release(versioning): stabile 5.2.0 aus rc6 ableiten (#93)

* ci(release): stable-promotion und rc-retention fail-closed nachziehen

* fix(release): rc-retention nur fuer hoehere naechste version behalten

* fix(release): rc-keep an korrespondierenden stable-tag koppeln

---------

Co-authored-by: GitHub Copilot Agent <github-actions[bot]@users.noreply.github.com>

Author: tomtastisch

.github/workflows/release-retention.yml

@@ -11,6 +11,7 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
 
 jobs:
   retention:
@@ -28,14 +29,19 @@ jobs:
           dotnet-version: |
             8.0.x
             10.0.102
+      - name: NuGet login (OIDC / Trusted Publishing)
+        uses: NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544 # v1
+        id: nuget_login
+        with:
+          user: Tomtastisch
       - name: Apply retention (GH Releases + NuGet unlist + GH Packages delete)
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           OWNER: ${{ github.repository_owner }}
           PACKAGE_ID: Tomtastisch.FileClassifier
           NUGET_PACKAGE_ID: tomtastisch.fileclassifier
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
           OUT_DIR: artifacts/retention
         run: bash tools/ci/release/retention_apply.sh
       - name: Upload retention artifacts

docs/versioning/002_HISTORY_VERSIONS.MD

@@ -12,7 +12,7 @@ Heuristik fuer die Rueckwirkungs-Zuordnung:
 - `docs|test|ci|chore|tooling|refactor|fix` => Patch
 
 Aktueller Entwicklungsstand:
-- Aktuelle Entwicklungslinie enthaelt `5.x` (aktueller Pre-Release-Stand: `v5.2.0-rc.6`, naechster stabiler Zielstand: `5.2.0`; Details in `docs/versioning/003_CHANGELOG_RELEASES.MD`).
+- Aktuelle Entwicklungslinie enthaelt `5.x` (aktueller stabiler Stand: `v5.2.0`; Details in `docs/versioning/003_CHANGELOG_RELEASES.MD`).
 
 Hinweis:
 - Die Spalte `Keyword` verwendet den technischen Klassifizierungswert aus der Historie.

docs/versioning/003_CHANGELOG_RELEASES.MD

@@ -7,12 +7,13 @@
 Alle Aenderungen werden hier technisch dokumentiert. Die Release-Version selbst ist
 der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
 
-## [Unreleased]
+## [5.2.0]
 - Added:
   - Incode-Dokumentation fuer die TFM-Providermethoden komplettiert (`HashPrimitivesProvider` fuer `netstandard2.0` und `net8.0+`).
   - Legacy-Office-Refinement (`LegacyOfficeBinaryRefiner`) fuer OLE2-Dokumente mit fail-closed Marker-Logik eingefuehrt.
   - Erweiterte E2E-Matrix-Tests fuer falsche Endungen, korrupte Payloads und Office/OpenDocument-Varianten ergänzt.
 - Changed:
+  - Release-Linie von `v5.2.0-rc.6` auf stabilen Tag `v5.2.0` gehoben.
   - Public XML-Dokumentation auf Policy-045 ausgerichtet: unzulaessige `<exception>`-Tags in fail-closed APIs entfernt.
   - Deutsche Log-/Dokumentationstexte mit korrekten Umlauten harmonisiert.
   - Office-/OpenOffice-Aliasauflösung im `FileTypeRegistry` konsolidiert (`doc/docx/odt`, `xls/xlsx/ods`, `ppt/pptx/odp`).
@@ -22,11 +23,13 @@ der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
     - laengeres Retry-Fenster,
     - `registration` standardmaessig entkoppelt bei `vX.Y.Z-<label>`,
     - weiterhin fail-closed auf `flatcontainer`.
+  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass nach vorhandenem korrespondierendem Stable-Tag `vX.Y.Z` die RCs derselben Basisversion bereinigt werden (konkret: Promotion `v5.2.0-rc.6` -> `v5.2.0`), waehrend ein RC ohne korrespondierenden Stable-Tag erhalten bleibt.
 - Fixed:
   - Release-Blocker beseitigt, bei dem Pre-Release-Publish trotz erfolgreichem Push an verzögerter Registration-Sichtbarkeit scheiterte.
 - Docs/CI/Tooling:
   - NuGet-Trusted-Publishing-Doku (DE/EN) und Root-README auf den angepassten Gate-4-Ablauf aktualisiert.
   - Commit-Referenz fuer Version 5.2.0 in Versionshistorie (DE/EN) hinzugefuegt.
+  - Retention-Workflow auf OIDC-Key-Fallback (`NuGet/login`) fuer NuGet-Unlist umgestellt.
 
 ## [5.1.4]
 - Changed:

docs/versioning/102_HISTORY_VERSIONS.MD

@@ -12,7 +12,7 @@ Heuristics for retroactive classification:
 - `docs|test|ci|chore|tooling|refactor|fix` => patch
 
 Current state:
-- Current release line contains `5.x` (current pre-release state: `v5.2.0-rc.6`, next stable target: `5.2.0`; details in `docs/versioning/103_CHANGELOG_RELEASES.MD`).
+- Current release line contains `5.x` (current stable state: `v5.2.0`; details in `docs/versioning/103_CHANGELOG_RELEASES.MD`).
 
 Note:
 - The \"short description\" column follows the original commit/PR intent text for deterministic traceability and is not normalized to a single language.

docs/versioning/103_CHANGELOG_RELEASES.MD

@@ -6,12 +6,13 @@
 
 All changes are documented here in technical terms. The release version itself is the Git tag `vX.Y.Z` (optional `-prerelease`) as SSOT.
 
-## [Unreleased]
+## [5.2.0]
 - Added:
   - Completed in-code documentation for TFM provider methods (`HashPrimitivesProvider` for `netstandard2.0` and `net8.0+`).
   - Added legacy Office refinement (`LegacyOfficeBinaryRefiner`) for OLE2 documents with fail-closed marker logic.
   - Added extended E2E matrix tests for wrong extensions, corrupted payloads, and Office/OpenDocument variants.
 - Changed:
+  - Promoted the release line from `v5.2.0-rc.6` to the stable tag `v5.2.0`.
   - Aligned public XML docs with Policy 045 by removing invalid `<exception>` tags from fail-closed APIs.
   - Harmonized German log/doc strings to use proper umlauts.
   - Consolidated Office/OpenOffice alias resolution in `FileTypeRegistry` (`doc/docx/odt`, `xls/xlsx/ods`, `ppt/pptx/odp`).
@@ -21,11 +22,13 @@ All changes are documented here in technical terms. The release version itself i
     - longer retry window,
     - `registration` decoupled by default for `vX.Y.Z-<label>`,
     - still fail-closed on `flatcontainer`.
+  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RCs are cleaned up once the corresponding stable tag `vX.Y.Z` exists (for example `v5.2.0-rc.6` -> `v5.2.0`), while an RC without a corresponding stable tag is kept.
 - Fixed:
   - Resolved release blocker where pre-release publishing failed due delayed registration visibility despite successful push.
 - Docs/CI/Tooling:
   - Updated NuGet trusted-publishing docs (DE/EN) and root README for the adjusted Gate 4 behavior.
   - Added commit reference for version 5.2.0 in version history (DE/EN).
+  - Switched retention workflow to OIDC key fallback (`NuGet/login`) for NuGet unlist operations.
 
 ## [5.1.4]
 - Changed:

tools/ci/release/retention_apply.sh

@@ -50,7 +50,15 @@ declare -A KEEP_TAGS=()
 [[ -n "${LATEST_STABLE}" ]] && KEEP_TAGS["${LATEST_STABLE}"]=1
 [[ -n "${PREV_STABLE}" ]] && KEEP_TAGS["${PREV_STABLE}"]=1
 [[ -n "${BASELINE}" ]] && KEEP_TAGS["${BASELINE}"]=1
-[[ -n "${LATEST_RC}" ]] && KEEP_TAGS["${LATEST_RC}"]=1
+
+# Keep the latest RC until the corresponding stable tag (same X.Y.Z) exists.
+# RCs that match an already published stable version line are subject to cleanup.
+if [[ -n "${LATEST_RC}" ]]; then
+  latest_rc_core="${LATEST_RC%%-rc.*}"
+  if ! printf '%s\n' "${STABLE_TAGS[@]}" | grep -xF "${latest_rc_core}" >/dev/null 2>&1; then
+    KEEP_TAGS["${LATEST_RC}"]=1
+  fi
+fi
 
 # GH releases actions
 mapfile -t RELEASE_ROWS < <(gh api "/repos/${REPO}/releases" --paginate | jq -r '.[] | [.id, .tag_name] | @tsv')