From 9f2bbfb5dd719df15baa33edd5fd3b47542332f0 Mon Sep 17 00:00:00 2001
From: Michael Trosper <140276486+Trosper3@users.noreply.github.com>
Date: Mon, 12 Oct 2026 13:25:33 -0600
Subject: [PATCH 1/2] Add CI and a tag-triggered NuGet publish workflow

---
 .github/workflows/ci.yml      | 23 +++++++++++++++++++++++
 .github/workflows/publish.yml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..55bb012
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            6.0.x
+            8.0.x
+      - name: Build
+        run: dotnet build DiscreteParser.csproj -c Release
+      # The test project arrives with the first fix PR; until then there is nothing to run.
+      - name: Test
+        if: hashFiles('tests/SPADE.Tests/SPADE.Tests.csproj') != ''
+        run: dotnet test tests/SPADE.Tests/SPADE.Tests.csproj -c Release
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..04721f7
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,31 @@
+name: Publish to NuGet
+
+# Push a tag v<Version> (matching <Version> in DiscreteParser.csproj) to build, test and publish that version.
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            6.0.x
+            8.0.x
+      - name: Check the tag matches the project version
+        run: |
+          version=$(grep -oP '(?<=<Version>)[^<]+' DiscreteParser.csproj)
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match <Version>$version</Version> in DiscreteParser.csproj"
+            exit 1
+          fi
+      - name: Test
+        if: hashFiles('tests/SPADE.Tests/SPADE.Tests.csproj') != ''
+        run: dotnet test tests/SPADE.Tests/SPADE.Tests.csproj -c Release
+      - name: Pack
+        run: dotnet pack DiscreteParser.csproj -c Release -o out
+      - name: Push
+        run: dotnet nuget push "out/*.nupkg" --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate

From e235a17d6696aa12b62900fdd01e3001830e1813 Mon Sep 17 00:00:00 2001
From: Michael Trosper <140276486+Trosper3@users.noreply.github.com>
Date: Mon, 12 Oct 2026 15:45:10 -0600
Subject: [PATCH 2/2] ci(publish): use nuget.org trusted publishing instead of
 a stored API key

---
 .github/workflows/publish.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 04721f7..aa42087 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,6 +8,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # lets NuGet/login trade a GitHub OIDC token for a short-lived nuget.org key
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
@@ -27,5 +30,11 @@ jobs:
         run: dotnet test tests/SPADE.Tests/SPADE.Tests.csproj -c Release
       - name: Pack
         run: dotnet pack DiscreteParser.csproj -c Release -o out
+      # Trusted publishing: the nuget.org policy (owner Trosper3) must name ReduxISU/SPADE and publish.yml.
+      - name: NuGet login
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: Trosper3
       - name: Push
-        run: dotnet nuget push "out/*.nupkg" --api-key "${{ secrets.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
+        run: dotnet nuget push "out/*.nupkg" --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate