Windows 5/5: release integration and full-system proof - #1010

Merged

arul28 merged 30 commits into

codex/windows-packaging-updatesfrom

codex/windows-release-proof

Aug 3, 2026

Commits on Aug 3, 2026

docs(windows): port release and proof guidance from #999

nsxdavid
authored and
arul28
committed
6a537ac
feat(windows): add exact-SHA release proof gate

arul28
and
nsxdavid
committed
47ca19f
fix(windows): bind standalone runtime proof
arul28
committed
4da126b
fix(windows): promote immutable runtime proof
arul28
committed
98d7d65
fix(windows): enforce exact release artifact identity
arul28
committed
e95578d
fix(release): restore platform-neutral prepare-release dry run
arul28
committed
0a15782
fix(release): pin and check approved Windows proof artifact retention
arul28
committed
24b3334
fix(release): publish runtime assets from the run that built them
arul28
committed
cd21e62
docs(release): document every required release gate and setting
arul28
committed
8c41ebf
feat(release): build and publish Windows on the release tag
arul28
committed
df6f954
docs(release): make the release skill and AGENTS Windows-aware
arul28
committed
96b24c5
docs(release): describe the in-run Windows release model
arul28
committed
786cb73
test(release): pin the Windows standalone checksum normalization
arul28
committed
8624167
docs(release): drop deleted Windows gate variables from supporting docs
arul28
committed
2cc9c34
docs(release): rewrite the signing playbook for the in-run Windows build
arul28
committed
12071e5
docs(sync): state that Linux is a runtime target, not a sync peer
arul28
committed
0df3f1d
fix(release): sign Windows through Azure Artifact Signing
arul28
committed
199324a
fix(release): sign the standalone Windows runtime through Azure Artifact Signing
arul28
committed
e6e7a5d
fix(release): require Azure signing credentials instead of PFX secrets
arul28
committed
d76c310
docs(release): rewrite the Windows signing playbook for Azure Artifact Signing
arul28
committed
1017abb
fix(release): move publishing into its own reusable workflow
arul28
committed
561e607
fix(release): let windows_proof validate a pre-merge commit
arulsharma
committed
39fb091
ci: allow CI to be dispatched for stacked branches
arulsharma
committed
9b9988c
Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof
arulsharma
committed
06d09e0
ci: scope the dispatched secret scan to this branch's commits
arulsharma
committed
1ad268d
ci: invoke gitleaks directly for dispatched runs
arulsharma
committed
a9ba354
fix(release): let windows_proof build without a ci-pass check run
arulsharma
committed
4708ea6
Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof
arul28
committed
6ea1dd5
fix(windows): strip the vendor signature before postject injects the SEA
arulsharma
committed
c239304
Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof
arul28
committed
90a7c7c

Navigation Menu

Windows 5/5: release integration and full-system proof - #1010

Windows 5/5: release integration and full-system proof#1010
arul28 merged 30 commits into
codex/windows-packaging-updatesfrom
codex/windows-release-proof

Commits on Aug 3, 2026

docs(windows): port release and proof guidance from #999

feat(windows): add exact-SHA release proof gate

fix(windows): bind standalone runtime proof

fix(windows): promote immutable runtime proof

fix(windows): enforce exact release artifact identity

fix(release): restore platform-neutral prepare-release dry run

fix(release): pin and check approved Windows proof artifact retention

fix(release): publish runtime assets from the run that built them

docs(release): document every required release gate and setting

feat(release): build and publish Windows on the release tag

docs(release): make the release skill and AGENTS Windows-aware

docs(release): describe the in-run Windows release model

test(release): pin the Windows standalone checksum normalization

docs(release): drop deleted Windows gate variables from supporting docs

docs(release): rewrite the signing playbook for the in-run Windows build

docs(sync): state that Linux is a runtime target, not a sync peer

fix(release): sign Windows through Azure Artifact Signing

fix(release): sign the standalone Windows runtime through Azure Artifact Signing

fix(release): require Azure signing credentials instead of PFX secrets

docs(release): rewrite the Windows signing playbook for Azure Artifact Signing

fix(release): move publishing into its own reusable workflow

fix(release): let windows_proof validate a pre-merge commit

ci: allow CI to be dispatched for stacked branches

Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof

ci: scope the dispatched secret scan to this branch's commits

ci: invoke gitleaks directly for dispatched runs

fix(release): let windows_proof build without a ci-pass check run

Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof

fix(windows): strip the vendor signature before postject injects the SEA

Merge branch 'codex/windows-packaging-updates' into codex/windows-release-proof