Remove Windows signing smoke test scaffolding

.github/workflows/rust-release.yml

@@ -18,8 +18,6 @@
 name: rust-release
 on:
   push:
-    branches:
-      - dev/shijie/drop-windows-signing-deployment
     tags:
       - "rust-v*.*.*"
   workflow_dispatch:
@@ -51,7 +49,7 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref_type == 'branch' && github.ref_name || 'release' }}
+  group: ${{ github.workflow }}
   cancel-in-progress: true
 
 jobs:
@@ -73,12 +71,6 @@ jobs:
           set -euo pipefail
           echo "::group::Tag validation"
 
-          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF_TYPE}" == "branch" ]]; then
-            echo "Branch smoke run; skipping release tag validation."
-            echo "::endgroup::"
-            exit 0
-          fi
-
           case "${RELEASE_MODE}" in
             signed)
               if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
@@ -143,8 +135,7 @@ jobs:
           echo "::endgroup::"
 
   build:
-    # Temporarily disabled while this PR exercises Windows build and signing only.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     needs: tag-check
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
@@ -1097,8 +1088,7 @@ jobs:
           if-no-files-found: error
 
   stage-signed-macos:
-    # Temporarily disabled while this PR exercises Windows build and signing only.
-    if: ${{ false && github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }}
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }}
     needs: tag-check
     name: Stage signed macOS handoff - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: macos-15-xlarge
@@ -1341,12 +1331,11 @@ jobs:
     needs: tag-check
     uses: ./.github/workflows/rust-release-windows.yml
     with:
-      release-lto: ${{ github.ref_type == 'branch' && 'thin' || (contains(github.ref_name, '-alpha') && 'thin' || 'fat') }}
+      release-lto: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'fat' }}
     secrets: inherit
 
   argument-comment-lint-release-assets:
-    # Temporarily disabled while this PR exercises Windows build and signing only.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode == 'build_unsigned' }}
     name: argument-comment-lint release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-argument-comment-lint.yml
@@ -1354,8 +1343,7 @@ jobs:
       publish: true
 
   zsh-release-assets:
-    # Temporarily disabled while this PR exercises Windows build and signing only.
-    if: ${{ false && (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') }}
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode == 'build_unsigned' }}
     name: zsh release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-zsh.yml
@@ -1369,11 +1357,9 @@ jobs:
       - build-windows
       - argument-comment-lint-release-assets
       - zsh-release-assets
-    # Temporarily disabled while this PR exercises Windows build and signing only.
     if: >-
       ${{
         always() &&
-        false &&
         needs.tag-check.result == 'success' &&
         (
           (
@@ -1759,13 +1745,11 @@ jobs:
   # npm docs: https://docs.npmjs.com/trusted-publishers
   publish-npm:
     # Publish to npm for stable releases and alpha pre-releases with numeric suffixes.
-    # Temporarily disabled while this PR exercises Windows build and signing only.
     # promote_signed intentionally skips build jobs that are ancestors of release;
     # include the !cancelled() status function so Actions does not apply its implicit
     # success() check to the whole dependency chain before evaluating release outputs.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.should_publish_npm == 'true'
@@ -1926,10 +1910,8 @@ jobs:
     needs: release
     # Only trigger the deploy for a stable signed release.
     # The deploy updates developers.openai.com with the new config schema json file.
-    # Temporarily disabled while this PR exercises Windows build and signing only.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true' &&
@@ -1958,10 +1940,8 @@ jobs:
     needs: release
     # Only publish stable/mainline releases to WinGet; pre-releases include a
     # '-' in the semver string (e.g., 1.2.3-alpha.1).
-    # Temporarily disabled while this PR exercises Windows build and signing only.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true' &&
@@ -1986,10 +1966,8 @@ jobs:
 
   update-branch:
     name: Update latest-alpha-cli branch
-    # Temporarily disabled while this PR exercises Windows build and signing only.
     if: >-
       ${{
-        false &&
         !cancelled() &&
         needs.release.result == 'success' &&
         needs.release.outputs.sign_macos == 'true'