Build a fail-closed release pipeline with trusted publishing and traceable artifacts

[plx]

Parent epic

#32

Problem and impact

There is no reproducible release workflow, immutable version/tag check, package/installed-artifact gate, GitHub Release, binary archive, checksum, SBOM, provenance, or signature policy. Crates.io 0.1.4 exists without a corresponding Git tag or GitHub Release. Manual publication could diverge from the audited commit.

Required pipeline

Design a dry-runnable workflow that, on the exact proposed tag commit:

1. verifies clean source identity and Cargo.toml/tag/CLI/changelog version agreement;
2. runs locked full tests on every supported OS and the MSRV;
3. runs fmt, all-target/all-feature Clippy with warnings denied, and rustdoc with warnings denied;
4. runs advisory, workflow, license, attribution, and package-manifest checks;
5. runs public API/SemVer policy against the proper baseline;
6. builds cargo package, installs it in a clean root, and runs the smoke suite;
7. builds supported native binary archives in reproducible/traceable environments;
8. smoke-tests each exact archive on its target OS;
9. creates SHA-256 checksums and an SBOM/provenance attestation;
10. uses a protected environment and crates.io Trusted Publishing where available; and
11. creates an immutable GitHub Release only after all gates pass.

The workflow must support a non-publishing rehearsal that exercises every gate and artifact step without creating external release state.

Security requirements

• Pin every action/tool as established by the workflow-hardening ticket.
• Minimize permissions; grant id-token: write only to the publish job/environment.
• Never run release with untrusted checkout code and secrets in the same trust context.
• Require maintainer approval for the production environment.
• Prevent moving/reusing release tags.

Required tests/evidence

• Deliberately mismatch tag/version and prove failure before build/publish.
• Deliberately fail a package smoke test and prove publish cannot run.
• Verify checksums against downloaded artifacts.
• Install every artifact in a clean environment and exercise success/failure CLI behavior.
• Rebuild twice; if bit reproducibility is claimed, hashes must match, otherwise record expected nondeterminism while proving source provenance.

Acceptance criteria

• One non-publishing rehearsal passes end to end on the intended v0.2 candidate shape.
• Every gate is fail-closed and required by the publish job.
• Crate and binaries trace to one immutable commit/tag.
• Checksums, SBOM/provenance, licenses, and smoke results are produced.
• Trusted publishing/protected approval is configured without a long-lived exposed token.
• Failure injection proves publication cannot bypass a failed gate.
• Release runbook documents recovery without tag mutation.

Relationships

• Parent: [Epic] Release engineering and supply-chain hardening #32
• Blocked by: Narrow and stabilize the supported Rust surface for v0.2 #54, Run the full behavioral suite and filesystem conformance tests on Linux, macOS, and Windows #55, the MSRV ticket, workflow-hardening ticket, package-allowlist ticket, v0.2 identity ticket, and repository-protection ticket.
• Blocks final audit rehearsal and publication.

Non-goals

This ticket builds and rehearses the mechanism; it must not publish v0.2 before the independent audit passes.