[Mudaafi]

What

Replaces the manual versioning steps in How to version the .NET repo with a Publish workflow, run from the Actions tab after merging a PR to main.

Structured after the PLP UI repo: small composite actions, reusable workflows, one orchestrator.

File	Purpose
workflows/publish.yml	Orchestrator — manual dispatch
workflows/generate-docs.yml	Regenerates docs/; reusable and independently dispatchable
workflows/publish-nuget.yml	Builds, packs and pushes to NuGet
workflows/create-github-release.yml	Creates the GitHub release
actions/next-version	Resolves the next version from constructor.io.csproj
actions/set-version	Writes the version to all 4 files, then verifies
actions/git-identity	Attributes the release to whoever triggered it

Inputs: version-strategy (patch/minor/major/explicit), optional exact version, a release title, and a publish-to-nuget toggle. Each reusable workflow also keeps a manual trigger so a partially failed run can be resumed a step at a time.

Verified before opening this

• Doxygen output reproduces exactly. Generated with 1.15.0 and INPUT = src/constructor.io src/Constructorio_NET.Tests README.md, HTML_OUTPUT = . — all 385 committed docs/*.html come back byte-identical. That's how the INPUT paths were derived rather than guessed.
• Package shape matches what's live. Downloaded constructor.io 4.4.0 from NuGet and packed locally: same lib/netstandard2.0/{dll,xml}, same .NETStandard2.0 nuspec target, same Newtonsoft.Json 13.0.4 dependency. The library targets netstandard2.0; dotnet-version: 8.0.x is only the build SDK, needed because the test project targets net8.0.
• Version bumping, across all 4 files / 5 locations, including the tab-indented .sln line.
• The verify guard fires. set-version re-greps every file afterwards; reverting just the .sln makes it fail, so a silently non-matching sed can't ship a half-bumped release.
• Attribution, end-to-end against a real remote with no global git identity: commits come out author=<you>, committer=github-actions[bot], and the annotated tag records you as tagger. Unresolvable actors (scheduled run, deleted account, API failure) fall back to the bot with a warning rather than failing the release.

Notes for review

• publish.sh is kept as a manual fallback — it prompts for confirmation, so it can't run in CI. README now documents the workflow as the primary path and warns against bumping by hand, since doing both risks publishing twice.
• An annotated tag takes its tagger from GIT_COMMITTER_*, not GIT_AUTHOR_* — tags have no author field. Hence the deliberate split: the tag uses the triggering user as committer, while commits keep the bot as committer, since the bot is what performed the push.
• Doxygen is pinned to 1.15.0 because the version is baked into every page footer; bumping it reflows all of docs/.
• The generated docs do not embed the SDK version (PROJECT_NUMBER is empty and ConstructorIO.Version is private with EXTRACT_PRIVATE = NO), so the docs step's position is about ordering only, not content.

Before the first real release

Two things I couldn't check without repo settings:

1. NUGET_API_KEY must exist as a repo secret.
2. Branch protection on main — if direct pushes are blocked, bump_version and generate_docs will both fail and the workflow needs a token with bypass.

Suggested first run: Publish: Generate documentation with commit unchecked. It touches nothing, and exercises the real Linux runner — including the GNU sed path, which could only be reasoned about locally, not executed.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Test failures do not block publication, release tagging follows a mutable branch, and manual version input permits shell injection.

3 open issues

• Validate manual version input to prevent shell injection · New
• Tag immutable bump commit instead of re-resolving branch · New
• Make test failures block release and NuGet publication · New

What changed in this PR

Automates .NET SDK releases through GitHub Actions, retaining the manual publishing fallback.

Changes:

• Adds release orchestration and independently runnable publishing workflows.
• Adds version-management and git-attribution actions.
• Documents the automated release process.

File	Description
README.md	Documents automated releases and manual fallback.
.github/​workflows/​publish.yml	Orchestrates versioning, documentation, tagging, and publishing.
.github/​workflows/​publish-nuget.yml	Builds and publishes NuGet packages.
.github/​workflows/​generate-docs.yml	Regenerates, uploads, and optionally commits documentation.
.github/​workflows/​create-github-release.yml	Creates releases with generated notes.
.github/​actions/​set-version/​action.yml	Updates and verifies tracked versions.
.github/​actions/​next-version/​action.yml	Resolves versions and checks existing tags.
.github/​actions/​git-identity/​action.yml	Resolves release attribution with bot fallback.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The documentation push relies on a missing remote-tracking reference after SHA checkout, blocking releases whenever documentation changes.

1 open issue

• Use explicit branch SHA lease for docs commit push · New

3 resolved since last review

• Tag immutable bump commit instead of re-resolving branch
• Validate manual version input to prevent shell injection
• Make test failures block release and NuGet publication

_{Review effort: Balanced}