Harden and validate C# workflow

[konard]

Summary

Fixes every reproducible C# workflow warning and failure from #143 and makes hidden/skipped failures visible.

• merges the latest main changes that fixed compiler and NuGet package warnings
• replaces mutable scripts downloaded from linksplatform/Scripts with reviewed, repository-owned release, PDF, DocFX, and deployment logic
• replaces unavailable Ubuntu packages (nuget and Python 2 python-pygments) with supported tooling
• validates documentation on pull requests and transfers the generated PDF between runners instead of silently discarding it
• makes package, documentation, and GitHub release jobs warning-strict and dependency-gated
• adds a terminal status job so a failed publisher followed by skipped dependents cannot look successful
• disables persisted checkout credentials, adds bounded job timeouts, and suppresses Git's default-branch warning before checkout
• pins Ubuntu 24.04 before the ubuntu-latest migration and replaces the warning-producing artifact download action with gh run download
• adds release-credential preflight checks and documents the one limitation: NuGet.org does not provide a read-only API-key validation endpoint

The review comment linked link-foundation/charp-ai-driven-development-pipeline-template; that repository does not exist. I used the intended csharp-ai-driven-development-pipeline-template as the best-practices reference. It already implements the relevant default-branch, credential, timeout, and aggregate-status protections. Its workflows do share the newly surfaced ubuntu-latest warning, which is now reported in template issue #63. The Node Buffer() warning is an upstream action defect already tracked in actions/download-artifact#484.

Reproduction and root causes

The latest main C# run 35130869182 reproduced the remaining failures:

• NuGet.org rejected NUGET_TOKEN with HTTP 403
• documentation publishing tried to install an unavailable nuget Ubuntu package
• PDF generation tried to install the removed Python 2 python-pygments package
• Git checkout emitted the default initial-branch warning
• the PDF and documentation were built on separate runners without artifact transfer
• failed publishers could leave later jobs skipped without one authoritative pipeline result

The repository secret must be rotated by a maintainer before the next release. The workflow can detect a missing key, but only a real NuGet push can detect expiry or incorrect package scope.

Automated verification

• node --test .github/scripts/*.test.mjs — 25 passed
• .github/scripts/validate-csharp-package.sh — strict build, 2 tests, package-content validation, 0 warnings
• actionlint — passed
• shellcheck .github/scripts/*.sh — passed
• docfx docfx.json --warningsAsErrors with DocFX 2.80.1 — 0 warnings, 0 errors
• .github/scripts/generate-csharp-pdf.sh — generated an 8-page PDF locally
• negative deployment validation — correctly rejects a site missing its PDF

The new workflow-policy and aggregate-status tests reproduce the former false negatives and protect the corrected behavior.

Resolves #143

[konard]

We also should fix all errors, warnings, false positives and false negatives. And use https://github.com/link-foundation/charp-ai-driven-development-pipeline-template as example of best practices. If the similar issue is also present there we should report issue to that repository.

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-09-20T05:50:10.619Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

Runtime: solve v2.29.0 · tool codex · model gpt-5.6-sol · task image konard/hive-mind-dind:2.29.0@sha256:11a236d03854cbaea86fdd7ca06265c912cf0b67d1fcc9b3eb60bd84c43ff749

[konard]

Maintainer action is required before the next C# release: please rotate the repository NUGET_TOKEN secret.

The fresh main investigation log from run 35130869182 shows the package was created successfully, then NuGet.org returned HTTP 403: “The specified API key is invalid, has expired, or does not have permission” (downloaded log lines 488–493). The secret was last updated on 2022-12-02, and NuGet.org currently exposes Platform.Interfaces only through 0.5.0 while this repository is prepared to publish 0.5.2.

This PR adds a presence preflight and keeps GitHub release creation gated on successful publication. NuGet.org has no read-only API-key validation endpoint, so the workflow cannot safely prove expiry or package scope without performing the real push.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $11.869662

📊 Context and tokens usage:

• 505.2K / 200K (253%) input tokens, 54.1K / 128K (42%) output tokens

Total: (505.2K + 7.8M cached) input tokens, 54.1K output tokens, $11.869662 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: high (~23999 tokens)
• Model: GPT-5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (4098KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag