The tax-pack release workflow remains a separate release surface from the desktop/MAS release flow.\n\nCurrent gap:\n- .github/workflows/tax-pack-release.yml can be manually triggered from a mutable event ref.\n- It checks out that ref, signs the pack, and publishes to the FloCafe-Plugins repository without verifying the tag signature, commit signature, workflow commit binding, main ancestry, or package/version provenance.\n\nWhy this is separate:\n- Tax-pack releases use different tag and version conventions, so the desktop release validator cannot be applied unchanged.\n\nRequested outcome:\n1. Define the approved tax-pack tag/version policy and trusted publisher identities.\n2. Require immutable ref binding and provenance validation before signing or publishing.\n3. Restrict who can trigger and publish tax-pack releases, including the external FloCafe-Plugins repository.\n4. Add regression tests for unsigned, mismatched, moved, and off-policy refs.\n5. Document the recovery/rotation process for an invalid tax-pack release.\n\nThe desktop/MAS release-hardening PR intentionally does not modify this workflow; this issue tracks the separate follow-up.
The tax-pack release workflow remains a separate release surface from the desktop/MAS release flow.\n\nCurrent gap:\n- .github/workflows/tax-pack-release.yml can be manually triggered from a mutable event ref.\n- It checks out that ref, signs the pack, and publishes to the FloCafe-Plugins repository without verifying the tag signature, commit signature, workflow commit binding, main ancestry, or package/version provenance.\n\nWhy this is separate:\n- Tax-pack releases use different tag and version conventions, so the desktop release validator cannot be applied unchanged.\n\nRequested outcome:\n1. Define the approved tax-pack tag/version policy and trusted publisher identities.\n2. Require immutable ref binding and provenance validation before signing or publishing.\n3. Restrict who can trigger and publish tax-pack releases, including the external FloCafe-Plugins repository.\n4. Add regression tests for unsigned, mismatched, moved, and off-policy refs.\n5. Document the recovery/rotation process for an invalid tax-pack release.\n\nThe desktop/MAS release-hardening PR intentionally does not modify this workflow; this issue tracks the separate follow-up.