[Release] Publish canonical GitHub Releases and immutable version tags #98

Parent project: #95
Depends on: #96, #82, #83, #84, #85, #91

Objective

Use GitHub Releases as the authoritative, dated publication history for SightAdapt versions and downloadable artifacts.

Acceptance criteria

• Define the release/tag naming convention, beginning with v0.5.0.50-alpha or the next approved version.
• Use release titles in the format SightAdapt™ <version>.
• Include the canonical product description in every release.
• Include release notes, supported Windows versions, known limitations and upgrade/migration notes.
• Attach the complete verified Windows archive, checksums, SBOM and legal bundle.
• Include links to https://aiteracja.pl/sightadapt/, documentation, privacy notice and source code.
• Make tags immutable after publication except for documented emergency withdrawal procedures.
• Document prerelease versus stable-release policy.
• Add a release checklist that verifies CI, manual tests, licenses and artifact hashes.
• Ensure the website can obtain the current version and download link from GitHub Releases without duplicating binary files.
• Publish a permanent release-history page linking every version and tag.

Current implementation status — 2026-09-23

PR #150 was merged as cc81bb5d367f563723063bca8c5b160aed8e3c2b and implemented the verified GitHub Release publication path.

Verified evidence:

• pull-request DCO and full Windows build/release-compliance CI passed;
• the post-merge main build run 35910802970 passed every build, test, notice, SBOM and final-package gate;
• the first Publish SightAdapt GitHub Release workflow run 35911089822 passed with publish: false;
• no GitHub Release was created;
• no v0.5.0.50-alpha tag was created;
• the publication workflow now requires an exact successful CI artifact, matching version/tag provenance, the github-release final-package gate, manual Windows smoke acceptance and confirmed GitHub release immutability.

Remaining blockers before first publication

1. GitHub release immutability is enabled and recorded in release/release-request.json by PR Confirm immutable GitHub Releases gate #151 / commit c33954bb9e9d7cbc4cdcbe91a9974964bb0a4020.
2. Manual Windows smoke testing was completed and recorded in release/manual-smoke/v0.5.0.50-alpha-2026-09-24.md; PR Accept 0.5.0.50-alpha Windows smoke gate #152 set manualWindowsSmokeAccepted to true.
3. PR Publish SightAdapt 0.5.0.50-alpha #153 set publish to true; main build run 35972748135 passed and release workflow run 35972996206 published v0.5.0.50-alpha.
4. GitHub reports the release as immutable, the tag points to f51db2f2a2566bde5994ff654dad04a67300a11a, all required assets are present, and PR Finalize 0.5.0.50-alpha release record #154 updated release history and reset publish to false.

Final publication evidence — 2026-09-24

• Release: https://github.com/KeyffMS/SightAdapt/releases/tag/v0.5.0.50-alpha
• Release ID: 395462798
• Title: SightAdapt™ 0.5.0.50-alpha
• Status: prerelease
• GitHub immutable release state: true
• Tag: v0.5.0.50-alpha
• Tag target: f51db2f2a2566bde5994ff654dad04a67300a11a
• Main build run: 35972748135 — passed
• Release workflow run: 35972996206 — passed
• Official archive: SightAdapt-0.5.0.50-alpha-win-x64.zip
• Archive SHA-256: c6dc5ba5c0356c84b32a74d298015d63158c57886b835e411da0b60f306fd711
• Published alongside SHA256SUMS.txt, schema-3 compliance report, SPDX SBOM, dependency/license reports, MIT License, .NET notices, third-party notices and privacy notice.
• PR Finalize 0.5.0.50-alpha release record #154 recorded the published release in docs/RELEASE-HISTORY.md and disarmed the one-shot publication request by restoring publish: false.

GitHub Releases are now the authoritative binary source for this version.