[ryanduguid]

Summary

Gives the fork its own release pipeline and its own Windows registration, so a first release no longer depends on storytold/craft-common-actions at a mutable reference or shares registry state with upstream. Stacked on #25: merge that first.

push ryan/release-*  ->  build and test on Windows, Linux, macOS; drafts nothing
push release         ->  the same, then a draft release with SHA256SUMS.txt
publishing           ->  a person, by hand

• .github/workflows/release.yml: written afresh, unsigned Windows (x64, x86, arm64), Linux (x86_64, aarch64) and ad-hoc signed macOS universal. Refuses a published or moved tag.
• packaging/windows/pdfcraft.wxs, install-policy.json: PlutarchPages.Document, .Edit, .CreatePdf and the RegisteredApplications name, with new context-menu component GUIDs.
• packaging/windows/test-install.ps1: installs the x64 MSI on the runner, runs the CLI, requires a window, uninstalls and checks what's left.
• Metainfo and AppImage update links point at this repository.

Evidence

• Before: dry run 41101087383: 6 of 7 jobs passed, x64 failed on a bug in the new test.
  After: dry run 41111539740 on 33f9d788: all 7 jobs passed, and

  PASS installed, ran 0.15.0, showed the window 'PlutarchPages' and uninstalled.
  

• test-install-policy.ps1 passes locally for x64, x86 and arm64. cargo deny check passes.

• The tag lookup was run by hand: an absent tag, a present tag, a prefix-only match and a missing repository each behaved as intended.

• Alcuin review: rounds 1 and 2 returned changes, all addressed or declined with reasons; round 3 approved 606c7ace.

Merge danger

Door: two-way. Nothing publishes until someone pushes release, and then only a draft. Blast radius: CI, Windows installer.

The Windows registration names are fixed once a release ships: changing them later needs migration. Installing alongside upstream isn't supported, as App Paths\pdfcraft.exe and Applications\pdfcraft.exe stay shared.

Unverified

• The draft job and its tag check haven't run: only a push to release reaches them. An annotated tag and a 5xx response weren't tried.
• The dry run on the final commit 606c7ace was still running when this opened. That commit changes only the draft job, which it skips.
• macOS and Linux packages were built but not installed; the AppImage runs --version.
• The Windows test sees a window but doesn't open a PDF. Windows x86 and arm64 packages aren't installed by it.
• Upgrades aren't tested: that needs 2 versions, so it comes with the second release.
• Flatpak, Arch, FreeBSD, riscv64 and web packages aren't built.
• Builds are unsigned, so Windows SmartScreen and macOS Gatekeeper will warn. App updates trust a SHA-256 from the same release, so they protect against corruption, not against a compromised release.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud