fix(ci): harden CI and source-only releases

.github/actions/protected-candidate-checkout/action.yml

@@ -0,0 +1,79 @@
+name: Protected candidate checkout
+description: Stage protected policy, check out one exact candidate, and verify it.
+
+inputs:
+  policy-path:
+    description: Workspace-relative protected policy checkout.
+    required: false
+    default: policy
+  candidate-path:
+    description: Workspace-relative candidate checkout destination.
+    required: false
+    default: candidate
+  repository:
+    description: Exact candidate repository.
+    required: true
+  head-sha:
+    description: Exact authorized candidate commit.
+    required: true
+  base-sha:
+    description: Exact protected-main base commit.
+    required: true
+  fetch-depth:
+    description: Candidate checkout fetch depth.
+    required: false
+    default: "1"
+
+outputs:
+  python:
+    description: Absolute protected interpreter staged before candidate checkout.
+    value: ${{ steps.protected.outputs.python }}
+
+runs:
+  using: composite
+  steps:
+    # Candidate files do not exist while trusted policy and tool paths are staged.
+    - name: Stage protected verifier and trusted tools
+      id: protected
+      shell: bash
+      run: >-
+        python3 "${GITHUB_ACTION_PATH}/../../scripts/protected_checkout.py" stage
+        --source-root "${GITHUB_WORKSPACE}/${{ inputs.policy-path }}"
+        --destination "${RUNNER_TEMP}/yaml-sigil-protected-checkout"
+        --github-output "${GITHUB_OUTPUT}"
+
+    - name: Check out exact candidate
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Preserve Git blob bytes on every host before the protected verifier
+      # compares sensitive worktree files with their authorized objects.
+      env:
+        GIT_CONFIG_COUNT: "1"
+        GIT_CONFIG_KEY_0: core.autocrlf
+        GIT_CONFIG_VALUE_0: "false"
+      with:
+        fetch-depth: ${{ inputs.fetch-depth }}
+        path: ${{ inputs.candidate-path }}
+        persist-credentials: false
+        ref: ${{ inputs.head-sha }}
+        repository: ${{ inputs.repository }}
+        submodules: false
+
+    # This is the first post-checkout step and executes only staged protected code.
+    - name: Verify exact candidate checkout
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        PATH: ${{ steps.protected.outputs.path }}
+        TRUSTED_GIT: ${{ steps.protected.outputs.git }}
+        TRUSTED_PYTHON: ${{ steps.protected.outputs.python }}
+      run: >-
+        "${TRUSTED_PYTHON}" "${{ steps.protected.outputs.verifier }}" verify
+        --candidate-root "${GITHUB_WORKSPACE}/${{ inputs.candidate-path }}"
+        --git "${TRUSTED_GIT}"
+        --repository "${GITHUB_REPOSITORY}"
+        --base-sha "${{ inputs.base-sha }}"
+        --head-sha "${{ inputs.head-sha }}"
+        --config "${{ steps.protected.outputs.config }}"
+        --expected-verifier-sha256 "${{ steps.protected.outputs.verifier_sha256 }}"
+        --expected-controller-sha256 "${{ steps.protected.outputs.controller_sha256 }}"
+        --expected-config-sha256 "${{ steps.protected.outputs.config_sha256 }}"

.github/legacy-release-inventory.json

@@ -0,0 +1,209 @@
+{
+  "schema_version": 1,
+  "api_version": "2026-03-10",
+  "repository": "NVIDIA/yaml-sigil-rs",
+  "legacy_author": {
+    "id": 41898282,
+    "login": "github-actions[bot]",
+    "type": "Bot"
+  },
+  "prospective_author": {
+    "id": 318780254,
+    "login": "nvidia-yamlsigil-release-pr[bot]",
+    "type": "Bot"
+  },
+  "entries": [
+    {
+      "release_id": 374728976,
+      "package": "yaml-sigil-verification",
+      "version": "0.5.0-rc.1",
+      "tag": "yaml-sigil-verification-v0.5.0-rc.1",
+      "tag_object_sha": "9fe046b72bd8a0917f32f73a2d5e5b35b69f02f9",
+      "peeled_commit_sha": "80e06775ac6b5a2f19286bd92492e68374a90eb2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "3b23aa0020c3dc4d1962423c5f51df3634491e0443b1b470285dfe530acc9ad2",
+      "source_archive_sha256": "37527966228fa878c2451e153b33ffcb17d73e4d48e973e29a14072814d58b6b",
+      "path_in_vcs": "crates/yaml-sigil-verification"
+    },
+    {
+      "release_id": 374728608,
+      "package": "yaml-sigil-transcription",
+      "version": "0.5.0-rc.1",
+      "tag": "yaml-sigil-transcription-v0.5.0-rc.1",
+      "tag_object_sha": "f65966bdfafb602bd0ed63264a7137365765f1b5",
+      "peeled_commit_sha": "80e06775ac6b5a2f19286bd92492e68374a90eb2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "f4a0ad8182b166379f16bb7bcc6be185cdd77ee9b24162af7d45c28a1d05c645",
+      "source_archive_sha256": "0470ef628bf5645a869f90d1cc6fdf3989d433b9e2fde9029ec555d1b0544a13",
+      "path_in_vcs": "crates/yaml-sigil-transcription"
+    },
+    {
+      "release_id": 374728947,
+      "package": "yaml-sigil-signing",
+      "version": "0.5.0-rc.1",
+      "tag": "yaml-sigil-signing-v0.5.0-rc.1",
+      "tag_object_sha": "77a810a91c879ca8eeaebfce4a300d98a6389350",
+      "peeled_commit_sha": "80e06775ac6b5a2f19286bd92492e68374a90eb2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "9e296c79e73ba4ff6c2bca976a7f37740334cb3eef259c009f1a1e31ad4b375c",
+      "source_archive_sha256": "f1e1d91d6f46127e0e8232b7e6b39fd06e5012f392c5415f5b97aeaf4b2846b4",
+      "path_in_vcs": "crates/yaml-sigil-signing"
+    },
+    {
+      "release_id": 374728253,
+      "package": "yaml-sigil-core",
+      "version": "0.5.0-rc.1",
+      "tag": "yaml-sigil-core-v0.5.0-rc.1",
+      "tag_object_sha": "93ddb571695ff462fba4ae73d2cd51cf92e1530b",
+      "peeled_commit_sha": "80e06775ac6b5a2f19286bd92492e68374a90eb2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "d6e32bca1de4f89fc2c10094aeab985b885b3022d5ad8f213b3cd642032f22ec",
+      "source_archive_sha256": "2ca28fea80a47a6b28fd10ae04e78332d71a6e85cdaa6fe8725a0cf584a37caa",
+      "path_in_vcs": "crates/yaml-sigil-core"
+    },
+    {
+      "release_id": 373953610,
+      "package": "yaml-sigil-verification",
+      "version": "0.4.0-rc.2",
+      "tag": "yaml-sigil-verification-v0.4.0-rc.2",
+      "tag_object_sha": "f422b7b1462c4264bd3dfa4ef88f2bdedd661fb8",
+      "peeled_commit_sha": "ceb24a09323eeaea6ebe580aa4ad1eaf49027750",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "913330bde4dc8d2a6db4884222b6ba161bc4db706561db5fed3551541ee649d0",
+      "source_archive_sha256": "fd88de0ebdb72326e6fcf97f40afae2620e07c7ed8f248e0c30e069d2cac90ef",
+      "path_in_vcs": "crates/yaml-sigil-verification"
+    },
+    {
+      "release_id": 373953498,
+      "package": "yaml-sigil-transcription",
+      "version": "0.4.0-rc.2",
+      "tag": "yaml-sigil-transcription-v0.4.0-rc.2",
+      "tag_object_sha": "30ce47c74ff3e8ba9528cf7e21d77f9c61a51788",
+      "peeled_commit_sha": "ceb24a09323eeaea6ebe580aa4ad1eaf49027750",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "913330bde4dc8d2a6db4884222b6ba161bc4db706561db5fed3551541ee649d0",
+      "source_archive_sha256": "919ac2c68b8c550d9f577edffdd6191748d37c43752e2f6983dabffdaa39998a",
+      "path_in_vcs": "crates/yaml-sigil-transcription"
+    },
+    {
+      "release_id": 373953561,
+      "package": "yaml-sigil-signing",
+      "version": "0.4.0-rc.2",
+      "tag": "yaml-sigil-signing-v0.4.0-rc.2",
+      "tag_object_sha": "4a4a2320a0f4b400cdf7615f87421a57440d3be9",
+      "peeled_commit_sha": "ceb24a09323eeaea6ebe580aa4ad1eaf49027750",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "913330bde4dc8d2a6db4884222b6ba161bc4db706561db5fed3551541ee649d0",
+      "source_archive_sha256": "f1cd22c670055476c1f94a46584042b3223f76088a11a51bb6fe1e6ffb78c730",
+      "path_in_vcs": "crates/yaml-sigil-signing"
+    },
+    {
+      "release_id": 373953410,
+      "package": "yaml-sigil-core",
+      "version": "0.4.0-rc.2",
+      "tag": "yaml-sigil-core-v0.4.0-rc.2",
+      "tag_object_sha": "120a161a5e4a290930cfefc54101b166a45dba99",
+      "peeled_commit_sha": "ceb24a09323eeaea6ebe580aa4ad1eaf49027750",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "913330bde4dc8d2a6db4884222b6ba161bc4db706561db5fed3551541ee649d0",
+      "source_archive_sha256": "2d52abf8c1c0fcf8543d589f7f48ed1cc5887182f87a8c2d224cb7170bb77bc8",
+      "path_in_vcs": "crates/yaml-sigil-core"
+    },
+    {
+      "release_id": 373131899,
+      "package": "yaml-sigil-verification",
+      "version": "0.4.0-rc.1",
+      "tag": "yaml-sigil-verification-v0.4.0-rc.1",
+      "tag_object_sha": "fea5e58521530e51c99f24e7cdcbec0847885a33",
+      "peeled_commit_sha": "bfd62fef2e95b4a16f7015b4d2ba3f28a7ba76b2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "ce788ff5a9be321d7b2480f74130c09e7320deea1e7a5754f746b0547b4ef2e1",
+      "source_archive_sha256": "3b6df28014ef103671c85926d5521e1e68484054879b1d09eebf3b682ce302e6",
+      "path_in_vcs": "crates/yaml-sigil-verification"
+    },
+    {
+      "release_id": 372740779,
+      "package": "yaml-sigil-transcription",
+      "version": "0.4.0-rc.1",
+      "tag": "yaml-sigil-transcription-v0.4.0-rc.1",
+      "tag_object_sha": "bf5379259bb87414648cfc74a5e3fc9812d5105c",
+      "peeled_commit_sha": "d8f2227bcafbd86f12441ed3c6c355806a0ccf3c",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "a19a5d5b05522d4f613dbd378e8dc08e2b141494806a21cdb824383c96ed07e8",
+      "source_archive_sha256": "dd29ad1a8dab5c49b4df5ccfca48d1639431e5a82c622472e95299b3dca69731",
+      "path_in_vcs": "crates/yaml-sigil-transcription"
+    },
+    {
+      "release_id": 373131837,
+      "package": "yaml-sigil-signing",
+      "version": "0.4.0-rc.1",
+      "tag": "yaml-sigil-signing-v0.4.0-rc.1",
+      "tag_object_sha": "0fa5144c58129bf9231bc8bf63b9643c2fc4044a",
+      "peeled_commit_sha": "bfd62fef2e95b4a16f7015b4d2ba3f28a7ba76b2",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "28faef8bd29ebeced423d2085d201368c336e7c18b3a1dd1de1c6fb670ad5ba2",
+      "source_archive_sha256": "83c9e919abcf2a559365f97e2c823ef084de8eaa8a42b1e53445d8d404c59be4",
+      "path_in_vcs": "crates/yaml-sigil-signing"
+    },
+    {
+      "release_id": 372740726,
+      "package": "yaml-sigil-core",
+      "version": "0.4.0-rc.1",
+      "tag": "yaml-sigil-core-v0.4.0-rc.1",
+      "tag_object_sha": "5910b3145e705de0bb77d96ad206d1dac5cf4c4a",
+      "peeled_commit_sha": "d8f2227bcafbd86f12441ed3c6c355806a0ccf3c",
+      "target_commitish": "main",
+      "draft": false,
+      "prerelease": true,
+      "immutable": false,
+      "asset_count": 0,
+      "body_sha256": "5e40cccd339ddecd5ecfe2d6e517e79e6349771558a327233f353c0b285cc8cd",
+      "source_archive_sha256": "2a492caa5e1d72e9f9f2f8172e3d63e4bc7672bc312b6922e2288ca9c3c38445",
+      "path_in_vcs": "crates/yaml-sigil-core"
+    }
+  ]
+}

.github/protected-pr-ci.json

@@ -1,5 +1,7 @@
 {
-  "version": 2,
+  "version": 3,
+  "repository": "NVIDIA/yaml-sigil-rs",
+  "repository_kind": "rs",
   "default_branch": "main",
   "workflow_file": ".github/workflows/pr-ci-command.yml",
   "required_check": "Required CI",
@@ -26,34 +28,10 @@
   "expected_jobs": [
     "commit_policy",
     "workflow_lint",
+    "platform_verifier",
     "static_checks",
     "rust",
     "candidate_ci"
   ],
-  "candidate_ci_paths": [
-    ".cargo/**",
-    "**/.cargo/**",
-    ".github/workflows/ci.yml",
-    ".github/workflows/pr-ci.yml",
-    "rust-toolchain",
-    "rust-toolchain.toml",
-    "**/rust-toolchain",
-    "**/rust-toolchain.toml",
-    "rustfmt.toml",
-    ".rustfmt.toml",
-    "**/rustfmt.toml",
-    "**/.rustfmt.toml",
-    "clippy.toml",
-    ".clippy.toml",
-    "**/clippy.toml",
-    "**/.clippy.toml",
-    ".rumdl.toml",
-    "rumdl.toml",
-    "deny.toml",
-    "deny.exceptions.toml",
-    "crates/yaml-sigil-core/buf.yaml",
-    "crates/yaml-sigil-core/buf.lock",
-    "crates/yaml-sigil-core/buf.gen.yaml",
-    "xtask/**"
-  ]
+  "supplemental_candidate_ci": true
 }

.github/release-notification-policy.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": 1,
+  "api_version": "2026-03-10",
+  "repository": "NVIDIA/yaml-sigil-rs",
+  "default_branch": "main",
+  "sender": {
+    "id": 318780254,
+    "login": "nvidia-yamlsigil-release-pr[bot]",
+    "type": "Bot"
+  },
+  "app": {
+    "id": 4653064,
+    "slug": "nvidia-yamlsigil-release-pr",
+    "email": "318780254+nvidia-yamlsigil-release-pr[bot]@users.noreply.github.com"
+  },
+  "release_branch": "release-plz-next",
+  "packages": [
+    {
+      "name": "yaml-sigil-core",
+      "tag_prefix": "yaml-sigil-core-v",
+      "path_in_vcs": "crates/yaml-sigil-core"
+    },
+    {
+      "name": "yaml-sigil-transcription",
+      "tag_prefix": "yaml-sigil-transcription-v",
+      "path_in_vcs": "crates/yaml-sigil-transcription"
+    },
+    {
+      "name": "yaml-sigil-signing",
+      "tag_prefix": "yaml-sigil-signing-v",
+      "path_in_vcs": "crates/yaml-sigil-signing"
+    },
+    {
+      "name": "yaml-sigil-verification",
+      "tag_prefix": "yaml-sigil-verification-v",
+      "path_in_vcs": "crates/yaml-sigil-verification"
+    }
+  ]
+}