From 20eb3d444fd5111efaaa82fb6c1d0708204df057 Mon Sep 17 00:00:00 2001
From: GitHub Copilot Agent <github-actions[bot]@users.noreply.github.com>
Date: Wed, 18 Feb 2026 10:04:29 +0100
Subject: [PATCH 1/3] ci(release): stable-promotion und rc-retention
 fail-closed nachziehen

---
 .github/workflows/release-retention.yml   | 8 +++++++-
 docs/versioning/002_HISTORY_VERSIONS.MD   | 2 +-
 docs/versioning/003_CHANGELOG_RELEASES.MD | 5 ++++-
 docs/versioning/102_HISTORY_VERSIONS.MD   | 2 +-
 docs/versioning/103_CHANGELOG_RELEASES.MD | 5 ++++-
 tools/ci/release/retention_apply.sh       | 7 ++++++-
 6 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release-retention.yml b/.github/workflows/release-retention.yml
index 4ae1a57..04dcca8 100644
--- a/.github/workflows/release-retention.yml
+++ b/.github/workflows/release-retention.yml
@@ -11,6 +11,7 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
 
 jobs:
   retention:
@@ -28,6 +29,11 @@ jobs:
           dotnet-version: |
             8.0.x
             10.0.102
+      - name: NuGet login (OIDC / Trusted Publishing)
+        uses: NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544 # v1
+        id: nuget_login
+        with:
+          user: Tomtastisch
       - name: Apply retention (GH Releases + NuGet unlist + GH Packages delete)
         env:
           GH_TOKEN: ${{ github.token }}
@@ -35,7 +41,7 @@ jobs:
           OWNER: ${{ github.repository_owner }}
           PACKAGE_ID: Tomtastisch.FileClassifier
           NUGET_PACKAGE_ID: tomtastisch.fileclassifier
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
           OUT_DIR: artifacts/retention
         run: bash tools/ci/release/retention_apply.sh
       - name: Upload retention artifacts
diff --git a/docs/versioning/002_HISTORY_VERSIONS.MD b/docs/versioning/002_HISTORY_VERSIONS.MD
index 341b765..d5ce28f 100644
--- a/docs/versioning/002_HISTORY_VERSIONS.MD
+++ b/docs/versioning/002_HISTORY_VERSIONS.MD
@@ -12,7 +12,7 @@ Heuristik fuer die Rueckwirkungs-Zuordnung:
 - `docs|test|ci|chore|tooling|refactor|fix` => Patch
 
 Aktueller Entwicklungsstand:
-- Aktuelle Entwicklungslinie enthaelt `5.x` (aktueller Pre-Release-Stand: `v5.2.0-rc.6`, naechster stabiler Zielstand: `5.2.0`; Details in `docs/versioning/003_CHANGELOG_RELEASES.MD`).
+- Aktuelle Entwicklungslinie enthaelt `5.x` (aktueller stabiler Stand: `v5.2.0`; Details in `docs/versioning/003_CHANGELOG_RELEASES.MD`).
 
 Hinweis:
 - Die Spalte `Keyword` verwendet den technischen Klassifizierungswert aus der Historie.
diff --git a/docs/versioning/003_CHANGELOG_RELEASES.MD b/docs/versioning/003_CHANGELOG_RELEASES.MD
index f4f715d..4fb60c7 100644
--- a/docs/versioning/003_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/003_CHANGELOG_RELEASES.MD
@@ -7,12 +7,13 @@
 Alle Aenderungen werden hier technisch dokumentiert. Die Release-Version selbst ist
 der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
 
-## [Unreleased]
+## [5.2.0]
 - Added:
   - Incode-Dokumentation fuer die TFM-Providermethoden komplettiert (`HashPrimitivesProvider` fuer `netstandard2.0` und `net8.0+`).
   - Legacy-Office-Refinement (`LegacyOfficeBinaryRefiner`) fuer OLE2-Dokumente mit fail-closed Marker-Logik eingefuehrt.
   - Erweiterte E2E-Matrix-Tests fuer falsche Endungen, korrupte Payloads und Office/OpenDocument-Varianten ergänzt.
 - Changed:
+  - Release-Linie von `v5.2.0-rc.6` auf stabilen Tag `v5.2.0` gehoben.
   - Public XML-Dokumentation auf Policy-045 ausgerichtet: unzulaessige `<exception>`-Tags in fail-closed APIs entfernt.
   - Deutsche Log-/Dokumentationstexte mit korrekten Umlauten harmonisiert.
   - Office-/OpenOffice-Aliasauflösung im `FileTypeRegistry` konsolidiert (`doc/docx/odt`, `xls/xlsx/ods`, `ppt/pptx/odp`).
@@ -22,11 +23,13 @@ der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
     - laengeres Retry-Fenster,
     - `registration` standardmaessig entkoppelt bei `vX.Y.Z-<label>`,
     - weiterhin fail-closed auf `flatcontainer`.
+  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass nach vorhandenem Stable-Tag keine RC-Version mehr als Keep-Set erhalten bleibt.
 - Fixed:
   - Release-Blocker beseitigt, bei dem Pre-Release-Publish trotz erfolgreichem Push an verzögerter Registration-Sichtbarkeit scheiterte.
 - Docs/CI/Tooling:
   - NuGet-Trusted-Publishing-Doku (DE/EN) und Root-README auf den angepassten Gate-4-Ablauf aktualisiert.
   - Commit-Referenz fuer Version 5.2.0 in Versionshistorie (DE/EN) hinzugefuegt.
+  - Retention-Workflow auf OIDC-Key-Fallback (`NuGet/login`) fuer NuGet-Unlist umgestellt.
 
 ## [5.1.4]
 - Changed:
diff --git a/docs/versioning/102_HISTORY_VERSIONS.MD b/docs/versioning/102_HISTORY_VERSIONS.MD
index 839a413..4ae308a 100644
--- a/docs/versioning/102_HISTORY_VERSIONS.MD
+++ b/docs/versioning/102_HISTORY_VERSIONS.MD
@@ -12,7 +12,7 @@ Heuristics for retroactive classification:
 - `docs|test|ci|chore|tooling|refactor|fix` => patch
 
 Current state:
-- Current release line contains `5.x` (current pre-release state: `v5.2.0-rc.6`, next stable target: `5.2.0`; details in `docs/versioning/103_CHANGELOG_RELEASES.MD`).
+- Current release line contains `5.x` (current stable state: `v5.2.0`; details in `docs/versioning/103_CHANGELOG_RELEASES.MD`).
 
 Note:
 - The \"short description\" column follows the original commit/PR intent text for deterministic traceability and is not normalized to a single language.
diff --git a/docs/versioning/103_CHANGELOG_RELEASES.MD b/docs/versioning/103_CHANGELOG_RELEASES.MD
index 9f867a5..57efb2c 100644
--- a/docs/versioning/103_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/103_CHANGELOG_RELEASES.MD
@@ -6,12 +6,13 @@
 
 All changes are documented here in technical terms. The release version itself is the Git tag `vX.Y.Z` (optional `-prerelease`) as SSOT.
 
-## [Unreleased]
+## [5.2.0]
 - Added:
   - Completed in-code documentation for TFM provider methods (`HashPrimitivesProvider` for `netstandard2.0` and `net8.0+`).
   - Added legacy Office refinement (`LegacyOfficeBinaryRefiner`) for OLE2 documents with fail-closed marker logic.
   - Added extended E2E matrix tests for wrong extensions, corrupted payloads, and Office/OpenDocument variants.
 - Changed:
+  - Promoted the release line from `v5.2.0-rc.6` to the stable tag `v5.2.0`.
   - Aligned public XML docs with Policy 045 by removing invalid `<exception>` tags from fail-closed APIs.
   - Harmonized German log/doc strings to use proper umlauts.
   - Consolidated Office/OpenOffice alias resolution in `FileTypeRegistry` (`doc/docx/odt`, `xls/xlsx/ods`, `ppt/pptx/odp`).
@@ -21,11 +22,13 @@ All changes are documented here in technical terms. The release version itself i
     - longer retry window,
     - `registration` decoupled by default for `vX.Y.Z-<label>`,
     - still fail-closed on `flatcontainer`.
+  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RC versions are no longer kept once a stable tag exists.
 - Fixed:
   - Resolved release blocker where pre-release publishing failed due delayed registration visibility despite successful push.
 - Docs/CI/Tooling:
   - Updated NuGet trusted-publishing docs (DE/EN) and root README for the adjusted Gate 4 behavior.
   - Added commit reference for version 5.2.0 in version history (DE/EN).
+  - Switched retention workflow to OIDC key fallback (`NuGet/login`) for NuGet unlist operations.
 
 ## [5.1.4]
 - Changed:
diff --git a/tools/ci/release/retention_apply.sh b/tools/ci/release/retention_apply.sh
index 636586d..0f3228e 100755
--- a/tools/ci/release/retention_apply.sh
+++ b/tools/ci/release/retention_apply.sh
@@ -50,7 +50,12 @@ declare -A KEEP_TAGS=()
 [[ -n "${LATEST_STABLE}" ]] && KEEP_TAGS["${LATEST_STABLE}"]=1
 [[ -n "${PREV_STABLE}" ]] && KEEP_TAGS["${PREV_STABLE}"]=1
 [[ -n "${BASELINE}" ]] && KEEP_TAGS["${BASELINE}"]=1
-[[ -n "${LATEST_RC}" ]] && KEEP_TAGS["${LATEST_RC}"]=1
+
+# Keep an RC only while there is no stable release yet.
+# After a stable tag exists, all RCs are subject to retention cleanup.
+if [[ -z "${LATEST_STABLE}" && -n "${LATEST_RC}" ]]; then
+  KEEP_TAGS["${LATEST_RC}"]=1
+fi
 
 # GH releases actions
 mapfile -t RELEASE_ROWS < <(gh api "/repos/${REPO}/releases" --paginate | jq -r '.[] | [.id, .tag_name] | @tsv')

From 79018883c91847bf6ddadf450e00506647cbbc05 Mon Sep 17 00:00:00 2001
From: GitHub Copilot Agent <github-actions[bot]@users.noreply.github.com>
Date: Wed, 18 Feb 2026 10:10:35 +0100
Subject: [PATCH 2/3] fix(release): rc-retention nur fuer hoehere naechste
 version behalten

---
 docs/versioning/003_CHANGELOG_RELEASES.MD |  2 +-
 docs/versioning/103_CHANGELOG_RELEASES.MD |  2 +-
 tools/ci/release/retention_apply.sh       | 13 +++++++++----
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/docs/versioning/003_CHANGELOG_RELEASES.MD b/docs/versioning/003_CHANGELOG_RELEASES.MD
index 4fb60c7..f7ba95f 100644
--- a/docs/versioning/003_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/003_CHANGELOG_RELEASES.MD
@@ -23,7 +23,7 @@ der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
     - laengeres Retry-Fenster,
     - `registration` standardmaessig entkoppelt bei `vX.Y.Z-<label>`,
     - weiterhin fail-closed auf `flatcontainer`.
-  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass nach vorhandenem Stable-Tag keine RC-Version mehr als Keep-Set erhalten bleibt.
+  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass RCs der bereits stabil veroeffentlichten Basisversion bereinigt werden, waehrend der neueste RC einer hoeheren naechsten Version erhalten bleibt.
 - Fixed:
   - Release-Blocker beseitigt, bei dem Pre-Release-Publish trotz erfolgreichem Push an verzögerter Registration-Sichtbarkeit scheiterte.
 - Docs/CI/Tooling:
diff --git a/docs/versioning/103_CHANGELOG_RELEASES.MD b/docs/versioning/103_CHANGELOG_RELEASES.MD
index 57efb2c..8460d6d 100644
--- a/docs/versioning/103_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/103_CHANGELOG_RELEASES.MD
@@ -22,7 +22,7 @@ All changes are documented here in technical terms. The release version itself i
     - longer retry window,
     - `registration` decoupled by default for `vX.Y.Z-<label>`,
     - still fail-closed on `flatcontainer`.
-  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RC versions are no longer kept once a stable tag exists.
+  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RCs for an already released stable base version are cleaned up, while the latest RC of a higher upcoming version is kept.
 - Fixed:
   - Resolved release blocker where pre-release publishing failed due delayed registration visibility despite successful push.
 - Docs/CI/Tooling:
diff --git a/tools/ci/release/retention_apply.sh b/tools/ci/release/retention_apply.sh
index 0f3228e..491e17b 100755
--- a/tools/ci/release/retention_apply.sh
+++ b/tools/ci/release/retention_apply.sh
@@ -51,10 +51,15 @@ declare -A KEEP_TAGS=()
 [[ -n "${PREV_STABLE}" ]] && KEEP_TAGS["${PREV_STABLE}"]=1
 [[ -n "${BASELINE}" ]] && KEEP_TAGS["${BASELINE}"]=1
 
-# Keep an RC only while there is no stable release yet.
-# After a stable tag exists, all RCs are subject to retention cleanup.
-if [[ -z "${LATEST_STABLE}" && -n "${LATEST_RC}" ]]; then
-  KEEP_TAGS["${LATEST_RC}"]=1
+# Keep the latest RC when it belongs to a newer version line than the latest stable.
+# RCs that match an already published stable version line are subject to cleanup.
+if [[ -n "${LATEST_RC}" ]]; then
+  latest_rc_core="${LATEST_RC%%-rc.*}"
+  if [[ -z "${LATEST_STABLE}" ]]; then
+    KEEP_TAGS["${LATEST_RC}"]=1
+  elif [[ "${latest_rc_core#v}" != "${LATEST_STABLE#v}" ]] && [[ "$(printf '%s\n%s\n' "${LATEST_STABLE#v}" "${latest_rc_core#v}" | sort -V | tail -n1)" == "${latest_rc_core#v}" ]]; then
+    KEEP_TAGS["${LATEST_RC}"]=1
+  fi
 fi
 
 # GH releases actions

From 4f19738d60873885dab082500e97d1e83b389f6c Mon Sep 17 00:00:00 2001
From: GitHub Copilot Agent <github-actions[bot]@users.noreply.github.com>
Date: Wed, 18 Feb 2026 10:16:02 +0100
Subject: [PATCH 3/3] fix(release): rc-keep an korrespondierenden stable-tag
 koppeln

---
 docs/versioning/003_CHANGELOG_RELEASES.MD | 2 +-
 docs/versioning/103_CHANGELOG_RELEASES.MD | 2 +-
 tools/ci/release/retention_apply.sh       | 6 ++----
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/docs/versioning/003_CHANGELOG_RELEASES.MD b/docs/versioning/003_CHANGELOG_RELEASES.MD
index f7ba95f..d55231e 100644
--- a/docs/versioning/003_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/003_CHANGELOG_RELEASES.MD
@@ -23,7 +23,7 @@ der Git-Tag `vX.Y.Z` (optional `-prerelease`) als SSOT.
     - laengeres Retry-Fenster,
     - `registration` standardmaessig entkoppelt bei `vX.Y.Z-<label>`,
     - weiterhin fail-closed auf `flatcontainer`.
-  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass RCs der bereits stabil veroeffentlichten Basisversion bereinigt werden, waehrend der neueste RC einer hoeheren naechsten Version erhalten bleibt.
+  - Release-Retention (`tools/ci/release/retention_apply.sh`) so angepasst, dass nach vorhandenem korrespondierendem Stable-Tag `vX.Y.Z` die RCs derselben Basisversion bereinigt werden (konkret: Promotion `v5.2.0-rc.6` -> `v5.2.0`), waehrend ein RC ohne korrespondierenden Stable-Tag erhalten bleibt.
 - Fixed:
   - Release-Blocker beseitigt, bei dem Pre-Release-Publish trotz erfolgreichem Push an verzögerter Registration-Sichtbarkeit scheiterte.
 - Docs/CI/Tooling:
diff --git a/docs/versioning/103_CHANGELOG_RELEASES.MD b/docs/versioning/103_CHANGELOG_RELEASES.MD
index 8460d6d..679d547 100644
--- a/docs/versioning/103_CHANGELOG_RELEASES.MD
+++ b/docs/versioning/103_CHANGELOG_RELEASES.MD
@@ -22,7 +22,7 @@ All changes are documented here in technical terms. The release version itself i
     - longer retry window,
     - `registration` decoupled by default for `vX.Y.Z-<label>`,
     - still fail-closed on `flatcontainer`.
-  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RCs for an already released stable base version are cleaned up, while the latest RC of a higher upcoming version is kept.
+  - Updated release retention (`tools/ci/release/retention_apply.sh`) so RCs are cleaned up once the corresponding stable tag `vX.Y.Z` exists (for example `v5.2.0-rc.6` -> `v5.2.0`), while an RC without a corresponding stable tag is kept.
 - Fixed:
   - Resolved release blocker where pre-release publishing failed due delayed registration visibility despite successful push.
 - Docs/CI/Tooling:
diff --git a/tools/ci/release/retention_apply.sh b/tools/ci/release/retention_apply.sh
index 491e17b..0b08acc 100755
--- a/tools/ci/release/retention_apply.sh
+++ b/tools/ci/release/retention_apply.sh
@@ -51,13 +51,11 @@ declare -A KEEP_TAGS=()
 [[ -n "${PREV_STABLE}" ]] && KEEP_TAGS["${PREV_STABLE}"]=1
 [[ -n "${BASELINE}" ]] && KEEP_TAGS["${BASELINE}"]=1
 
-# Keep the latest RC when it belongs to a newer version line than the latest stable.
+# Keep the latest RC until the corresponding stable tag (same X.Y.Z) exists.
 # RCs that match an already published stable version line are subject to cleanup.
 if [[ -n "${LATEST_RC}" ]]; then
   latest_rc_core="${LATEST_RC%%-rc.*}"
-  if [[ -z "${LATEST_STABLE}" ]]; then
-    KEEP_TAGS["${LATEST_RC}"]=1
-  elif [[ "${latest_rc_core#v}" != "${LATEST_STABLE#v}" ]] && [[ "$(printf '%s\n%s\n' "${LATEST_STABLE#v}" "${latest_rc_core#v}" | sort -V | tail -n1)" == "${latest_rc_core#v}" ]]; then
+  if ! printf '%s\n' "${STABLE_TAGS[@]}" | grep -xF "${latest_rc_core}" >/dev/null 2>&1; then
     KEEP_TAGS["${LATEST_RC}"]=1
   fi
 fi