Windows packaging and release pipeline

Plan the Windows packaging and release pipeline (separate from CI).

Owner direction (2026-10-17): release and CI are separate; Windows release builds need a dedicated Windows runner. Unsigned artifacts are acceptable at first (signing tracked separately).

Open decisions before work starts:

packaging format: portable zip of the Native AOT executable plus msalruntime.dll (recommended first) vs MSIX via winapp CLI (needs signing, package identity may change WAM redirect/broker behavior, execution-alias use from WSL needs validation);
operational identities (product, command, package, install root, update channel) in docs/governance/operational-identities.yaml, all currently null, non-colliding with upstream AzureAuth;
release Client Profile path: pass RECHECK-007 and the external Profile gate, or ship "bring your own Profile" with the experimental Profile only as an opt-in example;
release evidence per the validation strategy's Release Gates.

Needs its own accepted Delivery Wave entry. Related: #482.

docs: remove the completed real-host validation Wave entry

docs: address the review of the portable package Wave entry

docs: keep the native threat model out of the package Wave entry

docs: record the owner decisions on the package Wave entry

docs: clarify the circuit breaker and approval dates

docs: order the SDK move and declare the installed SDKs

docs: allow a temporary CI-pinned mise for the lock regeneration

docs: move CI and the host to mise 2026.10.22 in the package entry

docs: update the host mise with self-update in the package entry

docs: keep installed mise plugins out of the self-update

docs: let the host mise self-update also update its plugins

feat(cli): name the command azureauth-unofficial and version it with …

build(windows): add the portable package script and content

docs: record the portable package identities and Profile exception

build: move to .NET SDK 10.0.403 and mise 2026.10.22

fix(windows): check the version resource against the informational ve…

fix(windows): allow the managed symbol files in the publish output

docs(research): address the review of the host test protocol

docs(research): pin the host test SDK by absolute path on both sides

docs(research): classify the host test deviations and record the disp…

docs(research): name the post-stop continuation as a deviation

docs: record the owner decisions on the alpha prerelease entry

docs: let the release artifacts expire instead of deleting them

fix: address the review of the prerelease workflow

fix(ci): fail closed on the release draft lookup

Release review — v0.1.0-alpha.31 (draft release 428540142, run 40981669469, commit c3258d1ecefa2aba3de997e25202f11038f66aa2). Independent reviewer rv_wave_pkg; research-evidence-review at the release execution point (Wave "Windows 0.1.0-alpha Prereleases", item 3).

Run: release.yml on refs/heads/main-v2, workflow_dispatch; all three jobs succeeded with their declared token permissions only. Windows scenarios (TestCategory!=WindowsHostTiming) 181/181. Locked restore with audit on, 0 warnings. package.ps1 without development switches, public release True; imports 17 (exe) and 50 (msalruntime.dll), all System32 DLLs or API sets.
Draft: draft and prerelease, target c3258d1, tag v0.1.0-alpha.31 not yet created; notes state unsupported, unofficial, unsigned and the Visual Studio Profile limits.
Assets: package zip e3be21a8…4ca72, symbols zip 4966d67d…a9209, and their .sha256 files; checksums verify. gh attestation verify passed for both zips (signer release.yml@refs/heads/main-v2, source digest c3258d1, GitHub-hosted, Rekor-logged). Package holds the six allowlisted files; azureauth-unofficial.exe 64f1288b…b5b2, msalruntime.dll 9df30b54…0c79; the native PDB matches the exe.
Build chain (recorded, owner-accepted floating chain; linker use inferred): image win25-vs2026 20261021.278.1, .NET SDK 10.0.403, VS 18.11.1, MSVC 14.51.36231, link.exe 14.51.36260.0, Windows SDK 10.0.26100.0.
Build paths: only runner and Microsoft paths; no personal user name.
Rechecks (2026-10-30): RECHECK-001, 002, 003, 004, 006, 007, 008, 009, 010 fire; all sources unchanged; no conclusion changes. RECHECK-005 does not fire.
Findings (independent triage by tr_wave_pkg):
- A1, true positive (8/10): the zip's text files have CRLF line endings (Windows checkout), and the design's "byte-for-byte" claim for the bundled Profile was never accurate (the test asserts JSON equality). Fix: design wording; forcing LF for packaged text files is an optional change to the assets.
- A2, unresolved (4/10): the symbols zip carries no license or notices of its own; owner judgment.
Owner disposition (given in chat on 2026-10-30; posted by the authoring agent through the owner's session on the owner's instruction): do not publish alpha.31. Add LICENSE.txt and the third-party notices to the symbols zip through a Wave amendment, fix A1, and publish a new prerelease after all fixes. The owner authorizes the agent to publish that prerelease through the owner's session once its release review passes.

docs: bound the agent publication path in the alpha entry

Release review — v0.1.0-alpha.37 (draft release 428640408, run 41000291664, commit f509276cad32c49b5764af906e8374f3f9b182ae). Independent reviewer rv_wave_pkg; research-evidence-review at the release execution point (Wave "Windows 0.1.0-alpha Prereleases", item 3).

Run: release.yml on refs/heads/main-v2, workflow_dispatch, attempt 1. All three jobs succeeded with only their declared token permissions. Windows scenarios (TestCategory!=WindowsHostTiming) 181/181. Locked restore with audit on, 0 warnings. package.ps1 ran without development switches, public release True; imports 17 (exe) and 50 (msalruntime.dll), all System32 DLLs or API sets.
Draft: draft and prerelease, target f509276, tag v0.1.0-alpha.37 not yet created. The notes state unofficial, unsupported, unsigned and the Visual Studio Profile limits, and link the README at the commit and this issue.
Assets: package zip 6853bbca7c0b1b1da941ebd90200adf0b74b0bb30dc64d9c30f4125f341c68dc, symbols zip a722610866dcca37082b7eee9f0ce83cb99f24928e21fbc91044946a8224c117, and their .sha256 files; checksums verify. gh attestation verify passed for both (signer release.yml@refs/heads/main-v2, source digest f509276, GitHub-hosted, Rekor-logged). The package holds the six allowlisted files; azureauth-unofficial.exe e15efec1bdeb4b908473b0cde48e3159362bf6e495432f7b532539aad0f3d384, msalruntime.dll 9df30b54…0c79; the native PDB matches the exe.
docs: add license files to the symbols zip in the alpha entry #551/fix(windows): add license files to the symbols zip and force LF #552 changes verified: the symbols zip holds the three PDBs plus LICENSE.txt and THIRD-PARTY-NOTICES.txt. No text file in either zip contains a carriage return. The packaged Profile, README and LICENSE are byte-identical to the repository at f509276.
Build chain (recorded floating chain the owner accepted; that the linker used it is inferred): image win25-vs2026 20261021.278.1, .NET SDK 10.0.403, VS 18.11.1, MSVC 14.51.36231, link.exe 14.51.36260.0, Windows SDK 10.0.26100.0.
Build paths: only runner and Microsoft paths; no personal user name.
Rechecks (2026-10-30): RECHECK-001, 002, 003, 004, 006, 007, 008, 009 and 010 fire; all sources are unchanged and no conclusion changes. RECHECK-005 does not fire.
Findings: none, so there is no unresolved finding and no finding needing an owner decision. Agent publication still needs an owner instruction on this issue naming v0.1.0-alpha.37, as the Wave entry requires; otherwise the owner publishes the draft.

Repository-owner instruction (posted by the authoring agent through the owner's hcoona session on the owner's instruction; given in chat on 2026-10-30).

Publish v0.1.0-alpha.37 (draft release 428640408, commit f509276cad32c49b5764af906e8374f3f9b182ae) as a GitHub prerelease. Its release review records no unresolved finding and no finding needing an owner decision, so the Wave entry's condition for agent publication is met.

Published v0.1.0-alpha.37 as a GitHub prerelease at 2026-10-30T04:45:50Z under the owner instruction. Tag v0.1.0-alpha.37 points at f509276cad32c49b5764af906e8374f3f9b182ae, the reviewed and attested commit; the public package download verifies against its .sha256. https://github.com/hcoona/microsoft-authentication-cli/releases/tag/v0.1.0-alpha.37

Navigation Menu

Repository navigation

Windows packaging and release pipeline #506

3 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Windows packaging and release pipeline #506

Description

Activity

3 remaining items

hcoona commented on Oct 30, 2026

hcoona commented on Oct 30, 2026

hcoona commented on Oct 30, 2026

hcoona commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions