test: harden Windows persistence teardown

.github/workflows/ci.yml

@@ -16,13 +16,17 @@ jobs:
   validate:
     name: Windows validation
     runs-on: windows-latest
-    timeout-minutes: 20
+    # The full repository validation runs 43 persistence suites sequentially in
+    # Windows PowerShell child processes. On a hosted runner that takes about 33
+    # minutes, so the job limit must cover it with margin for the lifecycle,
+    # release-contract and TrayHost steps that follow.
+    timeout-minutes: 90
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
@@ -49,3 +53,7 @@ jobs:
       - name: Run production TrayHost smoke test
         shell: pwsh
         run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
+
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly

.github/workflows/release.yml

@@ -11,6 +11,10 @@ on:
         required: true
         type: string
 
+concurrency:
+  group: ccod-draft-${{ github.event.inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
@@ -19,6 +23,7 @@ jobs:
     runs-on: windows-latest
     outputs:
       tag: ${{ steps.release.outputs.tag }}
+      commit: ${{ steps.commit.outputs.commit }}
     steps:
       - name: Validate release tag
         id: release
@@ -27,25 +32,76 @@ jobs:
           CCOD_RELEASE_TAG_INPUT: ${{ inputs.tag }}
         run: |
           $tag = if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') { [string]$env:CCOD_RELEASE_TAG_INPUT } else { [string]$env:GITHUB_REF_NAME }
-          $tag = $tag.Trim()
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag must be canonical vX.Y.Z; received '$tag'."
           }
           "tag=$tag" >> $env:GITHUB_OUTPUT
 
-  build:
+      - name: Check out the validated release tag
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ steps.release.outputs.tag }}
+          fetch-depth: 1
+
+      - name: Resolve immutable release commit
+        id: commit
+        shell: pwsh
+        run: |
+          $commit = ([string](& git rev-parse HEAD)).Trim().ToLowerInvariant()
+          if ($LASTEXITCODE -ne 0 -or $commit -cnotmatch '^[0-9a-f]{40}$') {
+            throw "Release tag did not resolve to a canonical commit: '$commit'."
+          }
+          "commit=$commit" >> $env:GITHUB_OUTPUT
+
+  preflight:
     needs: prepare
     outputs:
       tag: ${{ needs.prepare.outputs.tag }}
+      commit: ${{ needs.prepare.outputs.commit }}
+    runs-on: windows-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ needs.prepare.outputs.commit }}
+
+      - name: Run clean release runner
+        shell: pwsh
+        env:
+          CCOD_RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+        run: |
+          $tag = $env:CCOD_RELEASE_TAG
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
+            throw "Release tag output is invalid: '$tag'."
+          }
+          $version = $tag.Substring(1)
+          Import-Module (Join-Path $PWD 'tools\Test-CleanReleaseRunner.psm1') -Force -DisableNameChecking
+          $result = Test-CcodCleanReleaseRunner -RepositoryRoot $PWD -ExpectedVersion $version
+          $artifact = Join-Path $PWD 'build\preflight\clean-preflight.json'
+          New-Item -ItemType Directory -Path (Split-Path $artifact -Parent) -Force | Out-Null
+          Copy-Item -LiteralPath $result.PreflightPath -Destination $artifact -Force
+
+      - name: Upload immutable clean preflight evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: CodexRemote-fix clean preflight
+          path: build/preflight/clean-preflight.json
+          if-no-files-found: error
+
+  build:
+    needs: preflight
+    outputs:
+      tag: ${{ needs.preflight.outputs.tag }}
+      commit: ${{ needs.preflight.outputs.commit }}
     runs-on: windows-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
-          ref: ${{ needs.prepare.outputs.tag }}
+          ref: ${{ needs.preflight.outputs.commit }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
@@ -65,160 +121,109 @@ jobs:
         shell: pwsh
         run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionOnly
 
+      - name: Run authenticated TrayHost production trace
+        shell: pwsh
+        run: ./tests/trayhost/Invoke-TrayHostSelfTest.ps1 -ProductionTraceOnly
+
       - name: Build CodexRemote-fix portable bundle
         shell: pwsh
         env:
-          CCOD_RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+          CCOD_RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
         run: |
           $version = $env:CCOD_RELEASE_TAG.Substring(1)
           ./build/build.ps1 -Version $version
 
       - name: Upload immutable CodexRemote-fix portable bundle
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: CodexRemote-fix portable bundle
-          path: build/dist/*
+          path: build/dist
           if-no-files-found: error
 
-  publish:
+  stage:
     needs: build
     runs-on: windows-latest
     permissions:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
-          ref: ${{ needs.build.outputs.tag }}
+          ref: ${{ needs.build.outputs.commit }}
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: 22
 
       - name: Download immutable CodexRemote-fix portable bundle
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: CodexRemote-fix portable bundle
           path: build/dist
 
-      - name: Verify downloaded release candidate contract
+      - name: Download immutable clean preflight evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          name: CodexRemote-fix clean preflight
+          path: build/preflight
+
+      - name: Materialize transferred clean preflight evidence
         shell: pwsh
         env:
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
         run: |
-          npm run test:release-contract
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
-            throw "Release tag output is invalid: '$tag'."
-          }
           $version = $tag.Substring(1)
-          . ./tools/Test-ReleaseDefender.ps1 -Library
-          $manifestPath = Join-Path $PWD ("build\dist\CodexRemote-fix-$version-release-manifest.json")
-          Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
-          $setupManifestPath = Join-Path $PWD ("build\dist\CodexRemote-fix-$version-setup-release-manifest.json")
-          Test-CcodReleaseAssetManifest -ManifestPath $setupManifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          $source = Join-Path $PWD 'build\preflight\clean-preflight.json'
+          $evidence = Join-Path $env:RUNNER_TEMP 'ccod-draft-evidence'
+          New-Item -ItemType Directory -Path $evidence -Force | Out-Null
+          Copy-Item -LiteralPath $source -Destination (Join-Path $evidence ("CodexRemote-fix-$version-clean-preflight.json")) -Force
 
-      - name: Publish GitHub release
+      - name: Verify downloaded release candidate contract
         shell: pwsh
         env:
-          GH_TOKEN: ${{ github.token }}
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
+          CCOD_RELEASE_COMMIT: ${{ needs.build.outputs.commit }}
         run: |
+          npm run test:release-contract
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag output is invalid: '$tag'."
           }
           $version = $tag.Substring(1)
-          $changelog = Get-Content -LiteralPath (Join-Path $PWD 'CHANGELOG.md') -Raw -Encoding UTF8
-          $releaseSection = [regex]::Match($changelog, '(?ms)^## ' + [regex]::Escape($tag) + '\r?\n(.*?)(?=^## |\z)')
-          if (-not $releaseSection.Success) {
-            throw "CHANGELOG.md has no release section for $tag"
-          }
-          $englishSection = [regex]::Match($releaseSection.Groups[1].Value, '(?ms)^### English\r?\n(.*?)(?=^### |\z)')
-          if (-not $englishSection.Success) {
-            throw "CHANGELOG.md has no English release section for $tag"
-          }
-          $notesPath = Join-Path $env:RUNNER_TEMP ("CodexRemote-fix-$tag-release-notes.md")
-          Set-Content -LiteralPath $notesPath -Value ("# CodexRemote-fix $version`n`n" + $englishSection.Groups[1].Value.Trim() + "`n") -Encoding UTF8
-          & gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets 2>$null | Out-Null
-          $exists = $LASTEXITCODE -eq 0
-          $existingAssets = @()
-          if ($exists) {
-            $existingAssets = @(& gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets --jq '.assets[].name')
-            if ($LASTEXITCODE -ne 0) {
-              throw "Could not inspect existing release assets for $tag."
-            }
-          }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json') })
-          $assetNames = @($assets | ForEach-Object { $_.Name })
-          $unexpected = @($existingAssets | Where-Object { $assetNames -cnotcontains $_ })
-          if ($unexpected.Count -ne 0) {
-            throw "Existing release $tag contains unexpected assets and cannot be safely updated: $($unexpected -join ', ')"
-          }
-          foreach ($asset in $assets) {
-            if ($existingAssets -ccontains $asset.Name) {
-              $downloadRoot = Join-Path $env:RUNNER_TEMP ('ccod-existing-asset-' + [guid]::NewGuid().ToString('N'))
-              New-Item -ItemType Directory -Path $downloadRoot -Force | Out-Null
-              try {
-                & gh release download $tag --repo $env:GITHUB_REPOSITORY --pattern $asset.Name --dir $downloadRoot
-                if ($LASTEXITCODE -ne 0) {
-                  throw "Could not download existing release asset $($asset.Name)."
-                }
-                $existingAsset = Join-Path $downloadRoot $asset.Name
-                if (-not (Test-Path -LiteralPath $existingAsset -PathType Leaf) -or
-                    (Get-FileHash -LiteralPath $existingAsset -Algorithm SHA256).Hash.ToLowerInvariant() -cne (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant()) {
-                  throw "Existing release asset $($asset.Name) differs from the immutable candidate."
-                }
-              } finally {
-                if (Test-Path -LiteralPath $downloadRoot) { Remove-Item -LiteralPath $downloadRoot -Recurse -Force -ErrorAction SilentlyContinue }
-              }
-            }
+          Import-Module (Join-Path $PWD 'tools\ReleaseAssetContract.psm1') -Force
+          $names = @(Get-CcodExpectedReleaseAssetNames -Version $version)
+          $candidate = Test-CcodExactReleaseAssetSet -AssetDirectory (Join-Path $PWD 'build/dist') -Version $version
+          if ($env:CCOD_RELEASE_COMMIT -cnotmatch '^[0-9a-f]{40}\z' -or $candidate.GitCommit -cne $env:CCOD_RELEASE_COMMIT) {
+            throw 'CCOD_RELEASE_BUILD_COMMIT_MISMATCH'
           }
-          if (-not $exists) {
-            gh release create $tag --repo $env:GITHUB_REPOSITORY --title "CodexRemote-fix $version" --notes-file $notesPath
-          } else {
-            gh release edit $tag --repo $env:GITHUB_REPOSITORY --title "CodexRemote-fix $version" --notes-file $notesPath
-          }
-          foreach ($asset in $assets) {
-            if ($existingAssets -cnotcontains $asset.Name) {
-              & gh release upload $tag --repo $env:GITHUB_REPOSITORY $asset.FullName
-              if ($LASTEXITCODE -ne 0) {
-                throw "Could not upload release asset $($asset.Name)."
-              }
-            }
+          $manifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-release-manifest.json')
+          Test-CcodReleaseAssetManifest -ManifestPath $manifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          $setupManifestPath = Join-Path $PWD ('build\dist\CodexRemote-fix-' + $version + '-setup-release-manifest.json')
+          Test-CcodReleaseAssetManifest -ManifestPath $setupManifestPath -AssetDirectory (Join-Path $PWD 'build\dist') -ExpectedVersion $version | Out-Null
+          if ($names.Count -ne 11) {
+            throw 'Release candidate does not expose the exact 11 public names.'
           }
 
-      - name: Read back published GitHub release assets
+      - name: Stage private GitHub draft
         shell: pwsh
         env:
           GH_TOKEN: ${{ github.token }}
           CCOD_RELEASE_TAG: ${{ needs.build.outputs.tag }}
         run: |
           $tag = $env:CCOD_RELEASE_TAG
-          if ($tag -cnotmatch '^v\d+\.\d+\.\d+$') {
+          if ($tag -cnotmatch '^v\d+\.\d+\.\d+\z') {
             throw "Release tag output is invalid: '$tag'."
           }
-          $assets = @(Get-ChildItem -LiteralPath (Join-Path $PWD 'build\dist') -File | Where-Object { $_.Extension -in @('.exe', '.zip', '.txt', '.json') })
-          $assetNames = @($assets | ForEach-Object { $_.Name })
-          $publishedNames = @(& gh release view $tag --repo $env:GITHUB_REPOSITORY --json assets --jq '.assets[].name')
-          if ($LASTEXITCODE -ne 0 -or ((@($publishedNames | Sort-Object) -join '|') -cne (@($assetNames | Sort-Object) -join '|'))) {
-            throw "Published release $tag does not expose the exact expected asset set for read-back."
-          }
-          $readBackRoot = Join-Path $env:RUNNER_TEMP ('ccod-release-readback-' + [guid]::NewGuid().ToString('N'))
-          New-Item -ItemType Directory -Path $readBackRoot -Force | Out-Null
-          try {
-            foreach ($asset in $assets) {
-              & gh release download $tag --repo $env:GITHUB_REPOSITORY --pattern $asset.Name --dir $readBackRoot
-              if ($LASTEXITCODE -ne 0) {
-                throw "Could not read back published release asset $($asset.Name)."
-              }
-              $readBackAsset = Join-Path $readBackRoot $asset.Name
-              if (-not (Test-Path -LiteralPath $readBackAsset -PathType Leaf) -or
-                  (Get-FileHash -LiteralPath $readBackAsset -Algorithm SHA256).Hash.ToLowerInvariant() -cne (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant()) {
-                throw "Published release asset $($asset.Name) does not match the immutable candidate bytes."
-              }
-            }
-          } finally {
-            if (Test-Path -LiteralPath $readBackRoot) { Remove-Item -LiteralPath $readBackRoot -Recurse -Force -ErrorAction SilentlyContinue }
+          $version = $tag.Substring(1)
+          $notesPath = Join-Path $env:RUNNER_TEMP ("CodexRemote-fix-$tag-release-notes.md")
+          & (Join-Path $PWD 'tools\New-GitHubReleaseNotes.ps1') -ChangelogPath (Join-Path $PWD 'CHANGELOG.md') -Tag $tag -OutputPath $notesPath | Out-Null
+          $evidence = Join-Path $env:RUNNER_TEMP 'ccod-draft-evidence'
+          $preflight = Join-Path $evidence ("CodexRemote-fix-$version-clean-preflight.json")
+          if (-not (Test-Path -LiteralPath $preflight -PathType Leaf)) {
+            throw "Transferred clean preflight evidence is missing: '$preflight'."
           }
+          Import-Module (Join-Path $PWD 'tools\Invoke-GitHubDraftRelease.psm1') -Force -DisableNameChecking
+          Invoke-CcodGitHubDraftRelease -Mode Stage -Tag $tag -AssetDirectory (Join-Path $PWD 'build\dist') -EvidenceDirectory $evidence -NotesPath $notesPath | Out-Null
+          Invoke-CcodGitHubDraftRelease -Mode Verify -Tag $tag -AssetDirectory (Join-Path $PWD 'build\dist') -EvidenceDirectory $evidence | Out-Null