[rafalmaciag]

Why

publish-nuget run 39152113710 failed at Guard - the packed-assembly-version guard's self-test. The log printed check-packed-assembly-versions self-test: 6 ok, 0 failed and then Process completed with exit code 1. Nothing was pushed.

The cause:

• The self-test ends with if ($fail -gt 0) { exit 1 } and has no explicit success exit.
• Its last case runs the guard (pwsh -File …) on a negative package, where the guard exits 1 on purpose, so $LASTEXITCODE is 1 at the end.
• GitHub's shell: pwsh template appends if ((Test-Path -LiteralPath variable:\LASTEXITCODE)) { exit $LASTEXITCODE }, which turns a passing self-test into a failed step.

The step is new since the 1.3.5 tag, so this is the first run that could show it.

Change

• check-packed-assembly-versions.selftest.ps1 ends with an explicit exit 0 after the $fail check.
• check-packed-assembly-versions.ps1 (the guard) ends with an explicit exit 0 too. It runs no native command today, so it was safe, but its verdict should not rest on that staying true. Its failures are terminating Write-Errors ($ErrorActionPreference = 'Stop').
• The audit found no other shell: pwsh steps in the workflows and no other .ps1 scripts.

Proof

Run locally through GitHub's own harness: the step's run: text in a temp .ps1 with $ErrorActionPreference = 'stop' prepended and the exit $LASTEXITCODE check appended, invoked as pwsh -command ". '<file>'".

tree	output	step exit
master dfc8143 (RED first)	6 ok, 0 failed	1
this branch	6 ok, 0 failed	0
mutant: a forced Bad	6 ok, 1 failed	1

Also: the self-test runs on every PR

• New .github/workflows/publish-guards.yml, on pull_request and push to master, runs the same self-test step the same way (shell: pwsh), so a regression of today's failure shows on the PR instead of at publish. Today's failure was the step's first-ever CI run.
• It ran on this PR's head 64f4574: run 39152836929, success. actionlint is clean.

🤖 Generated with Claude Code