Fix stale documentation now that 0.1.0 is published

- README/CONTRIBUTING: drop "not yet published"/"environment needs to
  be created" framing now that the package is live and the environment
  is already set up; document the publish job's permissions gotcha
  (job-level permissions replace, not merge with, workflow-level ones).
- SECURITY.md: remove the "community-maintained, unofficial" framing -
  this is now Monnify's own repo and package.
- CHANGELOG: move the accumulated Unreleased entries under a real
  [0.1.0] - 2026-06-29 release, merge a duplicated Fixed header, and
  open a fresh Unreleased section for future work.
- IntegrationTests README: corrected how CI actually skips sandbox
  tests (no --filter flag - it relies on SkippableFact plus the
  runner never having sandbox credentials).

Author: GREENFONTS

CHANGELOG.md

@@ -11,13 +11,20 @@ own version is independent of Monnify's API versioning.
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-06-29
+
 ### Fixed
 - Error responses that don't match Monnify's standard envelope (a gateway-level rejection, an
   HTTP error page, or any 401/403 returned because a feature like Disbursements isn't activated
   for the merchant yet) now surface a clear fallback message instead of an empty
   `responseCode`/`responseMessage`. The envelope's string fields were defaulting to `""` rather
   than `null`, which silently defeated the fallback logic in both `MonnifyHttpClientBase` and
   `MonnifyTokenProvider`.
+- `SECURITY.md` still described the webhook signature scheme as plain
+  `SHA-512(secretKey + rawBody)` from before that was corrected to
+  `HMAC-SHA512` earlier in this project - updated to match what
+  `MonnifyWebhookValidator` actually implements, plus a note that sandbox
+  sends no signature header at all.
 
 ### Added
 - Initial repository scaffolding: solution layout, Central Package Management,
@@ -145,10 +152,3 @@ own version is independent of Monnify's API versioning.
   `config.yml` redirecting security reports to private vulnerability
   reporting) and `.github/PULL_REQUEST_TEMPLATE.md` matching the checklist
   already documented in `CONTRIBUTING.md`.
-
-### Fixed
-- `SECURITY.md` still described the webhook signature scheme as plain
-  `SHA-512(secretKey + rawBody)` from before that was corrected to
-  `HMAC-SHA512` earlier in this project - updated to match what
-  `MonnifyWebhookValidator` actually implements, plus a note that sandbox
-  sends no signature header at all.

CONTRIBUTING.md

@@ -41,20 +41,21 @@ bump.
 
 Pushing a `vX.Y.Z` tag triggers [release.yml](.github/workflows/release.yml),
 which builds, tests, and packs, then **requires manual approval** before
-publishing: the publish job runs under a `nuget-release` GitHub Environment.
-Before the first release, that environment needs to be created (Settings →
-Environments) with required reviewers.
+publishing: the publish job runs under a `nuget-release` GitHub Environment
+(already configured with required reviewers).
 
 Publishing itself uses [NuGet Trusted Publishing](https://learn.microsoft.com/en-us/nuget/nuget-org/trusted-publishing)
 (OIDC) rather than a stored API key — the workflow exchanges a short-lived
 GitHub token for a temporary (~1hr) NuGet API key at publish time, so there's
-no long-lived secret to leak or rotate. This requires a matching policy on
-nuget.org (your account → Trusted Publishing) with Repository Owner=`Monnify`,
+no long-lived secret to leak or rotate. The matching policy on nuget.org
+(account → Trusted Publishing) has Repository Owner=`Monnify`,
 Repository=`monnify-dotnet-lib`, Workflow File=`release.yml`,
 Environment=`nuget-release` — the environment restriction means a token is
 only trusted if it came from a run that passed through that approval gate.
-The only secret still needed is `NUGET_USER` (the nuget.org profile username,
-not the account email), scoped to the `nuget-release` environment. Until the
-environment and the nuget.org policy both exist, the publish job has no
-reviewers and nothing will publish, which is the intended state until this is
-deliberately set up.
+The only secret involved is `NUGET_USER` (the nuget.org profile username,
+not the account email), scoped to the `nuget-release` environment.
+
+Both the `id-token: write` (OIDC) and `contents: write` (creating the GitHub
+Release) permissions need to be listed explicitly on the `publish` job —
+job-level `permissions:` replaces the workflow-level block entirely for that
+job rather than adding to it, so listing only one silently drops the other.

README.md

@@ -6,7 +6,8 @@
 An idiomatic .NET SDK for the [Monnify](https://developers.monnify.com)
 payment gateway API, targeting `netstandard2.0` and `net8.0`.
 
-> **Status: pre-release.** Not yet published to NuGet.org. See
+> **Status: early release (pre-1.0).** Published on NuGet.org starting with
+> `0.1.0` — the public API may still change before a stable `1.0`. See
 > [docs/COMPATIBILITY.md](docs/COMPATIBILITY.md) for every endpoint this SDK
 > calls and how it was verified.
 
@@ -27,11 +28,8 @@ payment gateway API, targeting `netstandard2.0` and `net8.0`.
 
 ## Install
 
-Not yet published to NuGet.org (see Status above). Until then, reference the
-project directly or build the `.nupkg` locally:
-
 ```bash
-dotnet pack src/Monnify/Monnify.csproj -c Release
+dotnet add package Monnify
 ```
 
 ## Configure

SECURITY.md

@@ -2,9 +2,8 @@
 
 ## Reporting a Vulnerability
 
-This is a community-maintained, unofficial SDK for the Monnify payment gateway
-API. If you discover a security vulnerability in this SDK (not in Monnify's
-own platform), please report it privately via GitHub's
+If you discover a security vulnerability in this SDK (not in Monnify's own
+platform), please report it privately via GitHub's
 [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability)
 feature on this repository rather than opening a public issue.
 

tests/Monnify.IntegrationTests/README.md

@@ -7,8 +7,9 @@ alongside the mocked unit tests in `Monnify.Tests` (see
 
 They're tagged `[Trait("Category", "Sandbox")]` and use `[SkippableFact]`
 (`Xunit.SkippableFact`) so they **skip silently rather than fail** when
-credentials aren't available — CI never has sandbox credentials and excludes
-this category entirely via `--filter "Category!=Sandbox"`.
+credentials aren't available — CI runs `dotnet test` with no filter, but
+since it never has sandbox credentials configured, `SandboxCredentials.IsAvailable`
+is `false` and every test in this project reports as `Skipped`, not `Failed`.
 
 ## Running locally