From d93199257b3087f3de1e49fa138e8f6c88da9f3e Mon Sep 17 00:00:00 2001
From: Kieron Lanning <kieronlanning@users.noreply.github.com>
Date: Sun, 24 May 2026 17:36:32 +0100
Subject: [PATCH 1/2] fix(cd): add SymbolPackageFormat=snupkg and safe glob for
 release assets

- dotnet pack without SymbolPackageFormat=snupkg produces .symbols.nupkg, not .snupkg
- Use nullglob so the release create doesn't fail if a glob matches nothing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .actrc                   | 11 +++++++++++
 .github/workflows/cd.yml | 11 +++++++----
 .gitignore               |  4 ++++
 .secrets.template        |  3 +++
 4 files changed, 25 insertions(+), 4 deletions(-)
 create mode 100644 .actrc
 create mode 100644 .secrets.template

diff --git a/.actrc b/.actrc
new file mode 100644
index 00000000..5bfafa31
--- /dev/null
+++ b/.actrc
@@ -0,0 +1,11 @@
+# act configuration for local workflow testing.
+# See: https://nektosact.com/usage/index.html
+
+# Use full Ubuntu image (has dotnet, node, bun, gh CLI pre-installed)
+-P ubuntu-latest=catthehacker/ubuntu:full-latest
+
+# Load secrets from local .secrets file (never commit this file)
+--secret-file .secrets
+
+# Load env vars for act-specific overrides
+--env-file .env.act
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 133a7247..4c6e14b0 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -142,15 +142,18 @@ jobs:
             PRERELEASE_FLAG="--prerelease"
           fi
 
-          # Create as draft first — draft releases are never immutable, so assets
-          # can be freely attached. The release becomes immutable only after --draft=false.
+          # *.nupkg matches both the main package and *.symbols.nupkg.
+          # nullglob prevents failures if either pattern matches nothing.
+          shopt -s nullglob
+          ASSETS=( ./artifacts/nuget/*.nupkg )
+          shopt -u nullglob
+
           gh release create "${RELEASE_TAG}" \
             --draft \
             --title "${RELEASE_TAG}" \
             --generate-notes \
             ${PRERELEASE_FLAG} \
-            ./artifacts/nuget/*.nupkg \
-            ./artifacts/nuget/*.snupkg
+            "${ASSETS[@]}"
 
           # Publish: marks as latest and becomes immutable. Any retry will clean up above.
           gh release edit "${RELEASE_TAG}" \
diff --git a/.gitignore b/.gitignore
index 07797e26..33ab702a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -197,3 +197,7 @@ node_modules/
 
 # BenchmarkDotNet output
 BenchmarkDotNet.Artifacts/!scripts/*
+
+# act local secrets
+.secrets
+.env.act
diff --git a/.secrets.template b/.secrets.template
new file mode 100644
index 00000000..4fe7c8b2
--- /dev/null
+++ b/.secrets.template
@@ -0,0 +1,3 @@
+# Template — copy to .secrets (gitignored) and fill in values.
+# Used by act for local workflow testing.
+GITHUB_TOKEN=<your-pat-with-contents:write-and-packages:write>

From 6f1cc517a5be9c20972be92d975e2a5e8674f2a7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 24 May 2026 17:19:27 +0000
Subject: [PATCH 2/2] fix(cd): fail release if no nupkg assets are found

Agent-Logs-Url: https://github.com/kjldev/purview-telemetry-sourcegenerator/sessions/7aa7cf82-b45e-4619-92d2-1a55a51d5779

Co-authored-by: kieronlanning <5364423+kieronlanning@users.noreply.github.com>
---
 .github/workflows/cd.yml | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 4c6e14b0..c96c4655 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -142,12 +142,23 @@ jobs:
             PRERELEASE_FLAG="--prerelease"
           fi
 
-          # *.nupkg matches both the main package and *.symbols.nupkg.
-          # nullglob prevents failures if either pattern matches nothing.
+          # Collect assets safely and fail if no package output exists.
           shopt -s nullglob
-          ASSETS=( ./artifacts/nuget/*.nupkg )
+          PACKAGES=( ./artifacts/nuget/*.nupkg )
+          SYMBOLS=( ./artifacts/nuget/*.snupkg )
           shopt -u nullglob
 
+          if (( ${#PACKAGES[@]} == 0 )); then
+            echo "::error::No .nupkg package assets found in ./artifacts/nuget."
+            exit 1
+          fi
+
+          if (( ${#SYMBOLS[@]} == 0 )); then
+            echo "::warning::No .snupkg symbol assets found in ./artifacts/nuget."
+          fi
+
+          ASSETS=( "${PACKAGES[@]}" "${SYMBOLS[@]}" )
+
           gh release create "${RELEASE_TAG}" \
             --draft \
             --title "${RELEASE_TAG}" \