Harden CI pipeline and release publishing for bare SemVer tags

[AGiorgetti]

Outcome

Make the CI and release pipeline safe and reproducible for this repository's bare SemVer tags, such as 2.0.0.

Scope

1. Tag-gated, fail-closed publishing

   • Publish only from a protected SemVer tag push or an explicitly approved production release run.
   • Do not publish on ordinary pushes to main, release/**, or hotfix/**.
   • Validate that the tag exactly matches the GitVersion package version.
   • Fail on duplicate or mismatched package versions instead of silently skipping them.

2. Publish the exact validated artifacts

   • Pack once in the validation workflow.
   • Upload the .nupkg and .snupkg artifacts plus checksums.
   • Publish those exact artifacts after verifying their commit, tag, version, and hashes.

3. Validate final packages before push

   • Run package-level API compatibility checks.
   • Run clean-consumer tests against the packed artifacts for supported target frameworks and language/Roslyn hosts.
   • Exercise static, instance, nested-collection, and cycle-detection mappings.
   • Run trimmed and Native AOT sample publish/execute checks.
   • Verify package contents do not include generator/Roslyn runtime assets.

4. Make test discovery explicit

   • Mark the four test projects with <IsTestProject>true</IsTestProject> or enumerate test projects directly in CI.
   • Keep samples and benchmarks as explicit dotnet run validations; do not force the test property across the whole solution.

5. Harden workflow governance

   • Keep one canonical workflow and remove or clearly retire the inactive .ym_ copies.
   • Protect release tags and the NuGet publishing environment with required checks and human approval.
   • Use least-privilege credentials and retain release artifacts/provenance.

6. Synchronize release documentation

   • Update STATUS.md, IMPLEMENTATION_PLAN.md, and any release checklist to reflect the actual CI, packaging, AOT, trimming, API-compatibility, and reproducibility evidence.

Acceptance criteria

• A push of 2.0.0-style tags runs validation and can publish the matching packages.
• A non-tag branch push cannot publish to NuGet.
• A malformed or mismatched tag, duplicate version, or tampered artifact fails before push; a valid prerelease tag is not rejected solely because it is prerelease.
• The release job publishes only artifacts produced and validated for the same commit/tag.
• All required package, consumer, API-compatibility, trimming, Native AOT, and mapping tests pass.
• Test discovery is explicit and local CI commands do not silently skip test projects.
• Release documentation and workflow files agree with SPECIFICATION.md.
• Dry-run executes the same build, pack, package, consumer, API-compatibility, mapping, trimming, Native AOT, artifact-integrity, and version/tag validations as production.
• Dry-run produces and retains the packages and checksums, reports what would be published, and never calls NuGet push or otherwise mutates NuGet.
• Stable and prerelease bare SemVer tags, including 2.0.0-alpha.1 and 2.0.1-beta.1, are accepted and must match the package version exactly.
• Automated tests cover stable tags, alpha/beta tags, invalid or mismatched tags, and prove that dry-run never publishes.

Notes

The repository uses bare SemVer tags (for example, 2.0.0), not v-prefixed tags. This issue is intentionally created in state:draft; add ready:agent when the implementation scope is approved for AgentStack execution.

Addendum: safe dry-run and prerelease tags

The release workflow must support a complete, non-publishing rehearsal and bare SemVer prerelease tags.

• Add a dry-run mode that executes the same build, pack, package-content, API-compatibility, clean-consumer, mapping, trimming, Native AOT, artifact-integrity, and version/tag checks as production.
• Dry-run must produce and retain the exact packages and checksums and report what would be published, but must not call NuGet push or otherwise mutate NuGet. The production path should differ only at the final, approval-gated publish step.
• Accept stable and prerelease bare SemVer tags, including examples such as 2.0.0-alpha.1 and 2.0.1-beta.1; validate the complete tag as SemVer and require the package version to match it exactly.
• Add tests proving both stable and alpha/beta tags are accepted, invalid or mismatched tags are rejected, and dry-run never publishes.

[AGiorgetti]

Agent claim registered for autonomous execution.

[AGiorgetti]

AgentStack Protocol: execution-plan

Outcome: make issue #17 production-safe for bare SemVer release tags, including alpha/beta prereleases, with a complete dry-run that never publishes to NuGet.

Impacted areas: .github/workflows/ci.yml and inactive workflow copies; explicit test-project metadata; pipeline/release validation coverage; STATUS.md and IMPLEMENTATION_PLAN.md release evidence.

Implementation steps:

1. Refactor CI release gating so ordinary branch pushes validate only, stable/prerelease SemVer tags (2.0.0, 2.0.1-beta.1) are version-checked, and production publishing is approval-gated.
2. Pack once, retain the exact packages/symbol packages/checksums, validate them, and publish only the verified artifacts.
3. Make workflow dry-run execute the same validation path and prove it never performs a NuGet mutation.
4. Make test discovery explicit without treating samples or benchmarks as tests.
5. Add or extend deterministic tests for tag parsing, version matching, dry-run no-publish behavior, final package validation, and test discovery.
6. Remove or clearly retire duplicate inactive workflows and synchronize release documentation with SPECIFICATION.md.

Validation: focused workflow/package tests; explicit test-project test runs; full required solution/test matrix; release package/API-compatibility/consumer/trimming/Native AOT checks where available; workflow syntax and scoped diff checks.

Assumptions and boundaries: use the repository's existing bare-tag convention; allow stable and alpha/beta SemVer tags; do not push to NuGet or create a release tag; do not change mapping semantics or add public APIs; preserve the specification as authoritative.

[AGiorgetti]

AgentStack Protocol: progress

• Issue claimed in isolated worktree
• execution plan recorded. Workflow/release and test/docs units are implementing in separate worktrees
• root will integrate and run final validation.