ci: publish via the org reusable-nuget-publish workflow

[MusaMisto]

Can be merged independently. It works with the shared workflow already on main; simplify9/.github#184 only adds improvements.

Why

Moves this repo onto the org's shared NuGet pipeline (simplify9/.github → reusable-nuget-publish.yml), with the same values as before.

It also removes the dependency on S9_GITHUB_TOKEN. That org PAT expired in September and now returns HTTP 401. With the old workflow, the next release would push the package, fail to create the tag, and every later run would recompute the same version and silently re-push nothing. SW-Bus hit exactly this on 2026-09-29.

Old → new (1-1)

	Old	New
Workflow file / name	nuget-publish.yml / Build and Publish NuGet Package	same	kept (Actions history + badge)
Triggers	push main, workflow_dispatch	same	kept
Version line	8.0.x	same	kept (dry-run computed 8.0.5)
.NET SDK	8.0.x	same	kept
Tests	off	same	kept
Test glob	**/*UnitTests/*.csproj	same	kept
Packed projects (1)	pdf-templar-sdk/pdf-templar-sdk.csproj	same, same order	kept
Build / configuration	**/*.csproj, Release	same	kept
API key → feed	SWNUGETKEY → nuget.org (reusable default)	same	kept
Tag token	S9_GITHUB_TOKEN (org PAT)	built-in GITHUB_TOKEN	changed (the PAT is dead; no workflow here triggers on tags)

New from the shared pipeline:

• A release is blocked while a critical Dependabot alert is open (0 open today).
• Runs are serialized per branch.
• A manual run from a non-main branch publishes a prerelease, never a stable version.

Verification

• Equivalence check: a script independent of the generator re-reads the old and new files and asserts every value above maps 1-1. It passes, and a negative control of three injected mistakes was caught.

• Lint: actionlint is clean, and the caller's inputs and secrets were checked against the shared workflow's signature.

• Live dry-run: run 36565394548, with a fake API key and an unresolvable feed so nothing could publish.

  • version 8.0.5-ci-dryrun-reusable-nuget-publish.8
  • build succeeded
  • 1/1 package(s) packed
  • tests: off
  • only the push to the fake feed failed, and the tag step was skipped

  The throwaway branch has been deleted, and no tag or package was created.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3c78f230-834a-4ce8-819c-a7cfae612902

📥 Commits

Reviewing files that changed from the base of the PR and between 5cf34d5 and 25e42b7.

📒 Files selected for processing (1)

• .github/workflows/nuget-publish.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

Treat GitHub Actions changes as supply-chain sensitive.

⚙️ CodeRabbit configuration file

Files:

• .github/workflows/nuget-publish.yml

🪛 zizmor (1.30.0)

.github/workflows/nuget-publish.yml

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🔇 Additional comments (1)

.github/workflows/nuget-publish.yml (1)

8-17: LGTM!

Also applies to: 19-29

---

📝 Walkthrough

⚠️ A high-level summary could not be generated for this review. CodeRabbit will regenerate it on the next update, or you can request a refresh with @coderabbitai summary.

Walkthrough

The NuGet publishing workflow now calls a reusable workflow. It passes project, version, test, and secret settings. Permissions default to none, with the publish job granting the required permissions.

Changes

NuGet publishing

Layer / File(s)	Summary
Reusable publishing workflow .github/workflows/nuget-publish.yml	The workflow replaces inline build, versioning, package-push, and tagging steps with a reusable workflow call. It passes project and version settings, keeps tests disabled, supplies secrets, and scopes permissions to the publish job.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested labels: security, infra, risk:critical

Suggested reviewers: samerzughul

Merge Risk: ⚪ Minimal · up to 25e42

The publishing workflow retains the existing trust model for shared organization code. No actionable merge-blocking risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 25e42

The new publishing path gives a shared workflow release credentials and permission to write repository contents. This warrants review, but the previous release path already trusted code maintained in the same organization for publishing and tagging.

Retained concerns

• Low · security · inferred: The new mutable reusable-workflow dependency receives a repository contents-write permission ceiling and two release-related secrets. Unlike the previous local tag step's expired PAT path, the delegated path is intended to create tags with the built-in token. Changes to the organization workflow could therefore change the effective release and tagging controls without a change in this repository. The previous workflow's mutable organization actions substantially limit what can be attributed to this PR alone.

Security review details

Security Blast Radius

• inferred — Control of the referenced organization workflow could affect this repository's delegated release execution and credentials. The evidence does not establish the NuGet key's feed scope, the Dependabot token's scope, or which other repositories call the same workflow.

Security Findings and Attack Paths

• inferred — The retained mutable-reference finding concerns an attacker able to change or compromise the organization-owned @main workflow before a release run. The previous release path already trusted mutable actions in that repository; the distinct new exposure is the delegated workflow's access to the restored write-token path and added alert credential, subject to its uninspected job controls.

Trust Boundaries and Controls

• observed — The caller sets no token scopes by default and grants explicit permissions at the Publish job. The callee implementation is needed to determine which of its jobs actually receive each secret and permission.

Resilience and Maintainability Implications

• inferred — Moving the release transition into shared code makes its failure containment and rerun behavior dependent on that code. The caller alone cannot verify whether a successful package push followed by a failed tag is recovered without repeating or misidentifying a release.

Hardening Proposals

• proposed — Consider referencing a reviewed immutable revision of the reusable workflow and verifying that its jobs receive only the secrets and permissions needed for their respective release steps.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: using the organization’s reusable NuGet publishing workflow.
Description check	✅ Passed	The description directly explains the workflow migration, preserved settings, token replacement, security rationale, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}