Re-sync template #213/#214 workflow fixes (single-target adaptation)

[ptr727]

Re-sync of the two workflow fixes this repo surfaced upstream, now merged in ptr727/ProjectTemplate on develop:

• Make jq_lacks set -e-safe #213 (develop leg published as a stable NuGet package) → template PR Version each publish leg against its own branch; validate at entry ProjectTemplate#215 (5adbcb9)
• Clarify publisher comment: only Actions bumps skip republish #214 (blanket artifact cleanup destroys diagnostics) → template PR Clean up transfer artifacts surgically at consumption, not blanket-delete ProjectTemplate#216 (161d8a9)

Apply here adapted to this single-target NuGet repo (no pypi/docker/executable jobs). These workflow files are CRLF — preserve line endings. Source of truth for every snippet below is template PRs ptr727/ProjectTemplate#215, #216, and #218 (the #217 delete-gating follow-up).

This is the first downstream re-sync of these fixes; once validated here it goes to the other derived repos.

---

A. #213 / #221 - version each leg from its checked-out branch, validate at entry

Updated for #221 + #219. The original GITHUB_REF-override approach (template PR ptr727/ProjectTemplate#215) was ineffective - GITHUB_REF is GitHub-reserved and a step env: cannot override it (the runner re-injects the dispatch ref). Use NBGV's own IGNORE_GITHUB_REF instead (template PR ptr727/ProjectTemplate#222). If you already applied the earlier version of this section, see the migration note in the comments below.

A1. get-version-task.yml - make NBGV ignore the CI ref

On the Run Nerdbank.GitVersioning tool step, set NBGV's IGNORE_GITHUB_REF so it versions from the checked-out branch (each leg already checks out its own branch) instead of the dispatch ref:

 - name: Run Nerdbank.GitVersioning tool step
 id: nbgv
 uses: dotnet/nbgv@master
 env:
 # Version from the checked-out branch, not the CI ref. GITHUB_REF is reserved and a step env can't reliably
 # override it; IGNORE_GITHUB_REF makes NBGV ignore it and use the checked-out branch. validate-release backstops.
 IGNORE_GITHUB_REF: "true"

Do not add a branch input to get-version-task.yml or thread branch into its callers - that was the ineffective #215 approach and is unnecessary.

A2. build-release-task.yml - validate-at-entry gate (smoke-skipped)

Add a validate-release job (right after get-version) that the build jobs needs:. It checks branch-versus-version consistency on real publishes and is skipped for smoke builds - a smoke build's detached PR HEAD always versions as prerelease, which would otherwise fail a main-base promotion PR (#219):

 validate-release:
 name: Validate release version job
 needs: [get-version]
 runs-on: ubuntu-latest
 steps:
 - name: Validate branch and version consistency step
 env:
 SEMVER2: ${{ needs.get-version.outputs.SemVer2 }}
 BRANCH: ${{ inputs.branch }}
 SMOKE: ${{ inputs.smoke }}
 run: |
 set -euo pipefail
 # Smoke builds never publish and always version as prerelease (detached PR HEAD), which would trip the main arm.
 if [[ "$SMOKE" == "true" ]]; then
 echo "Smoke build; skipping release version validation."
 exit 0
 fi
 CORE_AND_PRE="${SEMVER2%%+*}"
 if [[ "$BRANCH" == "main" ]]; then
 if [[ "$CORE_AND_PRE" == *-* ]]; then
 echo "::error::Public (main) release version '$SEMVER2' carries a prerelease suffix; refusing to publish."
 exit 1
 fi
 elif [[ "$CORE_AND_PRE" != *-* ]]; then
 echo "::error::Prerelease ($BRANCH) version '$SEMVER2' has no prerelease suffix (NBGV classified it public); refusing to publish."
 exit 1
 fi

• build-nugetlibrary job: needs: [get-version] -> needs: [get-version, validate-release]
• github-release job: add validate-release to its needs:
• Remove the old Verify public release version step from github-release (the entry gate covers it both directions).

B. #214 — surgical consume-then-delete, drop the blanket cleanup

B1. build-release-task.yml github-release job — delete the consumed assets

After the Create GitHub release step, add:

Includes the #217 refinement (template PR ptr727/ProjectTemplate#218): the delete is gated on the same if: as the Create step (steps.release-exists is the existing "Check for existing release step" already in this job), so a scheduled re-run on an existing tag doesn't delete the freshly built artifacts. If you already applied an earlier un-gated version of this step, just update its if: line to match below.

 # Surgical cleanup at the point of consumption: the release-asset-<branch>-* transfer artifacts now have durable
 # copies on the release, so delete them by exact pattern. Gated to the same condition as the Create step so it only
 # deletes when a release was actually created/refreshed this run; on a skipped create (existing tag, no new
 # commits) the fresh artifacts stay for the run, reaped by the retention-days: 1 backstop. Best-effort: a
 # listing/delete hiccup must not red the job. Deletes every matching id. Needs the caller `actions: write` (B2).
 - name: Delete consumed release asset artifacts step
 if: ${{ inputs.expect_release_assets && (steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch') }}
 continue-on-error: true
 env:
 GH_TOKEN: ${{ github.token }}
 run: |
 set -euo pipefail
 if ! ids=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/${{ github.run_id }}/artifacts" --paginate \
 --jq ".artifacts[] | select(.name | startswith(\"release-asset-${{ inputs.branch }}-\")) | .id"); then
 echo "::warning::Could not list run artifacts; retention-days backstop will reap them."
 ids=""
 fi
 for id in $ids; do
 gh api --method DELETE "repos/$GITHUB_REPOSITORY/actions/artifacts/$id" \
 || echo "::warning::Failed to delete artifact $id; retention-days backstop will reap it."
 done

B2. publish-release.yml

• On the publish job (the one that uses: ./.github/workflows/build-release-task.yml), add actions: write next to contents: write so the github-release job can delete:

   permissions:
   contents: write
   # actions:write lets the github-release job delete the release-asset-* artifacts it consumes (surgical cleanup).
   actions: write

• Remove the cleanup-artifacts job entirely. (No publish-pypi here — single target — so no other consume-then-delete is needed.)

B3. test-pull-request.yml

• Remove the cleanup-artifacts job entirely. check-workflow-status does not list it in needs:, so the required merge check is unaffected. Smoke builds upload no release-asset-* (gated on !smoke), so there is nothing left to clean here.

B4. Confirm the backstop

retention-days: 1 must be set on the release-asset-<branch>-nugetlibrary upload in build-nugetlibrary-task.yml (it is the failure-path backstop for B1/B2).

---

C. #211 — rulesets: nothing to carry here

Branch rulesets are now maintained only in the template as .github/rulesets/{develop,main}.json (template PR ptr727/ProjectTemplate#212); they are not carried/re-synced as a per-repo file. This repo's live rulesets were already verified in sync with the template's committed JSON, so there is nothing to do. To re-confirm, run the drift check from the template's AGENTS.md "Staying in Sync" (from a template checkout, against ptr727/LanguageTags).

---

Verify

• actionlint clean: docker run --rm -v "$PWD":/repo --workdir /repo rhysd/actionlint:latest
• validate-release fails a synthetic clean-X.Y.Z develop version and passes a X.Y.Z-g<sha> one; runs before the build job.
• After a real publish: no release-asset-* artifacts remain (consumed-then-deleted), diagnostics/build-records are retained; a forced mid-run failure leaves its artifact for retention-days: 1 rather than red-failing cleanup.
• CRLF preserved on every touched workflow file.

Once this is validated, the same set of changes (adapted per repo's target set) will be re-synced to the other derived repos.

[ptr727]

Updated the runbook (section B1) to include the #217 follow-up, fixed upstream in template PR ptr727/ProjectTemplate#218.

If you already applied the earlier consume-then-delete step, the only change needed is the delete step's if: — gate it on the same condition as the Create step so a scheduled re-run on an existing tag doesn't delete the freshly built artifacts:

# .github/workflows/build-release-task.yml — github-release job, Delete consumed release asset artifacts step
- if: ${{ inputs.expect_release_assets }}
+ if: ${{ inputs.expect_release_assets && (steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch') }}

steps.release-exists is the existing "Check for existing release step" already in that job, so no other change is needed.

[ptr727]

Migration note — if you already applied the earlier Section A. The template has since converged (PRs ptr727/ProjectTemplate#222 for #221, #220 for #219). Two deltas from the version you applied:

1. Replace the ineffective GITHUB_REF override with IGNORE_GITHUB_REF (#221). In get-version-task.yml:

• Remove the branch input you added, and remove the branch: line from the get-version call in build-release-task.yml and build-nugetlibrary-task.yml.
• On the nbgv step, swap the env:

# .github/workflows/get-version-task.yml — Run Nerdbank.GitVersioning tool step
 env:
- GITHUB_REF: ${{ inputs.branch != '' && format('refs/heads/{0}', inputs.branch) || github.ref }}
- GITHUB_REF_NAME: ${{ inputs.branch != '' && inputs.branch || github.ref_name }}
+ IGNORE_GITHUB_REF: "true"

2. Smoke-skip the validate-release gate (#219). It otherwise fails every develop → main promotion PR that carries a build change (smoke builds version as prerelease in detached HEAD). Add to the validate step:

 env:
 SEMVER2: ${{ needs.get-version.outputs.SemVer2 }}
 BRANCH: ${{ inputs.branch }}
+ SMOKE: ${{ inputs.smoke }}
 run: |
 set -euo pipefail
+ # Smoke builds never publish and always version as prerelease (detached PR HEAD), which would trip the main arm.
+ if [[ "$SMOKE" == "true" ]]; then
+ echo "Smoke build; skipping release version validation."
+ exit 0
+ fi
 CORE_AND_PRE="${SEMVER2%%+*}"

(The #217 delete-step gating from the earlier comment still applies.) Section A of the issue body is now updated to this final state for any fresh application.