Release: merge develop into beta (v7.0.5-beta)

.github/actions/azure-artifact-sign/action.yml

@@ -0,0 +1,47 @@
+name: Azure Artifact Sign
+description: Sign PE/MSI files with Azure Artifact Signing (OIDC via azure/login in the caller)
+
+inputs:
+  files:
+    description: Comma or newline-separated absolute paths to sign
+    required: true
+  endpoint:
+    description: Artifact Signing account endpoint
+    required: true
+  signing-account-name:
+    description: Artifact Signing account name
+    required: true
+  certificate-profile-name:
+    description: Certificate profile name
+    required: true
+  description:
+    description: Authenticode description
+    required: false
+    default: Titanium Web Proxy
+
+runs:
+  using: composite
+  steps:
+    - name: Sign files
+      uses: azure/artifact-signing-action@v2
+      with:
+        endpoint: ${{ inputs.endpoint }}
+        signing-account-name: ${{ inputs.signing-account-name }}
+        certificate-profile-name: ${{ inputs.certificate-profile-name }}
+        files: ${{ inputs.files }}
+        file-digest: SHA256
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
+        description: ${{ inputs.description }}
+        description-url: https://github.com/justcoding121/titanium-web-proxy
+        # azure/login already established Azure CLI; skip slower credential types.
+        exclude-environment-credential: true
+        exclude-workload-identity-credential: true
+        exclude-managed-identity-credential: true
+        exclude-shared-token-cache-credential: true
+        exclude-visual-studio-credential: true
+        exclude-visual-studio-code-credential: true
+        exclude-azure-cli-credential: false
+        exclude-azure-powershell-credential: true
+        exclude-azure-developer-cli-credential: true
+        exclude-interactive-browser-credential: true

.github/workflows/chocolatey-publish.yml

@@ -0,0 +1,51 @@
+name: chocolatey-publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'GitHub release tag (e.g. v7.0.5 or v7.0.5-beta)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: windows-latest
+    steps:
+      - name: Require CHOCOLATEY_API_KEY
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+        shell: pwsh
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:CHOCOLATEY_API_KEY)) {
+            throw 'CHOCOLATEY_API_KEY repository secret is not set.'
+          }
+
+      - uses: actions/checkout@v6
+
+      - name: Pack and push chocolatey packages
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $tag = $env:RELEASE_TAG.Trim()
+          if ($tag -notmatch '^v') { $tag = "v$tag" }
+          pwsh ./tools/packaging/chocolatey/bump-packages.ps1 -Tag $tag
+          $cliAsset = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/$tag/Titanium.Cli-win-x64.zip"
+          $msiAsset = "https://github.com/$env:GITHUB_REPOSITORY/releases/download/$tag/TitaniumInspector-win-x64.msi"
+          Invoke-WebRequest -Method Head -Uri $cliAsset -UseBasicParsing | Out-Null
+          Invoke-WebRequest -Method Head -Uri $msiAsset -UseBasicParsing | Out-Null
+          Push-Location tools/packaging/chocolatey/titanium-cli
+          choco pack --output-directory .
+          Pop-Location
+          Push-Location tools/packaging/chocolatey/titanium-inspector
+          choco pack --output-directory .
+          Pop-Location
+          Get-ChildItem tools/packaging/chocolatey -Recurse -Filter *.nupkg | ForEach-Object {
+            choco push $_.FullName --source https://push.chocolatey.org/ --api-key $env:CHOCOLATEY_API_KEY
+          }

.github/workflows/dotnetcore.yml

@@ -34,7 +34,7 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 60
     permissions:
-      # write: Publish Documentation (EndBug/add-and-commit) pushes DocFX output to develop.
+      # write: Publish Documentation pushes DocFX output to develop.
       # GITHUB_TOKEN with contents:read cannot push (403 github-actions[bot]).
       contents: write
       # SonarCloud / PR decoration when token is present
@@ -134,22 +134,42 @@ jobs:
       shell: pwsh
       run: .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="$env:SONAR_TOKEN"
 
-    - name: Update Documentation
-      if: github.ref == 'refs/heads/develop'
-      run: docfx .github/docfx.json
-
+    # DocFX output races other develop pushes (incl. concurrent "Update documentation").
+    # Sync to origin/develop, regenerate, commit docs-only, retry push — never fail the
+    # job on stash/rebase conflicts from EndBug/add-and-commit autostash.
     - name: Publish Documentation
       if: github.ref == 'refs/heads/develop'
-      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
-      with:
-        default_author: github_actions
-        message: Update documentation
-        committer_name: GitHub Actions
-        committer_email: actions@github.com
-        # Only commit DocFX output -- never Sonar/coverage/tool install artifacts
-        add: 'docs'
-        # DocFX often races another develop push; rebase instead of failing the job.
-        pull: '--rebase --autostash'
+      shell: pwsh
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+        for ($attempt = 1; $attempt -le 5; $attempt++) {
+          Write-Host "Publish documentation attempt $attempt"
+          git fetch origin develop
+          if ($LASTEXITCODE -ne 0) { throw "git fetch failed" }
+          git reset --hard origin/develop
+          if ($LASTEXITCODE -ne 0) { throw "git reset failed" }
+          docfx .github/docfx.json
+          if ($LASTEXITCODE -ne 0) { throw "docfx failed" }
+          git add -- docs
+          if (-not (git status --porcelain -- docs)) {
+            Write-Host "No documentation changes to publish."
+            exit 0
+          }
+          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" `
+            commit --author="github-actions <41898282+github-actions[bot]@users.noreply.github.com>" `
+            -m "Update documentation"
+          if ($LASTEXITCODE -ne 0) { throw "git commit failed" }
+          git push origin HEAD:develop
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "Documentation published."
+            exit 0
+          }
+          Write-Host "Push rejected (develop moved); retrying..."
+          Start-Sleep -Seconds (2 * $attempt)
+        }
+        throw "Failed to publish documentation after retries"
 
   # Cross-OS Inspector + Plus dashboard UI gates (Headless / Visual / Playwright).
   # Inspector unit suite stays on Windows `build` only except Inspector-Stress (below).
@@ -426,6 +446,8 @@ jobs:
 
   # Product zips stay on release.yml (v* tags). After beta/stable merge, create/move the
   # version tag and dispatch release.yml (GITHUB_TOKEN tag pushes do not re-trigger workflows).
+  # release.yml also packs/pushes Chocolatey (titanium-cli / titanium-inspector) after the
+  # GitHub Release exists — no separate chocolatey step here.
   cut-product-tag:
     if: github.event_name == 'push' && (github.ref == 'refs/heads/beta' || github.ref == 'refs/heads/stable')
     needs: [build, ui-portable, rps-publish-gate, rps-peer-gate]

.github/workflows/packaging-catalog-smoke.yml

@@ -0,0 +1,50 @@
+# Validate Homebrew formula against a published release tag.
+# Used for beta dry-run before stable catalog submit.
+name: packaging-catalog-smoke
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: 'GitHub release tag (e.g. v7.0.4-beta or v7.0.5)'
+        required: true
+        type: string
+      run_homebrew:
+        description: 'Smoke brew install from in-repo formula'
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  homebrew:
+    if: inputs.run_homebrew
+    runs-on: macos-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Smoke brew install from tap
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          set -euo pipefail
+          FORMULA=tools/packaging/homebrew/titanium.rb
+          test -f "$FORMULA"
+          # Formula version must match tag without leading v (e.g. 7.0.4-beta).
+          EXPECTED="${RELEASE_TAG#v}"
+          grep -q "version \"$EXPECTED\"" "$FORMULA"
+          # Homebrew rejects bare paths; install via the published custom tap (kept in sync).
+          export HOMEBREW_NO_REQUIRE_TAP_TRUST=1
+          brew tap justcoding121/titanium
+          brew update || true
+          # Prefer in-repo formula content for the version under test by copying into a local tap.
+          LOCAL_TAP="$(brew --repository)/Library/Taps/justcoding121/homebrew-titanium"
+          mkdir -p "${LOCAL_TAP}/Formula"
+          cp "$FORMULA" "${LOCAL_TAP}/Formula/titanium.rb"
+          brew install --formula justcoding121/titanium/titanium
+          titanium version
+          brew test justcoding121/titanium/titanium
+          brew uninstall --formula justcoding121/titanium/titanium || true