Samsung · Redth · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 27, 2026
diff --git a/.github/workflows/build-matrix.yml b/.github/workflows/build-matrix.yml
@@ -17,13 +17,15 @@ on:
     branches:
     - main
     - net10.0
+    - net11.0
     paths:
     - 'workload/**'
     - '.github/workflows/build-matrix.yml'
   pull_request:
     branches:
     - main
     - net10.0
+    - net11.0
     paths:
     - 'workload/**'
     - '.github/workflows/build-matrix.yml'
@@ -37,9 +39,22 @@ jobs:
   validate-metadata:
     name: Validate workload metadata
     runs-on: ubuntu-22.04
+    outputs:
+      net11_sdk: ${{ steps.versions.outputs.net11_sdk }}
     steps:
     - uses: actions/checkout@v3
 
+    - name: Resolve .NET 11 SDK version from Versions.props
+      id: versions
+      run: |
+        NET11=$(grep -oP '(?<=<DotNet11SdkVersion>)[^<]+' workload/build/Versions.props)
+        if [ -z "$NET11" ]; then
+          echo "::error::DotNet11SdkVersion not found in workload/build/Versions.props"
+          exit 1
+        fi
+        echo "net11_sdk=$NET11" >> "$GITHUB_OUTPUT"
+        echo "::notice ::.NET 11 SDK for CI: $NET11"
+
     - name: Authenticate GitHub Packages NuGet source
       run: |
         dotnet nuget update source github \
@@ -51,10 +66,45 @@ jobs:
     - name: Run validate-workload-metadata.py
       run: python3 workload/scripts/validate-workload-metadata.py
 
+    - name: Run test-matrix.sh --self-test
+      run: bash workload/scripts/test-matrix.sh --self-test
+
+    - name: Run test-version-band.sh
+      run: bash workload/scripts/test-version-band.sh
+
+    - name: Run test-template-conditions.sh
+      run: bash workload/scripts/test-template-conditions.sh
+
+    - name: Run test-package-fallback.sh
+      run: bash workload/scripts/test-package-fallback.sh
+
+    - name: Run test-release-workflow.sh
+      run: bash workload/scripts/test-release-workflow.sh
+
+    - name: Run test-install-failure.sh
+      run: bash workload/scripts/test-install-failure.sh
+
   test-matrix:
-    name: Multi-TFM build matrix
+    name: Multi-TFM build matrix (${{ matrix.name }})
     needs: validate-metadata
     runs-on: ubuntu-22.04
+    # The .NET 11 leg BLOCKS by default. The SDK version is pinned exactly
+    # (DotNet11SdkVersion), so the leg is deterministic - and a branch whose purpose is
+    # .NET 11 support gains nothing from an advisory-only .NET 11 gate.
+    #
+    # Set the repository variable TIZEN_NET11_ADVISORY=true to temporarily downgrade it,
+    # e.g. while chasing an upstream preview-SDK regression.
+    continue-on-error: ${{ matrix.experimental && vars.TIZEN_NET11_ADVISORY == 'true' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: .NET 10
+            dotnet_version: ''
+            experimental: false
+          - name: .NET 11 preview
+            dotnet_version: ${{ needs.validate-metadata.outputs.net11_sdk }}
+            experimental: true
     steps:
     - uses: actions/checkout@v3
       with:
@@ -71,14 +121,15 @@ jobs:
     - name: Run make test-matrix
       env:
         PULLREQUEST_ID: ${{ github.event.number }}
+        DOTNET_VERSION: ${{ matrix.dotnet_version }}
       working-directory: ./workload
       run: make test-matrix
 
     - name: Upload matrix logs on failure
       if: failure()
       uses: actions/upload-artifact@v4
       with:
-        name: test-matrix-logs
+        name: test-matrix-logs-${{ matrix.name }}
         path: |
           workload/.tmp/matrix/**/build.log
           workload/.tmp/matrix/**/dotnet-new.log

diff --git a/.github/workflows/build-workload.yml b/.github/workflows/build-workload.yml
@@ -5,13 +5,15 @@ on:
     branches:
     - main
     - net10.0
+    - net11.0
     paths:
     - 'workload/**'
     - '.github/workflows/**'
   pull_request:
     branches:
     - main
     - net10.0
+    - net11.0
     paths:
     - 'workload/**'
     - '.github/workflows/**'
@@ -41,10 +43,31 @@ jobs:
           --store-password-in-clear-text \
           --configfile workload/NuGet.config
 
+    # On a net11.0 branch (or a PR into one) .NET 11 is the product being built, so the
+    # workload must be built against the .NET 11 SDK rather than the Versions.props
+    # default. DotNet11SdkVersion in Versions.props is the single source of truth.
+    - name: Select target SDK band
+      id: sdk
+      run: |
+        TARGET_BRANCH="${{ github.base_ref || github.ref_name }}"
+        if [ "$TARGET_BRANCH" = "net11.0" ]; then
+          NET11=$(grep -oP '(?<=<DotNet11SdkVersion>)[^<]+' workload/build/Versions.props)
+          if [ -z "$NET11" ]; then
+            echo "::error::DotNet11SdkVersion not found in workload/build/Versions.props"
+            exit 1
+          fi
+          echo "dotnet_version=$NET11" >> "$GITHUB_OUTPUT"
+          echo "::notice ::Branch '$TARGET_BRANCH' builds against .NET 11 SDK $NET11"
+        else
+          echo "dotnet_version=" >> "$GITHUB_OUTPUT"
+          echo "::notice ::Branch '$TARGET_BRANCH' builds against the Versions.props default SDK band"
+        fi
+
     - name: Build
       env:
         PULLREQUEST_ID: ${{ github.event.number }}
         PRERELEASE_TAG: ${{ github.event.inputs.prerelease }}
+        DOTNET_VERSION: ${{ steps.sdk.outputs.dotnet_version }}
       run: make test
       working-directory: ./workload
 

diff --git a/.github/workflows/release-workload.yml b/.github/workflows/release-workload.yml
@@ -37,53 +37,144 @@ jobs:
           --store-password-in-clear-text \
           --configfile workload/NuGet.config
 
-    - name: Bump TizenWorkloadVersion (global sequential, NuGet-derived)
+    # Resolve the version to release.
+    #
+    # Two properties matter here:
+    #  * A reference-only run (release_manifest=false) publishes no manifest, so it must be
+    #    completely NON-MUTATING - no bump, no commit, no tag.
+    #  * OLD == NEW is NOT necessarily an error. next-workload-version.py derives the next
+    #    version from what is published on NuGet, so if a previous run already bumped and
+    #    pushed but failed before publishing, the branch legitimately carries the intended
+    #    (still unpublished) version. That case must RESUME, not abort - otherwise a failed
+    #    release can never be retried.
+    - name: Resolve release version
       id: bump
       working-directory: ./workload
       run: |
-        set -e
+        set -euo pipefail
         OLD=$(grep -oP '(?<=<TizenWorkloadVersion>)[^<]+(?=</TizenWorkloadVersion>)' build/Versions.props)
         NEW=$(python3 scripts/next-workload-version.py)
         echo "Current: $OLD"
         echo "Next:    $NEW"
+
+        if [ "${{ github.event.inputs.release_manifest }}" != "true" ]; then
+          echo "::notice ::Reference-only run: leaving TizenWorkloadVersion at $OLD (non-mutating)."
+          echo "workload_version=$OLD" >> "$GITHUB_OUTPUT"
+          echo "mutated=false" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
         if [ "$OLD" = "$NEW" ]; then
-            echo "ERROR: computed next == current. NuGet already has this version published."
-            exit 1
+          # The branch already holds the version NuGet does not have yet: resume it.
+          echo "::notice ::Resuming release of $OLD (already set on this branch, not yet published)."
+          echo "workload_version=$OLD" >> "$GITHUB_OUTPUT"
+          echo "mutated=false" >> "$GITHUB_OUTPUT"
+          exit 0
         fi
+
         python3 scripts/next-workload-version.py --apply --verbose
         echo "workload_version=$NEW" >> "$GITHUB_OUTPUT"
+        echo "mutated=true" >> "$GITHUB_OUTPUT"
         echo "::notice ::Bumped TizenWorkloadVersion: $OLD -> $NEW"
 
     - name: Install Wix toolset
       run: sudo apt-get install -y wixl
 
+    # A release must never publish a half-built or stale set of packages. The tree is
+    # cleaned first so the output directory can only contain this run's artifacts, and
+    # the build is NOT continue-on-error: a failed build must abort the release.
+    - name: Clean previous output
+      run: make clean
+      working-directory: ./workload
+
     - name: Build
       env:
         PRERELEASE_TAG: "stable"
       run: make install -d DOTNET_VERSION=${{ github.event.inputs.net_sdk_version }}
       working-directory: ./workload
-      continue-on-error: true
+
+    # Stage into an isolated directory and verify the expected artifacts exist, so the
+    # push steps operate on an explicit, audited list rather than a glob over whatever
+    # happens to be on disk.
+    - name: Stage and verify packages
+      id: stage
+      run: |
+        set -euo pipefail
+        STAGING="$RUNNER_TEMP/staging"
+        rm -rf "$STAGING" && mkdir -p "$STAGING"
+        shopt -s nullglob
+        pkgs=(./workload/out/nuget-unsigned/*.nupkg)
+        if [ ${#pkgs[@]} -eq 0 ]; then
+          echo "::error::Build produced no packages."
+          exit 1
+        fi
+        cp "${pkgs[@]}" "$STAGING/"
+        SDK="${{ github.event.inputs.net_sdk_version }}"
+        # Reuse the band function from workload-install.sh so the release cannot
+        # disagree with what the installer will look for.
+        eval "$(sed -n '/# BEGIN VERSION BAND DETECTION/,/# END VERSION BAND DETECTION/p' workload/scripts/workload-install.sh)"
+        BAND="$(compute_target_version_band "$SDK")"
+        echo "Resolved SDK feature band: $BAND"
+        if ! ls "$STAGING/Samsung.NET.Sdk.Tizen.Manifest-$BAND."*.nupkg >/dev/null 2>&1; then
+          echo "::error::No Samsung.NET.Sdk.Tizen.Manifest-$BAND package was produced."
+          ls -1 "$STAGING"
+          exit 1
+        fi
+        MANIFEST_PKG="$(basename "$(ls "$STAGING/Samsung.NET.Sdk.Tizen.Manifest-$BAND."*.nupkg | head -1)")"
+        echo "staging=$STAGING" >> "$GITHUB_OUTPUT"
+        echo "band=$BAND" >> "$GITHUB_OUTPUT"
+        echo "manifest_id=Samsung.NET.Sdk.Tizen.Manifest-$BAND" >> "$GITHUB_OUTPUT"
+        echo "manifest_pkg=$MANIFEST_PKG" >> "$GITHUB_OUTPUT"
+        echo "Staged packages:"; ls -1 "$STAGING"
+
+    # Persist the bump only AFTER the build succeeded and the expected artifacts were
+    # verified on disk. Committing earlier meant a later build failure left the branch
+    # already bumped, so the retry computed OLD == NEW and aborted - an unretryable release.
+    #
+    # Skipped when the resolve step did not mutate anything (reference-only run, or a resume
+    # of a version this branch already carries).
+    - name: Commit and push the version bump
+      id: commit
+      run: |
+        set -euo pipefail
+        BRANCH="${GITHUB_REF_NAME}"
+        VER="${{ steps.bump.outputs.workload_version }}"
+        if [ "${{ steps.bump.outputs.mutated }}" != "true" ]; then
+          echo "::notice ::No version mutation to persist; tagging existing HEAD."
+          echo "release_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+        if git diff --quiet -- workload/build/Versions.props; then
+          echo "::error::Versions.props was not modified by the resolve step."
+          exit 1
+        fi
+        git config user.name  "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add workload/build/Versions.props
+        git commit -m "chore: bump TizenWorkloadVersion to ${VER}"
+        git push origin "HEAD:${BRANCH}"
+        echo "release_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
     - name: Push Manifest/SDK/Runtime packs
       if: ${{ github.event.inputs.release_manifest == 'true' }}
       run: |
         echo "Pushing Manifest packs for version ${{ github.event.inputs.net_sdk_version }}"...
-        dotnet nuget push ./workload/out/nuget-unsigned/Samsung.NET.Sdk.Tizen.Manifest-*.nupkg \
+        dotnet nuget push ${{ steps.stage.outputs.staging }}/Samsung.NET.Sdk.Tizen.Manifest-*.nupkg \
                       -k ${{ secrets.NUGET_APIKEY }} \
                       -s https://api.nuget.org/v3/index.json \
                       -t 3000 \
                       --skip-duplicate
-        dotnet nuget push ./workload/out/nuget-unsigned/Samsung.Tizen.Sdk.*.nupkg \
+        dotnet nuget push ${{ steps.stage.outputs.staging }}/Samsung.Tizen.Sdk.*.nupkg \
                       -k ${{ secrets.NUGET_APIKEY }} \
                       -s https://api.nuget.org/v3/index.json \
                       -t 3000 \
                       --skip-duplicate
-        dotnet nuget push ./workload/out/nuget-unsigned/Samsung.NETCore.App.Runtime.*.nupkg \
+        dotnet nuget push ${{ steps.stage.outputs.staging }}/Samsung.NETCore.App.Runtime.*.nupkg \
                       -k ${{ secrets.NUGET_APIKEY }} \
                       -s https://api.nuget.org/v3/index.json \
                       -t 3000 \
                       --skip-duplicate
-        dotnet nuget push ./workload/out/nuget-unsigned/Samsung.Tizen.Templates.*.nupkg \
+        dotnet nuget push ${{ steps.stage.outputs.staging }}/Samsung.Tizen.Templates.*.nupkg \
                       -k ${{ secrets.NUGET_APIKEY }} \
                       -s https://api.nuget.org/v3/index.json \
                       -t 3000 \
@@ -93,27 +184,33 @@ jobs:
       if: ${{ github.event.inputs.release_reference == 'true' }}
       run: |
         echo "Pushing Manifest packs for version ${{ github.event.inputs.net_sdk_version }}"...
-        dotnet nuget push ./workload/out/nuget-unsigned/Samsung.Tizen.Ref.*.nupkg \
+        dotnet nuget push ${{ steps.stage.outputs.staging }}/Samsung.Tizen.Ref.*.nupkg \
                       -k ${{ secrets.NUGET_APIKEY }} \
                       -s https://api.nuget.org/v3/index.json \
                       -t 3000 \
                       --skip-duplicate
 
+    # Idempotent: a resumed run whose tag already exists must not fail the whole release.
     - name: Create GitHub Release
       if: ${{ github.event.inputs.release_manifest == 'true' }}
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         VER="${{ steps.bump.outputs.workload_version }}"
         SDK="${{ github.event.inputs.net_sdk_version }}"
-        BAND="${SDK%%-*}"
+        # Canonical feature band and manifest id, as resolved and VERIFIED against the
+        # staged artifacts. Do not recompute here: '${SDK%%-*}' yields '11.0.100' for
+        # 11.0.100-preview.7.* and '10.0.404' for a servicing band, linking to packages
+        # that were never published.
+        BAND="${{ steps.stage.outputs.band }}"
+        MANIFEST_ID="${{ steps.stage.outputs.manifest_id }}"
         MAJOR_MINOR="$(echo "$BAND" | cut -d. -f1-2)"
         {
           echo "### Target .NET SDK: .NET ${SDK}"
           echo ""
           echo "## NuGet Packages"
           echo ""
-          echo "- https://www.nuget.org/packages/Samsung.NET.Sdk.Tizen.Manifest-${BAND}/${VER}"
+          echo "- https://www.nuget.org/packages/${MANIFEST_ID}/${VER}"
           echo "- https://www.nuget.org/packages/Samsung.NETCore.App.Runtime.tizen/${VER}"
           echo "- https://www.nuget.org/packages/Samsung.Tizen.Sdk/${VER}"
           echo "- https://www.nuget.org/packages/Samsung.Tizen.Templates/${VER}"
@@ -122,8 +219,12 @@ jobs:
             [ -n "$v" ] && echo "- https://www.nuget.org/packages/Samsung.Tizen.Ref.API${api}/${v}"
           done
         } > "$RUNNER_TEMP/release-notes.md"
+        if gh release view "v${VER}" >/dev/null 2>&1; then
+          echo "::notice ::Release v${VER} already exists; skipping creation (resumed run)."
+          exit 0
+        fi
         gh release create "v${VER}" \
-          --target "${GITHUB_REF_NAME}" \
+          --target "${{ steps.commit.outputs.release_sha }}" \
           --title "Tizen Workload ${VER} - .Net ${MAJOR_MINOR}" \
           --notes-file "$RUNNER_TEMP/release-notes.md" \
           --generate-notes
diff --git a/.github/workflows/validate-version-map.yml b/.github/workflows/validate-version-map.yml
@@ -10,7 +10,7 @@ name: Validate Version Map
 
 on:
   push:
-    branches: [ main, net7.0, net8.0, net9.0, net10.0 ]
+    branches: [ main, net7.0, net8.0, net9.0, net10.0, net11.0 ]
     paths:
       - 'workload/scripts/version-map.json'
       - 'workload/scripts/workload-install.sh'