 ### Windows SmartScreen warning
 
@@ -12,7 +12,13 @@ PGMS releases are not code-signed yet, so Windows may show "Windows protected yo
 Get-FileHash .\PGMS-* -Algorithm SHA256
 ```
 
-Compare the hashes with `SHA256SUMS.txt` and the installer's `.sha256` file in the release. v0.1.0-alpha.1 was built on the maintainer's machine, so it has checksums but no build provenance attestation; releases produced by the [release workflow](../../.github/workflows/release.yml) can additionally be verified with `gh attestation verify` (see [development](development.md)). Code signing through the SignPath Foundation open source program is planned.
+Compare the hashes with `SHA256SUMS.txt` in the release. Starting with v0.1.0-alpha.2 the assets are built by the [release workflow](../../.github/workflows/release.yml) on GitHub Actions and carry a build provenance attestation, so you can also confirm that the ZIP or installer came from that workflow and this repository (requires the [GitHub CLI](https://cli.github.com/); see [development](development.md)):
+
+```powershell
+gh attestation verify .\PGMS-0.1.0-alpha.2-Setup-x64.exe --repo leoars/PostgresManagementStudio
+```
+
+v0.1.0-alpha.1 was built on the maintainer's machine and has checksums only. Code signing through the SignPath Foundation open source program is planned.
 
 ## Requirements
 

diff --git a/docs/en/graphical-installer.md b/docs/en/graphical-installer.md
@@ -2,7 +2,7 @@
 
 English | [Português (Brasil)](../pt-BR/graphical-installer.md)
 
-Download `PGMS-0.1.0-alpha.1-Setup-x64.exe` and its `.sha256` file from the [alpha.1 release](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.1). This additional installer wraps the exact existing M1008 application payload; the portable ZIP, original checksums and tag remain unchanged. The installer does not require PowerShell or a separately installed .NET runtime.
+Download `PGMS-0.1.0-alpha.2-Setup-x64.exe` from the [alpha.2 release](https://github.com/leoars/PostgresManagementStudio/releases/tag/v0.1.0-alpha.2) and check it against `SHA256SUMS.txt` (and, optionally, `gh attestation verify`). Since v0.1.0-alpha.2 the installer is built by the release workflow from the same payload as the portable ZIP of that release; in v0.1.0-alpha.1 it was added later to wrap the existing M1008 payload. The installer does not require PowerShell or a separately installed .NET runtime.
 
 ## Installation choices