[stadub]

Build/test and release automation stages immutable reviewed release snapshots, tests source and installed packages across Windows PowerShell 5.1/pwsh, Linux and macOS, and creates a versioned GitHub release from the tested bytes. Gallery dispatch defaults to dry-run; only actual upload receives the selected account key. A separate issues:write job uses trusted exact mappings only after actual publish and exact Gallery package/version/content verification.

CI covers all eight formal modules. It pins unchanged maintained sources to full SHAs, tests changed module sources from the proposal snapshot, expands cross-component coverage and records source identities. Publishing remains limited to the five established packages, verified reviewed release refs, unified out/ paths and distinct Stadub/MiniModules account mappings. Owner sibling worktrees were preserved. The owner-operated Set-GalleryApiKey.ps1 helper securely prompts through gh and checks master-only environment restrictions; offline tests never set live keys.

The manual release form now has a five-module selector and a prepared version field; users no longer enter commit SHAs. Dry-run stays checked by default, with a separate optional GitHub-release checkbox. Resolve-ReleaseSnapshot.ps1 resolves the configured reviewed branch once and every job consumes that full SHA. GitHub's /releases/latest URL alias is not used as a Git branch requirement: 7Zip/Currency select their verified 7-Zip/release/1.1 and Currency-Conv/release/1.5 refs; all five package paths still require out/. Version mismatches and missing reviewed refs/packages fail closed, with no development fallback or automatic version rewrite.

GitHub will expose the manual action only after this reviewed workflow is integrated into master. No master integration, live release or Gallery upload was performed while implementing the form.

Validation at current head 84126ae:

• Fresh push matrix passed all 24 jobs (22 module/OS + planning/status): https://github.com/stadub/PowershellScripts/actions/runs/43197917503
• Fresh PR matrix also passed all 24 jobs: https://github.com/stadub/PowershellScripts/actions/runs/43197921147
• New local-Git fixture contracts run in Ubuntu planning and Windows Base64 CI. They exercise all five reviewed refs, branch advancement after pinning, one SHA output, summary evidence, missing ref/origin and invalid module/version. The Windows step explicitly passed. The fixture preserves the caller's native exit code after expected failure tests. Workflow contracts verify SHA output propagation through every job and unchanged secret, dry-run and issue-completion gates.
• All 13 offline contracts and actionlint 1.7.12 pass. Read-only live resolution found all five configured refs and the prepared Base64String 1.3.0 commit.
• With explicit owner approval, source repairs Repair Bookmarks persistence checks while retaining update throttling #40–45 were merged only into their module development branches, with exact head/base and active checks rechecked before each normal merge; no admin bypass. Exact merge/source SHAs are recorded in docs/ci-component-merges.json. Maintained-source runs at 6bb426b passed all 24 jobs each: https://github.com/stadub/PowershellScripts/actions/runs/43130449793 and https://github.com/stadub/PowershellScripts/actions/runs/43130460091. Downloaded artifacts verified 22 maintained source identities and 28 NUnit reports: 295 Pester + 24 structural assertions, zero failures/skips. No feature/preview ref substitutes for a maintained source. Source fixes remain separate from this automation branch. FolderEncoder coverage validates restored import/export contracts, not the legacy encoder roundtrip; Shell coverage does not exercise Windows batch helpers or actual filesystem links.
• Base64String 1.3.0 release SHA 6d30dbc passed 34 source + 34 installed tests on all four platforms, with identical downloaded payload hashes: https://github.com/stadub/PowershellScripts/actions/runs/43086442317. Owner-confirmed WTFPL preserved. See docs/releases/base64string-1.3.0.md.

The owner authorized removal of Azure DevOps and AppVeyor. Both GitHub app installations were verified to select only PowershellScripts and uninstalled. Four Azure YAML files and all remaining Azure/AppVeyor badges are removed here; approved AppVeyor YAML cleanup from PR #33 is preserved. Other apps and hooks remain unchanged. The owner has no external account access, so internal service definitions/history remain. GitHub provides no supported individual deletion for historical external checks/statuses; no Actions evidence was deleted or statuses rewritten. See docs/ci/legacy-ci-removal/README.md.

Remaining rollout gates: reviewed automation integration into master and a full production manual dry-run; reviewed out/ package preparation for the other configured modules (including 7Zip/Currency numbered release sources); independent environment reviewer protection. Both account secret names exist. Master-only environment policy is preserved, with no reviewer rule and admin bypass enabled; opaque key validity/rights remain unverified.

The exact completion mapping targets only #22 at the tested Base64String 1.3.0 SHA. #22/#29 remain open. No Gallery upload, GitHub release creation, master/release merge, issue closure, environment or secret change occurred during component integration. This automation PR remains draft for production rollout review. References #29.