From 9f6c147be639c43934a51d638418b4415d94e458 Mon Sep 17 00:00:00 2001
From: Alexander Linne <alexander.linne@tngtech.com>
Date: Wed, 26 Aug 2026 18:25:59 +0200
Subject: [PATCH 1/2] ci: use nuget trusted publishing

Signed-off-by: Alexander Linne <alexander.linne@tngtech.com>
---
 .github/workflows/build.yaml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 9d90ee921..f24d9ca36 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -130,6 +130,8 @@ jobs:
     if: github.event_name == 'release'
     runs-on: windows-latest
     environment: deploy
+    permissions:
+      id-token: write
     needs:
       - formatting
       - coverage
@@ -165,8 +167,12 @@ jobs:
           else
             echo "CREATE_RELEASE=false" >> "$GITHUB_ENV"
           fi
+      - name: NuGet login (OIDC → temp API key)
+        if: env.CREATE_RELEASE == 'true'
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: nuget-login
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - name: Push
         if: env.CREATE_RELEASE == 'true'
-        run: dotnet nuget push .\nupkgs\*.nupkg --source https://api.nuget.org/v3/index.json --api-key "$env:NUGET_API_KEY"
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: dotnet nuget push .\nupkgs\*.nupkg --source https://api.nuget.org/v3/index.json --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}"

From 0f15ed974260e2d5b73e4e6f226ac0a521bc7772 Mon Sep 17 00:00:00 2001
From: Alexander Linne <alexander.linne@tngtech.com>
Date: Wed, 26 Aug 2026 18:37:38 +0200
Subject: [PATCH 2/2] ci: split building and publishing packages into separate
 jobs

Signed-off-by: Alexander Linne <alexander.linne@tngtech.com>
---
 .github/workflows/build.yaml | 74 +++++++++++++++++++++---------------
 1 file changed, 44 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f24d9ca36..d90e5ffb3 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -125,17 +125,9 @@ jobs:
           git checkout preview
           git reset --hard "$GITHUB_REF"
           git push origin --force-with-lease
-  publish-packages:
-    name: Publish packages
-    if: github.event_name == 'release'
+  build-packages:
+    name: Build and pack packages
     runs-on: windows-latest
-    environment: deploy
-    permissions:
-      id-token: write
-    needs:
-      - formatting
-      - coverage
-      - run-tests
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -147,32 +139,54 @@ jobs:
         run: dotnet build -c Release
       - name: Pack
         run: |
-          $semver = "$env:GITHUB_REF_NAME"
-          if ($semver -match '^(\d+)\.(\d+)\.\d+') {
-              $major = $matches[1]
-              $minor = $matches[2]
-              $packageVersion = "$env:GITHUB_REF_NAME"
-              $assemblyVersion = "$major.$minor.0.0"
-              Write-Host "Package version: $packageVersion"
-              Write-Host "Assembly version: $assemblyVersion"
-              dotnet pack -c Release --output nupkgs -p:PackageVersion=$packageVersion -p:AssemblyVersion=$assemblyVersion
+          if ("$env:GITHUB_EVENT_NAME" -eq "release") {
+              $semver = "$env:GITHUB_REF_NAME"
+              if ($semver -match '^(\d+)\.(\d+)\.\d+') {
+                  $major = $matches[1]
+                  $minor = $matches[2]
+                  $packageVersion = "$env:GITHUB_REF_NAME"
+                  $assemblyVersion = "$major.$minor.0.0"
+              } else {
+                  throw "Invalid semver format"
+              }
           } else {
-              throw "Invalid semver format"
+              # Placeholder version for non-release builds; never used for a real release.
+              $packageVersion = "0.0.0-ci"
+              $assemblyVersion = "0.0.0.0"
           }
-      - name: Check release conditions
-        shell: bash
-        run: |
-          if [[ "$GITHUB_REF" =~ ^"refs/tags/"[0-9]+.[0-9]+.[0-9]+(-[a-z]+.[0-9]+)?|"refs/heads/main"$ ]]; then
-            echo "CREATE_RELEASE=true" >> "$GITHUB_ENV"
-          else
-            echo "CREATE_RELEASE=false" >> "$GITHUB_ENV"
-          fi
+          Write-Host "Package version: $packageVersion"
+          Write-Host "Assembly version: $assemblyVersion"
+          dotnet pack -c Release --output nupkgs -p:PackageVersion=$packageVersion -p:AssemblyVersion=$assemblyVersion
+      - name: Upload package artifact
+        if: github.event_name == 'release'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: nupkgs
+          path: nupkgs/*.nupkg
+          retention-days: 1
+
+  publish-packages:
+    name: Publish packages
+    if: github.event_name == 'release'
+    needs:
+      - formatting
+      - coverage
+      - run-tests
+      - build-packages
+    runs-on: windows-latest
+    environment: deploy
+    permissions:
+      id-token: write
+    steps:
+      - name: Download package artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: nupkgs
+          path: nupkgs
       - name: NuGet login (OIDC → temp API key)
-        if: env.CREATE_RELEASE == 'true'
         uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         id: nuget-login
         with:
           user: ${{ secrets.NUGET_USER }}
       - name: Push
-        if: env.CREATE_RELEASE == 'true'
         run: dotnet nuget push .\nupkgs\*.nupkg --source https://api.nuget.org/v3/index.json --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}"