NTFSSecurity/.memory-bank/decisions/0012-ci-releases.md

status	date	last-verified	owner	source
accepted	2026-10-04	2026-10-04	shared	maintainer decisions after

Decision 12: Releases are built and published by CI on a version tag

• Choice: Pushing a tag such as 5.0.0 or 5.0.0-rc1 on master runs the release job of .github/workflows/ci.yml. It publishes the package that the build job built and tested to the PowerShell Gallery (Publish-PSResource -NupkgPath) and creates the GitHub release with NTFSSecurity.zip, marked as a prerelease for a prerelease tag. The job checks that the tag equals the manifest version (with the prerelease label) and points to a commit on master, and it skips a version the Gallery or GitHub already has, so a rerun is safe.
• Package: New-ModulePackage.ps1 copies only the FileList files of the Release build, so no .pdb, XML documentation, or System.Management.Automation.dll ships. Compress-PSResource builds the nupkg; the script adds the command tags (PSIncludes_Cmdlet, PSCmdlet_<name>, PSCommand_<name>) that PowerShellGet 2 added and PSResourceGet 1.2 doesn't, because the Gallery lists cmdlets and Find-Command searches by them. Every CI run builds the packages, so pull requests test them.
• Secret: PSGALLERY_API_KEY belongs to the GitHub environment powershell-gallery, which only the release job uses; the maintainer creates the key, the environment, and the secret, and may require a reviewer.
• Process: a prerelease first (maintainer, 2026-10-04: "no full release without proper testing"), starting with 5.0.0-rc1; the final release removes the label and dates the changelog section. Steps for maintainers are in Docs/Contributing/05-Releasing.md.
• Rationale: Releases so far were local Debug builds published by hand with the whole output folder; tags carried the previous version.
• Rejected: publishing with PowerShellGet 2 Publish-Module (repackages at publish time, so the tested package isn't the published one), and adding the command tags to the shipped manifest.