fix(cd): add SymbolPackageFormat=snupkg and safe glob for release assets

- dotnet pack without SymbolPackageFormat=snupkg produces .symbols.nupkg, not .snupkg
- Use nullglob so the release create doesn't fail if a glob matches nothing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: kieronlanning

.actrc

@@ -0,0 +1,11 @@
+# act configuration for local workflow testing.
+# See: https://nektosact.com/usage/index.html
+
+# Use full Ubuntu image (has dotnet, node, bun, gh CLI pre-installed)
+-P ubuntu-latest=catthehacker/ubuntu:full-latest
+
+# Load secrets from local .secrets file (never commit this file)
+--secret-file .secrets
+
+# Load env vars for act-specific overrides
+--env-file .env.act

.github/workflows/cd.yml

@@ -142,15 +142,18 @@ jobs:
             PRERELEASE_FLAG="--prerelease"
           fi
 
-          # Create as draft first — draft releases are never immutable, so assets
-          # can be freely attached. The release becomes immutable only after --draft=false.
+          # *.nupkg matches both the main package and *.symbols.nupkg.
+          # nullglob prevents failures if either pattern matches nothing.
+          shopt -s nullglob
+          ASSETS=( ./artifacts/nuget/*.nupkg )
+          shopt -u nullglob
+
           gh release create "${RELEASE_TAG}" \
             --draft \
             --title "${RELEASE_TAG}" \
             --generate-notes \
             ${PRERELEASE_FLAG} \
-            ./artifacts/nuget/*.nupkg \
-            ./artifacts/nuget/*.snupkg
+            "${ASSETS[@]}"
 
           # Publish: marks as latest and becomes immutable. Any retry will clean up above.
           gh release edit "${RELEASE_TAG}" \

.gitignore

@@ -197,3 +197,7 @@ node_modules/
 
 # BenchmarkDotNet output
 BenchmarkDotNet.Artifacts/!scripts/*
+
+# act local secrets
+.secrets
+.env.act

.secrets.template

@@ -0,0 +1,3 @@
+# Template — copy to .secrets (gitignored) and fill in values.
+# Used by act for local workflow testing.
+GITHUB_TOKEN=<your-pat-with-contents:write-and-packages:write>