Prepare 0.7.0 release (#39)

## Summary
- bump all workspace package versions and `Cargo.lock` to 0.7.0
- fail release preflight when the requested release version differs from
the root package version
- update the release workflow input example

## Validation
- verified all workspace manifests and lockfile entries use 0.7.0
- verified the preflight guard accepts 0.7.0 and rejects an incorrect
version
- `git diff --check`

Rust build/test validation was unavailable locally because no default
Rust toolchain is configured.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mamoreau-devolutions

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version to build/publish (for example 0.6.3)
+        description: Release version to build/publish (for example 0.7.0)
         required: true
         type: string
       publish_nuget:
@@ -97,6 +97,17 @@ jobs:
           }
 
           $releaseTag = "v$releaseVersion"
+          $manifestVersionMatch = Select-String -LiteralPath 'Cargo.toml' -Pattern '^version\s*=\s*"([^"]+)"' |
+            Select-Object -First 1
+          if (-not $manifestVersionMatch) {
+            throw 'Unable to resolve the psign package version from Cargo.toml.'
+          }
+
+          $manifestVersion = $manifestVersionMatch.Matches[0].Groups[1].Value
+          if ($manifestVersion -ne $releaseVersion) {
+            throw "Release version $releaseVersion does not match Cargo.toml package version $manifestVersion."
+          }
+
           $isMasterBranch = $sourceBranch -eq 'master'
           $publishNuget = Parse-BoolOrDefault '${{ github.event.inputs.publish_nuget }}' $false
           $publishPsgallery = Parse-BoolOrDefault '${{ github.event.inputs.publish_psgallery }}' $false

Cargo.lock

@@ -30,7 +30,7 @@ repository = "https://github.com/Devolutions/psign"
 
 [package]
 name = "psign"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Rust port of the Windows SDK signtool.exe (Authenticode sign/verify/timestamp) with portable digest helpers."
 license.workspace = true

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-authenticode-trust"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Portable Authenticode PKCS#7 trust verification (anchors, chain, EKU) using picky-rs"
 license.workspace = true

crates/psign-authenticode-trust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-azure-kv-rest"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Azure Key Vault certificate metadata + keys/sign REST (portable, blocking HTTP)"
 license.workspace = true

crates/psign-azure-kv-rest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-codesigning-rest"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Azure Code Signing data-plane CertificateProfileOperations Sign LRO (portable, blocking HTTP)"
 license.workspace = true

crates/psign-codesigning-rest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-digest-cli"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Linux/macOS-friendly CLI over portable Authenticode SIP digests (psign-sip-digest)"
 license.workspace = true

crates/psign-digest-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-opc-sign"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Portable OPC, VSIX, and NuGet package signing primitives"
 license.workspace = true

crates/psign-opc-sign/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-core"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "Reusable portable Authenticode signing and inspection APIs for psign"
 license.workspace = true

crates/psign-portable-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psign-portable-ffi"
-version = "0.6.3"
+version = "0.7.0"
 edition = "2024"
 description = "C ABI shared library for psign portable Authenticode operations"
 license.workspace = true