feat: drive CI/CD pipeline through dev-cli workflow command

Replace the build/test-only GitHub workflow with the timewarp-nuru
pattern: a single `dev workflow` invocation that auto-detects mode
from GITHUB_EVENT_NAME. PR/merge runs clean -> build -> test;
release runs check-version -> clean -> build -> push to NuGet.

- workflow-command.cs: add mode detection and --api-key option,
  invoke sibling handlers in-process (no self-install needed in CI),
  verify release tag matches Version, push the nupkg from
  artifacts/packages
- workflow.yml: restore release/workflow_dispatch triggers and path
  filters from ci-cd.yml.bak, pass PUBLISH_TO_NUGET_ORG on releases,
  upload artifacts with if: always()
- Directory.Build.props: rename PackageVersion to Version so ganda
  repo check-version can read it (org convention; PackageVersion is
  derived from Version so the nupkg is unchanged)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: StevenTCramer

.github/workflows/workflow.yml

@@ -2,19 +2,56 @@ name: CI/CD
 
 on:
   push:
-    branches: [ master, main ]
+    branches:
+      - master
+    paths:
+      - 'source/**'
+      - 'tests/**'
+      - 'tools/**'
+      - '.github/workflows/**'
+      - 'Directory.Build.props'
+      - 'Directory.Packages.props'
   pull_request:
-    branches: [ master, main ]
+    branches:
+      - master
+    paths:
+      - 'source/**'
+      - 'tests/**'
+      - 'tools/**'
+      - '.github/workflows/**'
+      - 'Directory.Build.props'
+      - 'Directory.Packages.props'
+  release:
+    types: [published] # Triggered when a release is published via GitHub Releases UI or gh CLI
+  workflow_dispatch:
 
 jobs:
-  build:
+  ci:
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: '10.0.x'
-      - name: Build
-        run: dotnet run tools/dev-cli/dev.cs -- build
-      - name: Test
-        run: dotnet run tools/dev-cli/dev.cs -- test
+
+      - name: Run CI Pipeline
+        run: |
+          if [ "${{ github.event_name }}" == "release" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            dotnet run --file tools/dev-cli/dev.cs -- workflow --api-key "${{ secrets.PUBLISH_TO_NUGET_ORG }}"
+          else
+            dotnet run --file tools/dev-cli/dev.cs -- workflow
+          fi
+
+      - name: Upload Artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: Packages-${{ github.run_number }}
+          path: artifacts/packages/*.nupkg
+          if-no-files-found: ignore

source/Directory.Build.props

@@ -4,7 +4,7 @@
 
   <!-- Default package metadata (can be overridden in individual projects) -->
   <PropertyGroup Label="Package Metadata">
-    <PackageVersion>1.0.0-beta.4</PackageVersion>
+    <Version>1.0.0-beta.4</Version>
     <Authors>Steven T. Cramer</Authors>
     <Company>TimeWarp Enterprises</Company>
     <Product>TimeWarp.OptionsValidation</Product>

tools/dev-cli/endpoints/workflow-command.cs

@@ -1,23 +1,34 @@
 #region Purpose
-// Executes the full CI workflow
+// Executes the full CI/CD pipeline with mode detection
 #endregion
 #region Design
-// Runs clean, build, test sequentially by invoking ./bin/dev subcommands
-// Handler stores RepoRoot and DevBin as fields so private methods are zero-parameter
-// RunStepAsync DRYs up the identical shell-invoke/exit-code-check pattern
+// Auto-detects mode from GITHUB_EVENT_NAME or accepts explicit --mode flag
+//   pr/merge: clean -> build -> test
+//   release:  check-version -> clean -> build -> push (build packs via GeneratePackageOnBuild)
+// Invokes sibling command handlers in-process so CI needs no self-install
+// Release version comes from Version in source/Directory.Build.props and
+// must match the git tag (GITHUB_REF_NAME) on release events
 #endregion
 
 namespace DevCli.Commands;
 
-[NuruRoute("workflow", Description = "Execute full CI workflow")]
+[NuruRoute("workflow", Description = "Execute full CI/CD pipeline")]
 internal sealed class WorkflowCommand : ICommand<Unit>
 {
+  [Option("mode", "m", Description = "CI mode: pr, merge, or release (auto-detected from GITHUB_EVENT_NAME if not specified)")]
+  public string? Mode { get; set; }
+
+  [Option("api-key", Description = "NuGet API key for publishing (release mode only)")]
+  public string? ApiKey { get; set; }
+
   internal sealed class Handler : ICommandHandler<WorkflowCommand, Unit>
   {
+    private const string PackageId = "TimeWarp.OptionsValidation";
+    private const string NuGetSource = "https://api.nuget.org/v3/index.json";
+
     private readonly ITerminal Terminal;
     private CancellationToken Ct;
     private string RepoRoot = null!;
-    private string DevBin = null!;
 
     public Handler(ITerminal terminal)
     {
@@ -29,11 +40,22 @@ public async ValueTask<Unit> Handle(WorkflowCommand command, CancellationToken c
       Ct = ct;
 
       if (!FindRepoRoot()) return Value;
-      if (!await RunStepAsync("clean", "Clean failed!")) return Value;
-      if (!await RunStepAsync("build", "Build failed!")) return Value;
-      if (!await RunStepAsync("test", "Tests failed!")) return Value;
 
-      Terminal.WriteLine("\nWorkflow completed successfully!".Green());
+      CiMode mode = DetermineMode(command.Mode);
+      Terminal.WriteLine($"Starting CI workflow (mode: {mode})...");
+
+      if (mode == CiMode.Release)
+      {
+        await RunReleaseWorkflowAsync(command.ApiKey);
+      }
+      else
+      {
+        await RunPrWorkflowAsync();
+      }
+
+      if (Environment.ExitCode == 0)
+        Terminal.WriteLine("\nWorkflow completed successfully!".Green());
+
       return Value;
     }
 
@@ -47,25 +69,140 @@ private bool FindRepoRoot()
         return false;
       }
       RepoRoot = root;
-      DevBin = Path.Combine(RepoRoot, "bin", "dev");
-      Terminal.WriteLine("Starting CI workflow...");
       return true;
     }
 
-    private async Task<bool> RunStepAsync(string subcommand, string failureMessage)
+    private CiMode DetermineMode(string? explicitMode)
+    {
+      if (!string.IsNullOrEmpty(explicitMode))
+      {
+        return explicitMode.ToLowerInvariant() switch
+        {
+          "release" => CiMode.Release,
+          "merge" => CiMode.Merge,
+          _ => CiMode.Pr
+        };
+      }
+
+      string? eventName = Environment.GetEnvironmentVariable("GITHUB_EVENT_NAME");
+
+      CiMode mode = eventName switch
+      {
+        "push" => CiMode.Merge,
+        "release" => CiMode.Release,
+        "workflow_dispatch" => CiMode.Release,
+        _ => CiMode.Pr // pull_request and local dev
+      };
+
+      Terminal.WriteLine($"Detected GITHUB_EVENT_NAME: {eventName ?? "(not set)"} -> Mode: {mode}");
+      return mode;
+    }
+
+    private async Task RunPrWorkflowAsync()
+    {
+      if (!await RunStepAsync("Clean", () => new CleanCommand.Handler(Terminal).Handle(new CleanCommand(), Ct))) return;
+      if (!await RunStepAsync("Build", () => new BuildCommand.Handler(Terminal).Handle(new BuildCommand(), Ct))) return;
+      await RunStepAsync("Test", () => new TestCommand.Handler(Terminal).Handle(new TestCommand(), Ct));
+    }
+
+    private async Task RunReleaseWorkflowAsync(string? apiKey)
     {
-      int exitCode = await Shell.Builder(DevBin)
-        .WithArguments(subcommand)
+      string? version = ReadVersion();
+      if (version is null)
+      {
+        Terminal.WriteErrorLine("Error: could not read Version from source/Directory.Build.props.".Red());
+        Environment.ExitCode = 1;
+        return;
+      }
+
+      if (!CheckVersionMatchesTag(version)) return;
+      if (!await RunStepAsync("Clean", () => new CleanCommand.Handler(Terminal).Handle(new CleanCommand(), Ct))) return;
+      if (!await RunStepAsync("Build", () => new BuildCommand.Handler(Terminal).Handle(new BuildCommand(), Ct))) return;
+      await PushPackageAsync(version, apiKey);
+    }
+
+    private async Task<bool> RunStepAsync(string title, Func<ValueTask<Unit>> step)
+    {
+      Terminal.WriteLine($"\n=== {title} ===");
+      await step();
+
+      if (Environment.ExitCode != 0)
+      {
+        Terminal.WriteErrorLine($"{title} failed!".Red());
+        return false;
+      }
+      return true;
+    }
+
+    private string? ReadVersion()
+    {
+      string propsPath = Path.Combine(RepoRoot, "source", "Directory.Build.props");
+      if (!File.Exists(propsPath)) return null;
+
+      Match match = Regex.Match(File.ReadAllText(propsPath), "<Version>(.+?)</Version>");
+      return match.Success ? match.Groups[1].Value : null;
+    }
+
+    private bool CheckVersionMatchesTag(string version)
+    {
+      // Only enforce on tag-triggered releases; workflow_dispatch has no tag
+      if (Environment.GetEnvironmentVariable("GITHUB_EVENT_NAME") != "release") return true;
+
+      string? tag = Environment.GetEnvironmentVariable("GITHUB_REF_NAME");
+      string? tagVersion = tag?.TrimStart('v');
+
+      if (tagVersion != version)
+      {
+        Terminal.WriteErrorLine($"Error: release tag '{tag}' does not match Version '{version}'.".Red());
+        Environment.ExitCode = 1;
+        return false;
+      }
+
+      Terminal.WriteLine($"Release tag '{tag}' matches Version '{version}'.");
+      return true;
+    }
+
+    private async Task PushPackageAsync(string version, string? apiKey)
+    {
+      Terminal.WriteLine("\n=== Push to NuGet ===");
+
+      string nupkgPath = Path.Combine(RepoRoot, "artifacts", "packages", $"{PackageId}.{version}.nupkg");
+      if (!File.Exists(nupkgPath))
+      {
+        Terminal.WriteErrorLine($"Error: package not found: {nupkgPath}".Red());
+        Environment.ExitCode = 1;
+        return;
+      }
+
+      Terminal.WriteLine($"Pushing {PackageId}.{version}.nupkg...");
+
+      List<string> args = ["nuget", "push", nupkgPath, "--source", NuGetSource, "--skip-duplicate"];
+      if (!string.IsNullOrEmpty(apiKey))
+      {
+        args.AddRange(["--api-key", apiKey]);
+      }
+
+      int exitCode = await Shell.Builder("dotnet")
+        .WithArguments([.. args])
+        .WithWorkingDirectory(RepoRoot)
         .WithNoValidation()
         .RunAsync(Ct);
 
       if (exitCode != 0)
       {
-        Terminal.WriteErrorLine(failureMessage.Red());
+        Terminal.WriteErrorLine("Push failed!".Red());
         Environment.ExitCode = exitCode;
-        return false;
+        return;
       }
-      return true;
+
+      Terminal.WriteLine($"\nPublished {PackageId} {version} to NuGet.org!".Green());
     }
   }
 }
+
+internal enum CiMode
+{
+  Pr,
+  Merge,
+  Release
+}

tools/dev-cli/global-usings.cs

@@ -11,6 +11,7 @@
 global using System.Diagnostics;
 global using System.Runtime.CompilerServices;
 global using System.Runtime.InteropServices;
+global using System.Text.RegularExpressions;
 
 global using TimeWarp.Nuru;
 global using static TimeWarp.Nuru.Unit;