Migrate CI/CD to clet's model, adapted for PowerShell Gallery (Install-Module)

[tig]

Tracks workstream C / checklist item 4 in PLAN.md, and supersedes the generic "replace OneBranch" task.

Migrate PSTui's CI/CD to mirror clet's model, adapted for a PowerShell binary module published to the PowerShell Gallery (not a NativeAOT CLI).

---

✅ Status (2026-06-24): functionally complete, 1.0.0 shipped

The pipeline migration is done and PSTui 1.0.0 is live on PSGallery (Install-Module PSTui, #6). The new workflows are on main:

• .github/workflows/release.yml — push to main (on src/**/test/**/build files), workflow_dispatch (with version_override), and repository_dispatch: terminal-gui-published. Resolves version from PSTui.Common.props, builds + tests, stamps the manifest, Publish-PSResource to PSGallery, tags v${VERSION}, creates a GitHub Release with the packaged .zip, and opens/updates a release-failure issue on failure. Installs PS 7.6 (runners ship 7.4) so Test-ModuleManifest/Publish-PSResource accept the manifest.
• .github/workflows/ci-test.yml — dev-loop CI: OS matrix (windows/macos/ubuntu), build + xUnit. Packaging/publishing stays in release.yml.

See the comment history below for the verified dry run and the PS-7.6 fix.

Remaining before this can close

• Remove the Microsoft OneBranch pipeline — .pipelines/ConsoleGuiTools-Official.yml is still in the tree on main and should be deleted (the only listed item that was never actually done).
• Add an Install-Module smoke test — clean-runner job that installs the published (or staged) module, imports it, and invokes ocgv/shot. Not present yet.
• (Minor) clet-parity gaps in ci-test.yml — add the dotnet format style check (once, on Linux) and fail-fast: false on the OS matrix.

---

Original scope

What to adopt from clet

• Branching model: develop (default, day-to-day + PRs) → main (release-only). — ✅ done.
• ci.yml: OS matrix (ubuntu/macos/windows), restore → build → test. — ✅ done as ci-test.yml (minus dotnet format / fail-fast: false, see above).
• release.yml: push to main, workflow_dispatch, repository_dispatch from Terminal.Gui. — ✅ done.
• Version resolution: RC vs stable split, auto-increment off latest matching tag, workflow_dispatch override. — ✅ done (PS prerelease labels are alphanumeric, so rc4 not clet's rc.4).
• Tag job (v${VERSION}) and failure-notification issue on workflow failure. — ✅ done.

What differs (PowerShell module, not a NativeAOT CLI)

• Publish to PowerShell Gallery — via Publish-PSResource (PSGallery API key as a repo secret), not dotnet tool/NuGet/Homebrew/WinGet.
• Install-Module PSTui works end-to-end — correct .psd1, validated with Test-ModuleManifest; 1.0.0 installable from PSGallery (Publish PSTui 1.0.0 to the PowerShell Gallery #6).
• Prerelease handling — VersionSuffix → Prerelease in PSData (Install-Module PSTui -AllowPrerelease).
• Attach the packaged module .zip to the GitHub Release.
• Add an Install-Module smoke test (clean runner: install, import, invoke ocgv/shot). — not done.
• Remove the Microsoft OneBranch pipeline (.pipelines/) and Azure-specific CI. — not done; .pipelines/ConsoleGuiTools-Official.yml still present.

[tig]

Initial release pipeline added on develop in f1370f9: .github/workflows/release.yml + .github/workflows/README.md (left the CI agent's ci-test.yml untouched).

Adapted from clet's model for a PowerShell module → PowerShell Gallery (no NativeAOT/Homebrew/WinGet):

• Triggers: push to main (src/**, test/**, build files), workflow_dispatch (with version_override), and repository_dispatch: terminal-gui-published so Terminal.Gui can trigger a republish.
• Versioning: driven by PSTui.Common.props VersionPrefix/VersionSuffix. Empty suffix → stable (1.0.0, 1.0.1…); non-empty → prerelease (rc1, rc2…), auto-incremented off the latest matching git tag. Note PowerShell prerelease labels are alphanumeric-only, so rc1 not clet's rc.1.
• Flow: resolve version → Invoke-Build Build, Test → stamp ModuleVersion/Prerelease into the built manifest → Publish-PSResource to PSGallery → tag + GitHub Release → notify-failure job opens/updates a release-failure issue.
• Safety: publish + tag are gated on the PSGALLERY_API_KEY secret. Until that's set, the workflow is a dry run (build/test/resolve only) — so it can be validated before going live.

⚠️ Authored without a local .NET SDK and not yet run end-to-end. Before first real release: add PSGALLERY_API_KEY, reserve the PSTui Gallery id (#6), and confirm a workflow_dispatch dry run is green. Leaving #5 open until that dry run passes.

---

Generated by Claude Code

[tig]

Finding from enabling CI on develop (re #1/#4): the rebranded manifest sets PowerShellVersion = 7.6, but GitHub-hosted runners ship PowerShell 7.4. So Invoke-Build … Package → Publish-PSResource fails manifest validation on the runners:

The version of PowerShell on this computer is '7.4.16'. The module … requires a minimum PowerShell version of '7.6' to run.

Dev-loop CI (ci-test.yml) now runs Build + Test only; packaging/publishing stays here in the release pipeline (release.yml, main). This pipeline must run under PowerShell 7.6+ (install a 7.6 pwsh in the release job, or run Publish-PSResource/Test-ModuleManifest under it) or it will hit the same wall when shipping 1.0.0 (#6). Flagging so it's handled as part of this workstream.

[tig]

✅ Release pipeline verified green under PS 7.6

Dry-run on develop (run) exercises the full pipeline:

Step	Result
Install PowerShell 7.6+	✅ 7.6.3 at ~/.dotnet/tools/pwsh
Build + xUnit	✅ 78/78
Stamp + Test-ModuleManifest	✅ validates the PS-7.6 manifest
Package artifact	✅
Publish to PSGallery	⏭️ skipped (not main)
Tag + GitHub Release	⏭️ skipped (not main)

What was fixed (all on develop)

1. PS 7.6 in CI — the module targets net10/PS 7.6+, but runners ship PS 7.4 (failing Test-ModuleManifest/Publish-PSResource). Install PS 7.6 as a .NET global tool, prepend to PATH, with a fail-fast Verify step.
2. nuget feed — the PS tool install was 401'ing against the repo's authenticated CFS feed; pinned that one install to a nuget.org-only --configfile.
3. Publish hard-locked to main — if: … && github.ref == 'refs/heads/main' on Publish + Tag, so workflow_dispatch on develop is always a safe dry-run.

Set up

• PSGALLERY_API_KEY repo secret is configured.

Remaining for an actual release (#6)

• Push to main (release branch) to trigger a real publish of 1.0.0.
• Confirm the PSGallery API key's glob scope accepts the first-ever PSTui push (widen to * once if the new-package push is rejected, then tighten).
• (Optional) code-signing / catalog signing decision, if desired before 1.0.0.

The pipeline migration itself is functionally complete and verified.

[tig]

Revised the issue body against current main (2026-06-24)

Reviewed the original checklist against what actually shipped. The migration is functionally complete and 1.0.0 is live, so I marked the done items and pulled the genuinely-remaining work to the top:

Done & verified on main: release.yml (publish via Publish-PSResource, RC/stable version resolution, workflow_dispatch override, repository_dispatch: terminal-gui-published, tag + GitHub Release with .zip, notify-failure issue), ci-test.yml (OS matrix build+test), prerelease handling, PS-7.6 install workaround.

Still open (3):

1. Remove .pipelines/ConsoleGuiTools-Official.yml — the OneBranch removal was on the checklist but never happened; it's still tracked on main.
2. Install-Module smoke test — no such job exists.
3. Minor clet-parity in ci-test.yml — missing dotnet format style check and fail-fast: false.

Keeping #5 open until at least items 1–2 land.