ci(release): publish prereleases before qualification

.agents/skills/sbom/SKILL.md

@@ -15,7 +15,7 @@ The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft,
 
 SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored).
 
-Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, and Release Tag image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
+Pushed gateway, sandbox, and supervisor images carry an SPDX SBOM and minimal SLSA provenance as OCI attestations. Branch E2E, Release Dev, Release, and Pre-release image binaries embed cargo-auditable metadata, so their image SBOMs include linked Rust crates.
 
 ## Prerequisites
 

.agents/skills/test-release-canary/SKILL.md

@@ -33,7 +33,7 @@ they continue to exercise the dev Debian package. Kubernetes pins the matching
 `0.0.0-dev` chart and `:dev` images.
 
 RPM package installation also has tmachine conformance coverage in
-`Branch E2E Checks` (with `test:e2e`), `Release Dev`, and `Release Tag`. Those
+`Branch E2E Checks` (with `test:e2e`), `Release Dev`, `Release`, and `Pre-release`. Those
 lanes use the `rpm` installer on `fedora-podman-rootful` and
 `fedora-podman-rootless` with candidate CLI and
 gateway RPMs and matching runtime images. Branch RPM package builds run on

.agents/skills/watch-github-actions/SKILL.md

@@ -156,21 +156,22 @@ groups and manual runs use their explicit baseline. Findings are reported by
 `Reject new high or critical findings`; distinguish those from scanner failures.
 
 For `Protobuf Compatibility`, check the logged train and comparison baseline.
-Branch Checks compares the prospective merge tree with its target; Release Tag
+Branch Checks compares the prospective merge tree with its target; release qualification
 compares the tagged candidate with the previous stable release. Both use
 the shared `check-protobuf-compatibility` action with `nix run .#check-protobuf-compatibility -- <ref>`.
 During `0.x`, a minor train permits compatibility findings
 as warnings; a patch train or no active train rejects them. Compare the current
 train's version with the latest stable release; commit messages are irrelevant.
 Compilation, baseline, and tool errors remain fatal. The `protobuf_compatibility` suite participates in
-the `release-tag-v1` qualification profile. Release Tag calls the reusable
+the `release-tag-v1` qualification profile. Release and Pre-release call the reusable
 `release-qualification.yml` workflow to run the checks and collect their results.
-Both tagged pre-release and stable
-publication require this profile to pass. Failed, cancelled, or skipped suites
-block publication; build artifacts and qualification evidence remain in Actions
-storage for diagnosis. Source-SHA images are staging inputs for qualification.
-Snap builds run in parallel with qualification, but tagged stable Store uploads
-consume those built artifacts only after qualification passes.
+Release builds, qualifies, then publishes. Pre-release builds, publishes, then
+qualifies in the same run. Failed, cancelled, or skipped required suites fail
+qualification; stable publication is blocked, while published pre-release
+artifacts remain available. The Pre-release failure notification includes the
+run link. Both callers share `release-build.yml` and `release-publish.yml`.
+Qualification evidence remains in Actions and OCI storage for diagnosis.
+Snap Store uploads happen only for stable releases after qualification passes.
 
 For `Codex Compatibility Review`, inspect its job summary and the
 `compatibility-review-run-<run-id>-attempt-<attempt>` artifact. Confirm the
@@ -183,7 +184,7 @@ share the `codex-release-review` concurrency group with `queue: max`, retaining
 up to 100 pending reviews while preventing overlapping API usage across runs.
 Either review can run first; other security scanners run in parallel.
 The qualification caller waits for both reviews to finish. Do not
-rerun Release Tag to debug this reviewer. Use its dedicated manual workflow
+rerun Release or Pre-release to debug this reviewer. Use its dedicated manual workflow
 with an existing candidate tag; that path does not publish release artifacts.
 
 View logs for a specific run:

.github/workflows/branch-docs.yml

@@ -12,6 +12,8 @@ on:
       - "tasks/scripts/check_docs_nav_test.py"
       - ".github/workflows/branch-docs.yml"
       - ".github/workflows/release-tag.yml"
+      - ".github/workflows/release-prerelease.yml"
+      - ".github/workflows/release-publish.yml"
 
 permissions:
   contents: read

.github/workflows/release-auto-tag.yml

@@ -85,12 +85,12 @@ jobs:
           git tag "$NEXT_TAG"
           git push origin "refs/tags/$NEXT_TAG"
 
-      - name: Trigger Release Tag workflow
+      - name: Trigger Pre-release workflow
         if: steps.version.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NEXT_TAG: ${{ steps.version.outputs.next }}
         run: |
-          gh workflow run release-tag.yml \
+          gh workflow run release-prerelease.yml \
             --ref main \
             -f tag="$NEXT_TAG"

.github/workflows/release-build.yml

@@ -0,0 +1,215 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Build Release
+
+on:
+  workflow_call:
+    inputs:
+      release-tag:
+        description: Git tag to build and publish
+        required: true
+        type: string
+      is-prerelease:
+        description: Whether the caller is publishing a pre-release
+        required: true
+        type: boolean
+    outputs:
+      python_version:
+        description: Python package version
+        value: ${{ jobs.compute-versions.outputs.python_version }}
+      npm_version:
+        description: TypeScript package version
+        value: ${{ jobs.compute-versions.outputs.npm_version }}
+      semver:
+        description: Release version without the v prefix
+        value: ${{ jobs.compute-versions.outputs.semver }}
+      source_sha:
+        description: Source commit resolved from the release tag
+        value: ${{ jobs.compute-versions.outputs.source_sha }}
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+  packages: read
+
+env:
+  RELEASE_TAG: ${{ inputs.release-tag }}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  compute-versions:
+    name: Compute Versions
+    runs-on: linux-amd64-cpu8
+    timeout-minutes: 5
+    container:
+      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    outputs:
+      python_version: ${{ steps.v.outputs.python }}
+      cargo_version: ${{ steps.v.outputs.cargo }}
+      npm_version: ${{ steps.v.outputs.npm }}
+      deb_version: ${{ steps.v.outputs.deb }}
+      rpm_version: ${{ steps.v.outputs.rpm_version }}
+      rpm_release: ${{ steps.v.outputs.rpm_release }}
+      # Semver without 'v' prefix (e.g. 0.6.0), used for image tags and release body
+      semver: ${{ steps.v.outputs.semver }}
+      # Commit resolved from RELEASE_TAG, used for image tags and downstream metadata
+      source_sha: ${{ steps.v.outputs.source_sha }}
+      is_prerelease: ${{ steps.v.outputs.is_prerelease }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ inputs.release-tag }}
+
+      - name: Mark workspace safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Fetch tags
+        run: git fetch --tags --force
+
+      - name: Compute all versions
+        id: v
+        env:
+          EXPECTED_PRERELEASE: ${{ inputs.is-prerelease }}
+        run: |
+          set -euo pipefail
+          if [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-pre\.[1-9][0-9]*$ ]]; then
+            is_prerelease=true
+          elif [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            is_prerelease=false
+          else
+            echo "Unsupported release tag: ${RELEASE_TAG}" >&2
+            exit 1
+          fi
+          if [[ "${is_prerelease}" != "${EXPECTED_PRERELEASE}" ]]; then
+            echo "Tag ${RELEASE_TAG} does not match this release workflow's prerelease mode." >&2
+            exit 1
+          fi
+          {
+            echo "is_prerelease=${is_prerelease}"
+            echo "python=$(uv run python tasks/scripts/release.py get-version --python)"
+            echo "cargo=$(uv run python tasks/scripts/release.py get-version --cargo)"
+            echo "npm=$(uv run python tasks/scripts/release.py get-version --npm)"
+            echo "deb=$(uv run python tasks/scripts/release.py get-version --deb)"
+            echo "rpm_version=$(uv run python tasks/scripts/release.py get-version --rpm-version)"
+            echo "rpm_release=$(uv run python tasks/scripts/release.py get-version --rpm-release)"
+            echo "semver=${RELEASE_TAG#v}"
+            echo "source_sha=$(git rev-parse HEAD)"
+          } >> "$GITHUB_OUTPUT"
+
+  build-binaries:
+    needs: compute-versions
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-binaries.yml
+    with:
+      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
+      supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  build-vm-driver:
+    needs: [compute-versions, build-binaries]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/build-vm-driver.yml
+    with:
+      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}
+      supervisor-image-tag: ${{ needs.compute-versions.outputs.semver }}
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+  package-binaries:
+    needs: [compute-versions, build-binaries, build-vm-driver]
+    permissions:
+      actions: read
+      contents: read
+    uses: ./.github/workflows/package-release-binaries.yml
+    with:
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+
+  build-images:
+    needs: [compute-versions, build-binaries]
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/build-images.yml
+    with:
+      image-tag: ${{ needs.compute-versions.outputs.source_sha }}
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+
+  build-python-wheel:
+    name: Build Python Wheel
+    needs: [compute-versions]
+    runs-on: linux-amd64-cpu8
+    timeout-minutes: 20
+    container:
+      image: ghcr.io/nvidia/openshell/ci:9cb72baa2e61a1b5f12407e6e82da7fdba0aa722@sha256:67a9a0c32cb99825e6d3e9d9eec45d67149ea1ff7c11a1b1e1b3480d2d3df684
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    env:
+      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL: ${{ needs.compute-versions.outputs.python_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ needs.compute-versions.outputs.source_sha }}
+
+      - name: Mark workspace safe for git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Sync Python dependencies
+        run: uv sync
+
+      - name: Build Python wheel
+        run: |
+          set -euo pipefail
+          mise run python:build
+          ls -la target/wheels/*.whl
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-wheel
+          path: target/wheels/*.whl
+          retention-days: 5
+
+  build-deb:
+    name: Build Debian Packages
+    needs: [compute-versions, build-binaries, build-vm-driver]
+    uses: ./.github/workflows/deb-package.yml
+    with:
+      deb-version: ${{ needs.compute-versions.outputs.deb_version }}
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+
+  build-snap:
+    name: Build Snap
+    needs: [compute-versions, build-binaries]
+    uses: ./.github/workflows/snap-package.yml
+    with:
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+
+  build-rpm:
+    name: Build RPM Packages
+    needs: [compute-versions, build-binaries]
+    uses: ./.github/workflows/rpm-package.yml
+    with:
+      checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
+      rpm-version: ${{ needs.compute-versions.outputs.rpm_version }}
+      rpm-release: ${{ needs.compute-versions.outputs.rpm_release }}
+      cargo-version: ${{ needs.compute-versions.outputs.cargo_version }}