From 6a26679db9bc5366321e0596be8e17e53152dfb2 Mon Sep 17 00:00:00 2001
From: Quang Tran <quangtran.niit@gmail.com>
Date: Fri, 7 Aug 2026 14:17:08 +0700
Subject: [PATCH 1/2] chore(#98): don comment nhap trong pack-msix.ps1

---
 pack-msix.ps1 | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pack-msix.ps1 b/pack-msix.ps1
index 4f7bed9..3e75283 100644
--- a/pack-msix.ps1
+++ b/pack-msix.ps1
@@ -30,12 +30,7 @@ if (Test-Path "Assets") {
 }
 
 Write-Host "Packaging MSIX..."
-# Generate a dummy dev cert if we don't have one for testing? Ticket says:
-# "Given dev cert self-signed đã cài (một lần). When cài file .msix vừa build và mở app. Then app khởi động..."
-# So the script should probably use --generate-cert or require a cert? 
-# Wait, winapp package has --generate-cert. Let's just create the msix without signing, or with a dummy cert?
-# Actually, the user says "dev cert self-signed đã cài". This means the cert is generated elsewhere or I can use --generate-cert and --install-cert here if they want? 
-# Let's generate a cert if it doesn't exist.
+# Cert dev chỉ để cài local khi smoke test; bản Store được Microsoft re-sign nên cert này không theo package (ADR 0005).
 if (-not (Test-Path "devcert.pfx")) {
     Write-Host "Generating devcert.pfx for testing..."
     winapp cert generate --output devcert.pfx --password password --publisher "CN=Placeholder"

From 71bfd92000b69bb92e28bb399a15a426198781fd Mon Sep 17 00:00:00 2001
From: Quang Tran <quangtran.niit@gmail.com>
Date: Fri, 7 Aug 2026 15:18:09 +0700
Subject: [PATCH 2/2] =?UTF-8?q?feat(#98):=20CI=20release=20workflow=20?=
 =?UTF-8?q?=E2=80=94=20tag=20v*.*.*=20=E2=86=92=20test=20gate=20=E2=86=92?=
 =?UTF-8?q?=20MSIX=20+=20GitHub=20Release?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/release.yml | 49 +++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..5941325
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # Gạch chắn: test đỏ thì mọi step sau không chạy (AC "test đỏ chặn đóng gói").
+      - name: Test
+        run: dotnet test PdfReaderApp.slnx -c Release
+
+      - name: Install winapp CLI
+        uses: microsoft/setup-WinAppCli@v0.2
+
+      - name: Pack MSIX
+        shell: pwsh
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          ./pack-msix.ps1 -Version $version
+
+      - name: Upload MSIX artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: msix
+          path: PdfReaderApp_*.msix
+          if-no-files-found: error
+
+      - name: Create GitHub Release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          gh release create "${{ github.ref_name }}" "PdfReaderApp_$version.msix" --generate-notes --verify-tag