laurenspriem · Aug 19, 2026 · Aug 19, 2026 · Aug 19, 2026 · Aug 19, 2026
diff --git a/.github/workflows/release.yml → .github/workflows/build.yml b/.github/workflows/release.yml → .github/workflows/build.yml
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -0,0 +1,154 @@
+name: Publish release
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_run_id:
+        description: Successful Build release candidate run ID
+        required: true
+
+concurrency:
+  group: ort-publish
+  cancel-in-progress: false
+
+permissions:
+  actions: read
+  contents: write
+
+jobs:
+  publish:
+    name: Publish verified candidate
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Validate build run
+        id: build
+        env:
+          BUILD_RUN_ID: ${{ inputs.build_run_id }}
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_REF" == refs/heads/main ]] || {
+            echo "releases may only publish from main; found $GITHUB_REF" >&2
+            exit 1
+          }
+          [[ "$BUILD_RUN_ID" =~ ^[1-9][0-9]*$ ]] || {
+            echo "build run ID must be a positive integer" >&2
+            exit 1
+          }
+
+          run="$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$BUILD_RUN_ID")"
+          jq --exit-status \
+            --arg repository "$GITHUB_REPOSITORY" '
+              .event == "workflow_dispatch" and
+              .status == "completed" and
+              .conclusion == "success" and
+              .head_branch == "main" and
+              .path == ".github/workflows/build.yml" and
+              .head_repository.full_name == $repository and
+              (.head_sha | test("^[0-9a-f]{40}$")) and
+              (.run_attempt | type) == "number" and
+              .run_attempt >= 1
+            ' <<<"$run" >/dev/null || {
+              echo "run $BUILD_RUN_ID is not a successful main-branch release-candidate build" >&2
+              exit 1
+            }
+
+          echo "commit=$(jq -r .head_sha <<<"$run")" >> "$GITHUB_OUTPUT"
+          echo "attempt=$(jq -r .run_attempt <<<"$run")" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Verify build commit belongs to main
+        env:
+          BUILD_COMMIT: ${{ steps.build.outputs.commit }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git cat-file -e "$BUILD_COMMIT^{commit}"
+          git merge-base --is-ancestor "$BUILD_COMMIT" origin/main
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-candidate
+          path: ${{ runner.temp }}/release-candidate
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ inputs.build_run_id }}
+          digest-mismatch: error
+
+      - name: Verify release candidate
+        id: candidate
+        env:
+          BUILD_COMMIT: ${{ steps.build.outputs.commit }}
+          BUILD_RUN_ATTEMPT: ${{ steps.build.outputs.attempt }}
+          BUILD_RUN_ID: ${{ inputs.build_run_id }}
+          CANDIDATE_DIR: ${{ runner.temp }}/release-candidate
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash scripts/verify-release-candidate.sh \
+            "$CANDIDATE_DIR" "$BUILD_RUN_ID" "$BUILD_RUN_ATTEMPT" "$BUILD_COMMIT" \
+            >> "$GITHUB_OUTPUT"
+
+          resolved="$(mktemp)"
+          bash scripts/resolve-release.sh \
+            "$(jq -r .upstream_ort_version "$CANDIDATE_DIR/build-provenance.json")" \
+            "$(jq -r .package_revision "$CANDIDATE_DIR/build-provenance.json")" \
+            > "$resolved"
+          grep -Fqx "ort_commit=$(jq -r .upstream_ort_commit "$CANDIDATE_DIR/build-provenance.json")" "$resolved"
+
+      - name: Determine latest-release status
+        id: latest
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ORT_VERSION: ${{ steps.candidate.outputs.ort_version }}
+          PACKAGE_REVISION: ${{ steps.candidate.outputs.package_revision }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          current="$ORT_VERSION-r$PACKAGE_REVISION"
+          highest="$(
+            gh api --paginate "repos/$GITHUB_REPOSITORY/releases" \
+              --jq '.[] | select(.draft == false and .prerelease == false) | .tag_name' |
+              sed -nE 's/^ort-([0-9]+\.[0-9]+\.[0-9]+-r[1-9][0-9]*)$/\1/p' |
+              sort -V |
+              tail -1
+          )"
+          latest=false
+          if [ -z "$highest" ] || [ "$(printf '%s\n%s\n' "$highest" "$current" | sort -V | tail -1)" = "$current" ]; then
+            latest=true
+          fi
+          echo "latest=$latest" >> "$GITHUB_OUTPUT"
+
+      - name: Publish immutable GitHub release
+        env:
+          BUILD_COMMIT: ${{ steps.candidate.outputs.packaging_commit }}
+          CANDIDATE_DIR: ${{ runner.temp }}/release-candidate
+          GH_TOKEN: ${{ github.token }}
+          LATEST: ${{ steps.latest.outputs.latest }}
+          RELEASE_TAG: ${{ steps.candidate.outputs.release_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          latest_flag=--latest=false
+          if [ "$LATEST" = true ]; then latest_flag=--latest; fi
+          notes="$(mktemp)"
+          jq -r .release_notes "$CANDIDATE_DIR/build-provenance.json" > "$notes"
+
+          [ -z "$(git ls-remote "https://github.com/$GITHUB_REPOSITORY.git" "refs/tags/$RELEASE_TAG")" ] || {
+            echo "tag $RELEASE_TAG already exists" >&2
+            exit 1
+          }
+          gh release create "$RELEASE_TAG" "$CANDIDATE_DIR"/* \
+            --target "$BUILD_COMMIT" \
+            --title "$RELEASE_TAG" \
+            --notes-file "$notes" \
+            "$latest_flag"
+
+          gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" \
+            --jq 'if .draft == false and .prerelease == false and .immutable == true and (.assets | length) == 35 then empty else error("published release is not immutable or has the wrong asset count") end'
+          [ "$(git ls-remote "https://github.com/$GITHUB_REPOSITORY.git" "refs/tags/$RELEASE_TAG" | awk '{ print $1 }')" = "$BUILD_COMMIT" ]
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -24,28 +24,9 @@ jobs:
           shellcheck -x -P scripts scripts/*.sh
           for script in scripts/*.sh; do bash -n "$script"; done
           jq --exit-status . config/*.json >/dev/null
-          source versions.env
+          source build.env
           [ "$ORT_TELEMETRY" = disabled ]
           jq --exit-status ".build_params | index(\"--no_telemetry\") != null" config/android-webgpu.json >/dev/null
           jq --exit-status ".build_params.base | index(\"--no_telemetry\") != null" config/ios-coreml.json >/dev/null
           # shellcheck disable=SC2016
           pwsh -NoProfile -Command '$errors = $null; Get-ChildItem scripts/*.ps1 | ForEach-Object { [System.Management.Automation.Language.Parser]::ParseFile($_.FullName, [ref]$null, [ref]$errors) | Out-Null }; if ($errors.Count) { $errors | Format-List; exit 1 }'
-
-      - name: Verify pinned ONNX Runtime patches
-        shell: bash
-        run: |
-          set -euo pipefail
-          git clone --depth 1 --branch "$(. versions.env; printf '%s' "$ORT_REF")" \
-            https://github.com/microsoft/onnxruntime.git "$RUNNER_TEMP/onnxruntime"
-          for patch in "$GITHUB_WORKSPACE"/patches/*.patch; do
-            git -C "$RUNNER_TEMP/onnxruntime" apply --check "$patch"
-            git -C "$RUNNER_TEMP/onnxruntime" apply "$patch"
-          done
-
-      - name: Compile portable runtime smoke test
-        shell: bash
-        run: |
-          set -euo pipefail
-          cmake -S tests -B "$RUNNER_TEMP/runtime-smoke" \
-            -DORT_INCLUDE_DIR="$RUNNER_TEMP/onnxruntime/include/onnxruntime/core/session"
-          cmake --build "$RUNNER_TEMP/runtime-smoke" --parallel
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/PATCHES.md b/PATCHES.md
@@ -1,6 +1,6 @@
 # Upstream patch inventory
 
-Every patch in `patches/` is applied to the exact upstream tag in `versions.env` by both CI validation and platform builds. Revalidate each patch when changing the upstream ONNX Runtime version.
+Every patch in `patches/` is applied to the exact upstream commit resolved by the release-candidate workflow. Its preflight job verifies the patches and compiles the portable smoke test against the requested ONNX Runtime release before any platform build starts.
 
 ## `onnxruntime-coreml-runtime-availability.patch`
 
@@ -12,8 +12,8 @@ This patch makes CoreML availability explicit at runtime for the APIs that are n
 
 Instead of relying on an unguarded availability call, the runtime returns a descriptive ONNX Runtime error on an older OS. The patch also propagates that error from model loading. It is required to support the documented iOS 15.1 deployment target safely.
 
-Remove this patch only when the selected upstream ONNX Runtime version contains equivalent runtime guards. The release workflow rejects builds that emit unguarded-availability warnings, and `Validate` checks that the patch still applies cleanly.
+Remove this patch only when the selected upstream ONNX Runtime version contains equivalent runtime guards. Apple platform builds reject unguarded-availability warnings, and the release-candidate preflight checks that the patch still applies cleanly to the requested upstream version.
 
 ## `onnxruntime-public-vcpkg.patch`
 
-This existing build-system patch keeps the required vcpkg integration reviewable and reproducible for the pinned upstream source. Its applicability is likewise checked by `Validate` before any release is built.
+This existing build-system patch keeps the required vcpkg integration reviewable and reproducible for the resolved upstream source. Its applicability is likewise checked by the release-candidate preflight before any platform build starts.