Fix and validate C# package publishing

[konard]

Summary

• Fix the NU5017 failures in both C# package publishing jobs while retaining embedded portable PDBs.
• Validate the build, tests, and final NuGet artifact on pull requests and before any publishing job runs.
• Remove the warnings found in the failed default-branch run and prevent a GitHub release from succeeding when either package registry publish fails.
• Update the C# package version to 0.5.2 for the repaired release.

Root cause and fix

The project requested a separate .snupkg with IncludeSymbols while also setting DebugType to embedded. Embedded symbols leave no standalone PDB content for the symbol package, so the SDK attempted to create an empty package and failed with NU5017.

This keeps DebugType=embedded (the behavior added for GitHub Package Registry debugging) and removes the incompatible separate-symbol-package request. A regression test reads the built PE debug directory and proves that its portable PDB is still embedded.

CI/CD audit

The failing default-branch C# run showed:

• both package publishing jobs failing with NU5017;
• ten nullable CS8600 warnings, deprecated PackageIconUrl, a missing package README advisory, and deprecated set-output usage;
• the release job succeeding in parallel despite both registries failing;
• no pull-request C# validation, allowing the package failure to reach main.

This PR addresses those paths by:

• adding a warning-strict package validator that checks one .nupkg, no .snupkg, and the expected DLL, README, and icon;
• running C# validation for pull requests while keeping secrets and publishing restricted to pushes to main;
• making the release depend on successful publication to both NuGet.org and GitHub Packages;
• using the same explicit, warning-strict pack command in both registry jobs;
• replacing obsolete output syntax and warning-producing package metadata;
• updating Actions to Node 24-based releases and upgrading tj-actions/changed-files to its Node 24-based v47 release;
• restricting Dependabot auto-merge to Dependabot PRs, removing its unnecessary old checkout action, and adding job timeouts.

Verification

• C# pull-request validation: passed with 2 tests and zero build/package warnings or errors.
• README/workflow validation: passed without annotations.
• Codacy static analysis: passed.
• Local: .github/scripts/validate-csharp-package.sh, actionlint, README badge tests/check, shell syntax validation, and git diff --check all passed.

The current auto-merge check still displays the two warnings emitted by the old workflow on main. This is expected for pull_request_target, which loads its workflow definition from the base branch rather than from this PR. The changed workflow in this PR removes both causes; GitHub can first execute that version after merge.

Resolves #142.

Also addresses the warning cleanup tracked in #143.

[konard]

double check that all CI/CD warnings, errors, false positive and false negative are fully solved in this pull request, check how CI/CD operated on default branch and so on.

[konard]

🤖 AI Work Session Started

Starting automated work session at 2026-09-16T17:16:27.447Z

The PR has been converted to draft mode while work is in progress.

This comment marks the beginning of an AI work session. Please wait for the session to finish, and provide your feedback.

Runtime: solve v2.29.0 · tool codex · model gpt-5.6-sol · task image konard/hive-mind-dind:2.29.0@sha256:11a236d03854cbaea86fdd7ca06265c912cf0b67d1fcc9b3eb60bd84c43ff749

[konard]

Completed the requested end-to-end CI/CD audit.

The last C# run on main (17670604837, SHA 06c9c39) was genuinely failing, not a stale status: both registry jobs hit NU5017, while the release job independently succeeded. That was a release false positive. The workflow also emitted ten CS8600 warnings, the deprecated package-icon warning, the missing README advisory, and deprecated set-output usage. Because C# only ran on pushes to main, the package regression was also a PR-validation false negative.

The updated branch now:

• reproduces and validates package creation before publishing;
• retains embedded PDBs and tests that behavior while no longer requesting an empty .snupkg;
• treats build/package warnings as errors and inspects the produced .nupkg;
• runs C# validation on PRs without exposing publish secrets;
• makes release creation depend on successful publication to both registries;
• removes the identified C#, NuGet metadata, output-command, and Node runtime warnings;
• uses identical explicit warning-strict packing for both registry jobs;
• restricts auto-merge to Dependabot PRs and removes its unnecessary checkout.

Latest head 72e434b is green: C# validation, README/workflow validation, and Codacy all pass. The C# and README jobs have zero annotations. Local validation also passes with 2 tests, 10 README tests, zero build/package warnings or errors, actionlint, shell syntax checks, and git diff --check.

One GitHub behavior is worth calling out explicitly: the current auto-merge run still reports the old checkout and non-Dependabot warnings because pull_request_target loads .github/workflows/AutoMerge.yml from main, not from this PR. The branch diff removes both causes, but GitHub can only execute that revised workflow after merge.

The branch includes current main, the working tree is clean, the PR title/body now reflect the complete fix, and no review comments remain unresolved.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $9.860274

📊 Context and tokens usage:

• 234.1K / 200K (117%) input tokens, 47.7K / 128K (37%) output tokens

Total: (234.1K + 8.2M cached) input tokens, 47.7K output tokens, $9.860274 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: xhigh (~31999 tokens)
• Model: GPT-5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (3490KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag