Owen Action release: immutable tag, external consumer verification, and protected major tag

[PhysShell]

Parent: #250
Blocked by: #252

Agent brief — tier: medium, owner-supervised. This issue performs the first real Action release.

Goal

Publish an immutable GitHub Action release tag, verify the Action from a separate repository, and only then move the protected major tag through the manual workflow.

Preconditions

• Owen Alpha gate: choose license, configure protected release environments, and approve version #252 completed.
• action-major-tag-move Environment exists with required reviewers.
• Main CI and the Marketplace-readiness workflow are green.
• The release version and immutable tag are recorded.
• The external consumer repository exists and is independent of the Own.NET checkout.

Immutable release tag

Create:

vX.Y.Z

Requirements:

• tag points to the intended release commit;
• tag is never moved or recreated;
• tag namespace remains distinct from CLI tags (owen-cli-v*);
• release-tag validation succeeds.

External consumer repository

Create or use a minimal separate public repository containing:

• a known leaking C# sample;
• a known clean C# sample;
• a workflow using the immutable Action tag:

uses: PhysShell/Own.NET@vX.Y.Z

The external workflow must not use:

• uses: ./;
• a checkout of Own.NET as its implementation source;
• a local composite-action path;
• a locally built CLI package.

External assertions

Verify:

1. Leak sample causes the Action step to fail for the expected finding.
2. The workflow explicitly asserts that this failure is expected rather than swallowing arbitrary failure.
3. Clean sample succeeds.
4. SARIF is non-empty and accepted by GitHub Code Scanning.
5. SARIF tool identity is Owen.
6. The workflow fetches the exact immutable Action tag.

Major-tag movement

Only after the immutable external consumer run succeeds:

1. Manually dispatch the existing major-tag workflow.
2. Target the immutable release tag.
3. Approve the protected action-major-tag-move deployment.
4. Peel annotated tags to the release commit before updating the major ref.
5. Verify:

v0 -> release commit for v0.x.y

Failure policy

• Never repair a broken immutable tag by moving it.
• Fix defects in a new patch tag.
• Do not move the major tag to a release that failed the external consumer workflow.
• Do not treat internal uses: ./ dogfood as sufficient external proof.

Guardrails

• No analyzer behavior changes.
• No NuGet publication in this issue.
• No automatic major-tag movement.
• No dynamic/untrusted shell interpolation of tag inputs.
• No broad Marketplace marketing work; this is release correctness and verification.

Acceptance

• Immutable vX.Y.Z exists and remains fixed.
• Separate consumer repository successfully invokes PhysShell/Own.NET@vX.Y.Z.
• Leak, clean and SARIF controls pass as specified.
• Code Scanning accepts the uploaded SARIF.
• Protected workflow moves the major tag to the peeled release commit.
• Evidence links the immutable tag, external workflow run, Code Scanning result and major-tag workflow run.