refactor: harden build provenance and releases

[bashrusakh]

Summary

• Hardened custom-build provenance, validation, cleanup, secret handling, workflow approval, and provider-derived execution identity.
• Removed the obsolete GitHub tag-protection fallback; modern Repository Rulesets are the sole supported protection surface.
• Renamed the active Windows workflow contract to rustqs-windows.yml, branch to rustqs/workflows, and artifact to rustqs-windows.
• Updated active documentation and canonical migration records; historical/frozen references remain labeled as such.

Current workflow contract

• Fork branch: rustqs/workflows
• Windows workflow: .github/workflows/rustqs-windows.yml
• Artifact: rustqs-windows
• Migration commit: b11be6aef84aa110884bec8fa5fe827663b8ff01
• RustDesk PR docs: translate markdown docs to English #5 remains open and is retargeted to rustqs/workflows: feat: make client sources upstream-independent rustdesk#5

Signed tag and protection

• Signed annotated tag: workflow-v1.0.0
• Tag target: b11be6aef84aa110884bec8fa5fe827663b8ff01
• GitHub verification: true / valid
• Active ruleset: DeskForge workflow tags (ID 20901403)
• Ruleset scope: refs/tags/workflow-*; deletion and update blocked; no bypass actors; fetch/merge updates disabled

GUI behavior

The existing admin GUI displays the provider-derived workflow tag and approval state. No raw workflow-ref editor or duplicate UI architecture was introduced.

Validation

• GOWORK=off go test ./...
• GOWORK=off go vet ./...
• GOWORK=off go test -race ./service
• Focused workflow/ruleset, controller, manifest, and security tests
• git diff --check
• Build 31923027293: Go, Rust, Admin UI, and Docker checks passed
• Analyzer 31923025300: Go, JavaScript/TypeScript, Python, and Rust passed
• CodeQL 95106018361: passed

Scope and limitations

• Workflow-dispatch selector TOCTOU remains explicitly unresolved and is not claimed fixed.
• Live client build execution, runner output, and delivered-artifact evidence remain outside this change.
• MySQL/PostgreSQL migration and clean network-denied builds remain unverified.
• CodeRabbit was skipped because manual review is required for this OSS repository.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 747b655c-fdd0-4bf3-8631-80828870f257

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}