feat(#98): CI release workflow — tag v*.*.* → test gate → MSIX artifact + GitHub Release

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      # Gạch chắn: test đỏ thì mọi step sau không chạy (AC "test đỏ chặn đóng gói").
+      - name: Test
+        run: dotnet test PdfReaderApp.slnx -c Release
+
+      - name: Install winapp CLI
+        uses: microsoft/setup-WinAppCli@v0.2
+
+      - name: Pack MSIX
+        shell: pwsh
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          ./pack-msix.ps1 -Version $version
+
+      - name: Upload MSIX artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: msix
+          path: PdfReaderApp_*.msix
+          if-no-files-found: error
+
+      - name: Create GitHub Release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $version = "${{ github.ref_name }}".TrimStart("v")
+          gh release create "${{ github.ref_name }}" "PdfReaderApp_$version.msix" --generate-notes --verify-tag

pack-msix.ps1

@@ -30,12 +30,7 @@ if (Test-Path "Assets") {
 }
 
 Write-Host "Packaging MSIX..."
-# Generate a dummy dev cert if we don't have one for testing? Ticket says:
-# "Given dev cert self-signed đã cài (một lần). When cài file .msix vừa build và mở app. Then app khởi động..."
-# So the script should probably use --generate-cert or require a cert? 
-# Wait, winapp package has --generate-cert. Let's just create the msix without signing, or with a dummy cert?
-# Actually, the user says "dev cert self-signed đã cài". This means the cert is generated elsewhere or I can use --generate-cert and --install-cert here if they want? 
-# Let's generate a cert if it doesn't exist.
+# Cert dev chỉ để cài local khi smoke test; bản Store được Microsoft re-sign nên cert này không theo package (ADR 0005).
 if (-not (Test-Path "devcert.pfx")) {
     Write-Host "Generating devcert.pfx for testing..."
     winapp cert generate --output devcert.pfx --password password --publisher "CN=Placeholder"