Prepare trusted NuGet publishing

.github/workflows/publish-nuget.yml

@@ -0,0 +1,111 @@
+name: Publish NuGet packages
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Resolve package version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Tag '$GITHUB_REF_NAME' does not produce a valid package version."
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Restore
+        working-directory: MagicSettings
+        run: dotnet restore MagicSettings.sln
+
+      - name: Build
+        working-directory: MagicSettings
+        run: dotnet build MagicSettings.sln --configuration Release --no-restore
+
+      - name: Test
+        working-directory: MagicSettings
+        run: dotnet test MagicSettings.sln --configuration Release --no-build --logger "console;verbosity=normal"
+
+      - name: Pack
+        working-directory: MagicSettings
+        run: >-
+          dotnet pack MagicSettings.sln
+          --configuration Release
+          --no-build
+          --output ../artifacts/packages
+          -p:PackageVersion=${{ steps.version.outputs.version }}
+
+      - name: Validate package output
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.version.outputs.version }}"
+          package_dir="artifacts/packages"
+
+          test -f "$package_dir/MagicSettings.$version.nupkg"
+          test -f "$package_dir/MagicSettings.Server.$version.nupkg"
+
+          if find "$package_dir" -maxdepth 1 -name 'MagicSettings.Share.*.nupkg' | grep -q .; then
+            echo "MagicSettings.Share must not be published as a standalone package."
+            exit 1
+          fi
+
+          package_count=$(find "$package_dir" -maxdepth 1 -name '*.nupkg' | wc -l)
+          if [[ "$package_count" -ne 2 ]]; then
+            echo "Expected exactly two .nupkg files, found $package_count."
+            find "$package_dir" -maxdepth 1 -type f -print
+            exit 1
+          fi
+
+          for package in \
+            "$package_dir/MagicSettings.$version.nupkg" \
+            "$package_dir/MagicSettings.Server.$version.nupkg"; do
+            if ! unzip -l "$package" | grep -q 'lib/net10.0/MagicSettings.Share.dll'; then
+              echo "$package does not contain lib/net10.0/MagicSettings.Share.dll."
+              exit 1
+            fi
+          done
+
+      - name: Upload package artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuget-packages-${{ steps.version.outputs.version }}
+          path: artifacts/packages/*.*nupkg
+          if-no-files-found: error
+
+      - name: NuGet login
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Publish packages
+        shell: bash
+        run: >-
+          dotnet nuget push "artifacts/packages/*.nupkg"
+          --api-key "${{ steps.login.outputs.NUGET_API_KEY }}"
+          --source https://api.nuget.org/v3/index.json
+          --skip-duplicate

MagicSettings/Directory.Build.props

@@ -8,5 +8,20 @@
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <NoWarn>$(NoWarn);1591</NoWarn>
     <Deterministic>true</Deterministic>
+
+    <Authors>magiccodingman</Authors>
+    <Company>magiccodingman</Company>
+    <RepositoryUrl>https://github.com/magiccodingman/MagicSettings</RepositoryUrl>
+    <RepositoryType>git</RepositoryType>
+    <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+    <ContinuousIntegrationBuild Condition="'$(CI)' == 'true'">true</ContinuousIntegrationBuild>
   </PropertyGroup>
+
+  <ItemGroup Condition="'$(IsPackable)' != 'false'">
+    <None Include="$(MSBuildThisFileDirectory)../README.md" Pack="true" PackagePath="/" Link="README.md" />
+  </ItemGroup>
 </Project>

MagicSettings/Directory.Build.targets

@@ -0,0 +1,18 @@
+<Project>
+  <PropertyGroup Condition="'$(IsPackable)' == 'true' and ('$(MSBuildProjectName)' == 'MagicSettings' or '$(MSBuildProjectName)' == 'MagicSettings.Server')">
+    <TargetsForTfmSpecificBuildOutput>$(TargetsForTfmSpecificBuildOutput);IncludeMagicSettingsShareInPackage</TargetsForTfmSpecificBuildOutput>
+  </PropertyGroup>
+
+  <Target Name="IncludeMagicSettingsShareInPackage"
+          Condition="'$(IsPackable)' == 'true' and ('$(MSBuildProjectName)' == 'MagicSettings' or '$(MSBuildProjectName)' == 'MagicSettings.Server')"
+          DependsOnTargets="BuildOnlySettings;ResolveReferences">
+    <ItemGroup>
+      <_MagicSettingsShareAssembly Include="@(ReferenceCopyLocalPaths)"
+                                   Condition="'%(ReferenceCopyLocalPaths.Filename)' == 'MagicSettings.Share' and '%(ReferenceCopyLocalPaths.Extension)' == '.dll'" />
+      <BuildOutputInPackage Include="@(_MagicSettingsShareAssembly)" />
+    </ItemGroup>
+
+    <Error Condition="'@(_MagicSettingsShareAssembly)' == ''"
+           Text="MagicSettings.Share.dll was not found in the resolved project references and cannot be included in the NuGet package." />
+  </Target>
+</Project>

MagicSettings/MagicSettings.Server/MagicSettings.Server.csproj

@@ -1,10 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
+    <IsPackable>true</IsPackable>
     <PackageId>MagicSettings.Server</PackageId>
+    <Title>MagicSettings Server</Title>
     <Description>Storage-agnostic server helpers for MagicSettings enrollment, synchronization, authorization, and proof verification.</Description>
+    <PackageTags>configuration;settings;server;dotnet;control-plane</PackageTags>
   </PropertyGroup>
   <ItemGroup>
-    <ProjectReference Include="../MagicSettings.Share/MagicSettings.Share.csproj" />
+    <ProjectReference Include="../MagicSettings.Share/MagicSettings.Share.csproj" PrivateAssets="all" />
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>
 </Project>

MagicSettings/MagicSettings.Share/MagicSettings.Share.csproj

@@ -1,5 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
+    <IsPackable>false</IsPackable>
     <PackageId>MagicSettings.Share</PackageId>
     <Description>Shared protocol, schema, and security contracts for MagicSettings clients and control-plane implementations.</Description>
   </PropertyGroup>

MagicSettings/MagicSettings/MagicSettings.csproj

@@ -1,10 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
+    <IsPackable>true</IsPackable>
     <PackageId>MagicSettings</PackageId>
+    <Title>MagicSettings</Title>
     <Description>Strongly typed configuration with generation, reconciliation, migrations, live overrides, and client-owned control-plane integration.</Description>
+    <PackageTags>configuration;settings;appsettings;dotnet;control-plane</PackageTags>
   </PropertyGroup>
   <ItemGroup>
-    <ProjectReference Include="../MagicSettings.Share/MagicSettings.Share.csproj" />
+    <ProjectReference Include="../MagicSettings.Share/MagicSettings.Share.csproj" PrivateAssets="all" />
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
   </ItemGroup>
 </Project>