From 2b05a68a3281e52566a6349b81a724d3acd4445a Mon Sep 17 00:00:00 2001 From: Magic Coding Man Date: Fri, 21 Aug 2026 12:42:11 -0400 Subject: [PATCH] fix: scope NuGet publishing to release environment --- .github/workflows/publish-nuget.yml | 1 + docs/contributing/testing.md | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml index bc19518..6200caa 100644 --- a/.github/workflows/publish-nuget.yml +++ b/.github/workflows/publish-nuget.yml @@ -29,6 +29,7 @@ jobs: publish: name: Build and publish package + environment: release needs: - core-validation - browser-validation diff --git a/docs/contributing/testing.md b/docs/contributing/testing.md index d5060a2..3bcbcd0 100644 --- a/docs/contributing/testing.md +++ b/docs/contributing/testing.md @@ -49,6 +49,8 @@ Every pull request runs: Pushes to `master` run the same workflows again. A push to `release` starts `publish-nuget.yml`, which calls both validation workflows and does not build or publish the NuGet package until every validation job succeeds. This makes the release run a final independent gate even when the same commit passed on `master`. +The publishing job declares the GitHub Actions environment `release`. NuGet's trusted-publishing policy must use the same environment value so the job's OIDC identity matches the policy. The protected `release` branch controls when the workflow runs; it is separate from the Actions environment claim used during the NuGet token exchange. + Core validation packages the library before the unit-test build so the package check starts without cached build manifests. Validation and release publishing use the same `.github/scripts/pack-nuget.sh` entry point. Release versions are based on the checked-in stable version line and the versions already present on NuGet. The workflow publishes one patch above whichever matching version is newer. Failed or retried workflow runs therefore do not consume or skip package versions. Version calculation fails safely if NuGet's version index cannot be read or validated.