fix(ci): gate tagged publication on qualification

Signed-off-by: Simon Scatton <sscatton@nvidia.com>

Author: SDAChess

.agents/skills/watch-github-actions/SKILL.md

@@ -147,9 +147,12 @@ During `0.x`, a minor train permits compatibility findings
 as warnings; a patch train or no active train rejects them. Compare the current
 train's version with the latest stable release; commit messages are irrelevant.
 Compilation, baseline, and tool errors remain fatal. The `protobuf_compatibility` suite participates in
-the `release-tag-v1` qualification profile. Failed qualification prevents stable
-publication but still allows pre-release artifacts to publish with the failure
-recorded.
+the `release-tag-v1` qualification profile. Both tagged pre-release and stable
+publication require this profile to pass. Failed, cancelled, or skipped suites
+block publication; build artifacts and qualification evidence remain in Actions
+storage for diagnosis. Source-SHA images are staging inputs for qualification.
+Snap builds run in parallel with qualification, but tagged stable Store uploads
+consume those built artifacts only after qualification passes.
 
 View logs for a specific run:
 

.github/workflows/branch-checks.yml

@@ -411,6 +411,11 @@ jobs:
       - name: Test
         run: mise run test:python
 
+      - name: Test release publication gates
+        run: |
+          mise run test:qualification-summary
+          mise run test:release-publication
+
       - name: Test local gateway configuration helpers
         run: |
           bash tasks/scripts/test-gateway-pull-policy.sh

.github/workflows/release-tag.yml

@@ -311,10 +311,10 @@ jobs:
           retention-days: 90
           if-no-files-found: error
 
-      - name: Require current qualification profile for stable releases
-        if: needs.compute-versions.outputs.is_prerelease != 'true' && steps.summary.outputs.current-profile-passed != 'true'
+      - name: Require current qualification profile before publication
+        if: steps.summary.outputs.current-profile-passed != 'true'
         run: |
-          echo "Stable release ${RELEASE_TAG} did not pass the current release-tag-v1 qualification profile." >&2
+          echo "Release ${RELEASE_TAG} did not pass the current release-tag-v1 qualification profile." >&2
           exit 1
 
   build-python-wheel:
@@ -372,7 +372,7 @@ jobs:
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
       upload-channel: ${{ needs.compute-versions.outputs.is_prerelease == 'true' && 'latest/edge' || 'latest/stable' }}
       github-environment: ${{ needs.compute-versions.outputs.is_prerelease == 'true' && 'latest/edge' || 'latest/stable' }}
-      publish: ${{ needs.compute-versions.outputs.is_prerelease != 'true' }}
+      publish: false
     secrets:
       publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
 
@@ -386,11 +386,23 @@ jobs:
       rpm-release: ${{ needs.compute-versions.outputs.rpm_release }}
       cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
 
+  publish-snap:
+    name: Publish Snap
+    needs: [compute-versions, release, qualification-result]
+    if: needs.compute-versions.outputs.is_prerelease != 'true' && needs.qualification-result.outputs.current-profile-passed == 'true'
+    uses: ./.github/workflows/snap-publish.yml
+    with:
+      upload-channel: latest/stable
+      github-environment: latest/stable
+    secrets:
+      publish-credentials: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+
   # ---------------------------------------------------------------------------
-  # Assemble release artifacts. Stable publication remains qualification-gated.
+  # Assemble release artifacts after the current qualification profile passes.
   # ---------------------------------------------------------------------------
   release:
     name: Release
+    if: needs.qualification-result.outputs.current-profile-passed == 'true'
     needs:
       - compute-versions
       - package-binaries
@@ -740,9 +752,10 @@ jobs:
   publish-qualification:
     name: Publish Qualification Summary (OCI)
     if: >-
-      always()
+      !cancelled()
       && needs.release.result == 'success'
       && needs.qualification-result.result == 'success'
+      && needs.qualification-result.outputs.current-profile-passed == 'true'
     needs: [compute-versions, qualification-result, release]
     runs-on: ubuntu-latest
     timeout-minutes: 5

.github/workflows/snap-package.yml

@@ -49,7 +49,6 @@ jobs:
             runner: linux-arm64-cpu8
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
-    environment: ${{ inputs.github-environment }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -173,23 +172,12 @@ jobs:
             *.comp
           retention-days: 5
 
-      - name: Upload snap to Snap Store
-        if: inputs.publish
-        env:
-          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.publish-credentials }}
-          INPUTS_UPLOAD_CHANNEL: ${{ inputs.upload-channel }}
-        run: |
-          set -euo pipefail
-          SNAP_FILE="${{ steps.capture.outputs.snap-file }}"
-          SNAP_NAME="${SNAP_FILE%.snap}"
-          SNAP_NAME="${SNAP_NAME%%_*}"
-
-          COMPONENT_ARGS=()
-          shopt -s nullglob
-          for comp in "${SNAP_NAME}"+*.comp; do
-            echo "Adding component: $comp"
-            COMPONENT_ARGS+=(--component "$comp")
-          done
-
-          echo "Uploading $SNAP_FILE to ${INPUTS_UPLOAD_CHANNEL}"
-          snapcraft upload --release "${INPUTS_UPLOAD_CHANNEL}" "$SNAP_FILE" "${COMPONENT_ARGS[@]}"
+  publish-snap:
+    needs: build-snap
+    if: inputs.publish
+    uses: ./.github/workflows/snap-publish.yml
+    with:
+      upload-channel: ${{ inputs.upload-channel }}
+      github-environment: ${{ inputs.github-environment }}
+    secrets:
+      publish-credentials: ${{ secrets.publish-credentials }}

.github/workflows/snap-publish.yml

@@ -0,0 +1,74 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Publish Snap
+
+on:
+  workflow_call:
+    inputs:
+      upload-channel:
+        required: true
+        type: string
+      github-environment:
+        required: true
+        type: string
+    secrets:
+      publish-credentials:
+        required: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  publish:
+    name: Publish Snap (Linux ${{ matrix.arch }})
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: linux-amd64-cpu8
+          - arch: arm64
+            runner: linux-arm64-cpu8
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 10
+    environment: ${{ inputs.github-environment }}
+    steps:
+      - name: Download built snap and components
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: snap-linux-${{ matrix.arch }}
+
+      - name: Install snapcraft
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y snapd
+          sudo systemctl enable --now snapd.socket
+          sudo systemctl start snapd
+          sudo snap wait system seed.loaded
+          sudo snap install snapcraft --classic
+
+      - name: Upload snap to Snap Store
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.publish-credentials }}
+          INPUTS_UPLOAD_CHANNEL: ${{ inputs.upload-channel }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          snaps=(*.snap)
+          if [[ "${#snaps[@]}" -ne 1 ]]; then
+            echo "Expected exactly one built snap, found ${#snaps[@]}" >&2
+            exit 1
+          fi
+          snap_file="${snaps[0]}"
+          snap_name="${snap_file%.snap}"
+          snap_name="${snap_name%%_*}"
+          component_args=()
+          for comp in "${snap_name}"+*.comp; do
+            component_args+=(--component "$comp")
+          done
+          snapcraft upload --release "${INPUTS_UPLOAD_CHANNEL}" "$snap_file" "${component_args[@]}"

CI.md

@@ -42,8 +42,8 @@ missing baselines, merge conflicts, and tool failures always fail the check.
 
 Release Tag compares the tagged candidate cumulatively against the previous
 stable release, using the same minor-versus-patch policy. Its result is part
-of the qualification profile: failure blocks stable publication, while a
-pre-release can still publish with failed qualification recorded. This checks
+of the qualification profile: failure blocks both pre-release and stable
+publication. Failed candidates retain build artifacts and evidence in Actions. This checks
 protobuf compatibility; SDK/configuration compatibility and migration review
 remain separate qualification work.
 
@@ -187,9 +187,8 @@ candidate snapshot. Cargo Deny uses its existing NVIDIA self-hosted runner and
 CI container.
 
 Tagged releases treat Cargo Deny and Codex Security findings as failures of the
-currently implemented qualification profile. A profile failure does not prevent
-a pre-release candidate's complete artifact set from being published, but it
-does prevent stable publication. CodeQL, Trivy, and Zizmor findings are
+currently implemented qualification profile. A profile failure prevents both
+pre-release and stable publication. CodeQL, Trivy, and Zizmor findings are
 temporarily informational for tagged releases: the existing findings were
 reviewed and accepted for v0.1.0 and will be addressed in 0.1.x releases.
 Scanner failures still fail qualification.
@@ -208,8 +207,9 @@ gh workflow run security-scan.yml --ref main \
   -F fail-on-static-findings=false
 ```
 
-To integrate it into a larger workflow, run it after the job that pushes the
-candidate tag and publishes the artifacts. This example assumes an existing
+To integrate it into a larger workflow, run it after the job that creates the
+candidate tag and stages source-addressed artifacts for scanning. Release-facing
+publication follows successful qualification. This example assumes an existing
 `build` job with outputs named `candidate_tag`, `gateway_image`, `sandbox_image`,
 and `chart_ref`; adapt those names to your workflow:
 
@@ -240,8 +240,8 @@ jobs:
 Set `needs: security` on a downstream promotion job to require successful scans.
 The tagged release workflow records protobuf, security, and integration outcomes in a
 qualification job after publishing its commit-addressed OCI images. A failed
-check remains visible in the workflow, but pre-release artifact assembly and
-publication continue. Stable publication currently requires the implemented
+check remains visible in the workflow, with build artifacts and evidence retained
+in Actions storage. Both pre-release and stable publication require the implemented
 `release-tag-v1` profile to pass; that profile is an incremental subset of RFC
 0014 qualification.
 
@@ -497,7 +497,8 @@ These workflows run after merge to publish dev/tagged artifacts and verify them.
 | File | Role |
 |---|---|
 | `.github/workflows/release-dev.yml` | Publishes the rolling `dev` build on every push to `main`. Builds gateway, sandbox, and supervisor images and binaries, packages, wheels, and pushes the Helm chart as `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` (plus an immutable `0.0.0-dev.<sha>` pin). Also dispatchable manually. |
-| `.github/workflows/release-tag.yml` | Publishes tagged stable releases and manually dispatched pre-releases. Its automatic tag trigger excludes `-pre.*`. Protobuf, security, and integration failures do not block pre-release artifact publication. Stable publication requires the currently implemented qualification profile to pass; the summary identifies the remaining RFC 0014 coverage. |
+| `.github/workflows/release-tag.yml` | Publishes tagged stable releases and manually dispatched pre-releases. Its automatic tag trigger excludes `-pre.*`. Both require the currently implemented qualification profile to pass before publication; the summary identifies the remaining RFC 0014 coverage. Failed candidates retain build artifacts and evidence in Actions storage. Source-SHA OCI images remain available as qualification inputs. |
+| `.github/workflows/snap-publish.yml` | Uploads existing Snap and component artifacts to the Store without rebuilding. Release Dev calls it after Snap builds; Release Tag calls it only after qualification and release assembly succeed. |
 | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The Snap lanes verify a compatible system Docker lifecycle and `ubuntu-snap-docker-preflight` tests fail-fast behavior when Docker is absent or supplied by the Docker snap. The positive Snap lane also runs a local policy containment check with the packaged prover. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
 
 ## Required status contexts

docs/about/support-matrix.mdx

@@ -19,6 +19,12 @@ the release cycle. Use a stable release for production deployments.
 | Pre-release | Built nightly when `main` has changed and normal CI passes. Versions use the form `X.Y.Z-pre.N`. | Validating the immutable artifact set proposed for the next stable release. Pre-releases use the stable feature set but may not have passed qualification. |
 | Stable | Promoted from a pre-release that passes conformance, upgrade, API compatibility, artifact, and security checks. Versions use the form `X.Y.Z`. | Production use within this support matrix. |
 
+The tagged release pipeline publishes pre-release and stable artifacts only
+after its current qualification profile passes. Failed candidates retain build
+artifacts and qualification evidence in CI storage. The current profile covers
+part of the complete release qualification policy; passing it does not establish
+full RFC 0014 coverage.
+
 Tagged stable releases generally go out every week. OpenShell targets Tuesday
 publication when there are changes and every blocking qualification check
 passes. A security release may ship sooner.