[Bpoe]

dscpkg currently provides CI executables but has no tag-driven release process. This adds a draft-only release flow modeled on dsc-reconciler, with ready-to-install packages and manual publication after review.

Approach

• Accept stable vX.Y.Z tags on commits already in main, resolve the exact tagged commit, and refuse to overwrite existing releases or drafts. Recheck the remote tag before creating the draft.
• Reuse native CI to build Linux, Windows, and macOS archives, Windows MSI, and Linux DEB/RPM packages. Inspect and test the payloads before uploading them, then assemble the draft from those same artifacts with generated notes and SHA256SUMS.
• Install machine-wide, manage the Windows system PATH entry, and preserve downloaded resource packages, registries, and caches through upgrades and uninstall. No services or DSC runtime are bundled.
• Keep publication manual, serialize releases per tag, and grant write permission only to the draft-creation job. Document installation, local packaging, tagging, and failure recovery.

Important details

MSI versions map directly to X.Y.Z: major/minor are limited to 255 and patch to 65535. These limits apply to the entire release; prerelease tags are unsupported. macOS remains archive-only, and distribution packages are unsigned. The pinned WiX 7 build tool's licensing/EULA requirements are documented.

Validation

• Hosted CI passed on Linux, Windows, and macOS, including existing Go checks, workflow/script lint, release-guard regression tests, and package inspection.
• Disposable Windows, Ubuntu, and Fedora environments exercised installer lifecycles and data retention. Windows additionally checked repair, PATH handling, and downgrade rejection; isolated fixtures verified upgrade replacement.
• Verified final draft assembly using the actual uploaded CI artifacts with GitHub writes mocked. No release tag was pushed or GitHub release created.