diff --git a/.actrc b/.actrc
new file mode 100644
index 00000000..5bfafa31
--- /dev/null
+++ b/.actrc
@@ -0,0 +1,11 @@
+# act configuration for local workflow testing.
+# See: https://nektosact.com/usage/index.html
+
+# Use full Ubuntu image (has dotnet, node, bun, gh CLI pre-installed)
+-P ubuntu-latest=catthehacker/ubuntu:full-latest
+
+# Load secrets from local .secrets file (never commit this file)
+--secret-file .secrets
+
+# Load env vars for act-specific overrides
+--env-file .env.act
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 133a7247..c96c4655 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -142,15 +142,29 @@ jobs:
             PRERELEASE_FLAG="--prerelease"
           fi
 
-          # Create as draft first — draft releases are never immutable, so assets
-          # can be freely attached. The release becomes immutable only after --draft=false.
+          # Collect assets safely and fail if no package output exists.
+          shopt -s nullglob
+          PACKAGES=( ./artifacts/nuget/*.nupkg )
+          SYMBOLS=( ./artifacts/nuget/*.snupkg )
+          shopt -u nullglob
+
+          if (( ${#PACKAGES[@]} == 0 )); then
+            echo "::error::No .nupkg package assets found in ./artifacts/nuget."
+            exit 1
+          fi
+
+          if (( ${#SYMBOLS[@]} == 0 )); then
+            echo "::warning::No .snupkg symbol assets found in ./artifacts/nuget."
+          fi
+
+          ASSETS=( "${PACKAGES[@]}" "${SYMBOLS[@]}" )
+
           gh release create "${RELEASE_TAG}" \
             --draft \
             --title "${RELEASE_TAG}" \
             --generate-notes \
             ${PRERELEASE_FLAG} \
-            ./artifacts/nuget/*.nupkg \
-            ./artifacts/nuget/*.snupkg
+            "${ASSETS[@]}"
 
           # Publish: marks as latest and becomes immutable. Any retry will clean up above.
           gh release edit "${RELEASE_TAG}" \
diff --git a/.gitignore b/.gitignore
index 07797e26..33ab702a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -197,3 +197,7 @@ node_modules/
 
 # BenchmarkDotNet output
 BenchmarkDotNet.Artifacts/!scripts/*
+
+# act local secrets
+.secrets
+.env.act
diff --git a/.secrets.template b/.secrets.template
new file mode 100644
index 00000000..4fe7c8b2
--- /dev/null
+++ b/.secrets.template
@@ -0,0 +1,3 @@
+# Template — copy to .secrets (gitignored) and fill in values.
+# Used by act for local workflow testing.
+GITHUB_TOKEN=<your-pat-with-contents:write-and-packages:write>