feat: csharp-publish composite action for NuGet Trusted Publishing

[monsieurleberre]

Root cause

csharp-publish-public.yaml was migrated to NuGet Trusted Publishing (OIDC), but as a reusable workflow its OIDC job runs in peacefulstudio/github-actions. The job_workflow_ref claim is therefore always stamped peacefulstudio/github-actions/.github/workflows/csharp-publish-public.yaml@<ref> — never the caller. A per-repo nuget Trusted Publishing policy anchored on the consumer repo can never match this claim. Confirmed by a live HTTP 401.

Fix

Move OIDC login into the caller and keep build/test/pack/push complexity in a composite action that runs inline as steps in the caller's job. Running inline means job_workflow_ref stays the caller's publish.yaml, so a per-repo nuget policy anchored on the consumer matches.

• New .github/actions/csharp-publish/action.yml — composite action (invoked via steps: - uses:, not jobs.*.uses:).

  • Does not checkout the consumer repo (the caller does that first).
  • Does not mint its own OIDC token / run NuGet/login — the caller mints the short-lived key and passes it via the api-key input.
  • Steps: setup-dotnet → version calc (ported verbatim) → restore → build → test (filter-aware) → pack (snupkg) → upload-artifact → push via repo's own scripts/push-nuget.sh.
  • Inputs: api-key (required), version_override, include_symbols (default true), working-directory (default .), test-filter (default empty).

• Deprecate csharp-publish-public.yaml — it cannot satisfy trusted publishing for any consumer (same job_workflow_ref reason). Marked [DEPRECATED] in name:, with a leading ::warning:: step pointing consumers to the composite action. Otherwise left functional.

Caller usage:

- uses: actions/checkout@...
- id: nuget_login
  uses: NuGet/login@...
  with: { user: ${{ secrets.NUGET_USER }} }
- uses: peacefulstudio/github-actions/.github/actions/csharp-publish@v1
  with:
    api-key: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}

Note

.github/ changes require a human maintainer to merge — bot auto-approval is held for this path.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[monsieurleberre]

@claude please review this PR.