UID2-7069: harden shared_create_releases composite

[jon8787]

Summary

Code-review follow-ups from PR #229 (UID2-6762). Closes UID2-7069.

• Validate publish_platform at the top of shared_create_releases — a typo no longer silently produces a draft release with an empty body. Implemented as a bash case (case-sensitive); the original contains(fromJSON([...])) expression was case-insensitive and let docker lowercase slip through.
• One mikepenz step, not five. A Prepare changelog template shell step picks the platform template (bash + jq + placeholder substitution); a single mikepenz/release-changelog-builder-action consumes the output via ${{ steps.changelog_config.outputs.json }}; Create Release.body references the one resulting output. Future template/SHA tweaks happen in one place.
• NuGet workflow no longer hardcodes UID2.Client as the package id — parsed from <id> in the .nuspec via xmllint (explicitly installed via apt-get install -y libxml2-utils — it is NOT preinstalled on ubuntu-latest), gated on is_release. The .nuspec filename is still hardcoded; that remains as a documented follow-up.
• Maven workflow: Extract Maven artifactId gated on steps.checkRelease.outputs.is_release (no longer runs on Snapshot builds); same step output used at the composite call site; unused env.IS_RELEASE removed. The inlined is_release boolean at jobs.release.name is documented in-file since job-level expressions cannot reference step outputs.
• PyPI workflow: Extract PyPI package name gated on is_release and rewritten with python3 tomllib — handles single- and double-quoted values, ignores unrelated name = keys in earlier tables, fails fast if [project].name is missing.

Verification — all run on real GHA Linux (no aspirational checkboxes)

A TEMP smoke harness landed on this branch and was deleted in 32e4920 after capturing three runs. Coverage:

Composite no-op path (is_release: false) — run 26142464874

• Validate publish_platform rejects docker (lowercase typo) with Unsupported publish_platform 'docker' + exit 1
• Validate publish_platform accepts each canonical platform: Docker, Maven, PyPI, NuGet, iOS
• Prepare changelog template bash + jq produces valid configurationJson on real Linux for all 5 platforms (case block extracted live from action.yaml to guarantee parity with the composite)

Extract steps against real consumer fixtures — run 26143046210

• mvn help:evaluate -Dexpression=project.artifactId on IABTechLab/uid2-attestation-aws/attestation-aws/pom.xml → attestation-aws
• python3 tomllib on IABTechLab/uid2-client-python/pyproject.toml → uid2_client (with underscore — exactly the kind of drift the new parser handles correctly)
• xmllint --xpath '...local-name()...' on IABTechLab/uid2-client-net/UID2.Client.nuspec → UID2.Client

Destructive composite end-to-end (is_release: true) — run 26143611716

• Composite invoked with publish_platform: Maven, is_release: true, fromTag: v2.3.2 (123 PRs in range so mikepenz takes the template path), toTag: v0.0.0-smoke (temporary tag created at HEAD)
• Draft releases snapshotted pre-run, restored post-run (defensively — repo had 0 pre-existing drafts; restore was a no-op)
• Build changelog (mikepenz) successfully consumed ${{ steps.changelog_config.outputs.json }} and substituted #{{CHANGELOG}} / #{{UNCATEGORIZED}} into the Maven template
• Delete Draft Releases + Create Release ran in sequence; resulting draft body contained <artifactId>smoke-pkg</artifactId> — proving the full plumbing chain (template prep → mikepenz → softprops body interpolation)
• Cleanup deleted the smoke draft and untagged v0.0.0-smoke

Bugs caught by the smoke and fixed before merge

Commit	Bug
fc5ff51	An empty ${{ }} in a code comment inside a run: block. GHA's template engine scans run: blocks for ${{...}} and tried to evaluate the empty expression — composite action YAML failed to load on every invocation. Local yaml.safe_load parsed it fine because YAML itself is valid; only the GHA template pass rejected it.
776f73e	Validate publish_platform was using !contains(fromJSON('["Docker",...]'), inputs.publish_platform). GHA's contains() is case-insensitive — so passing docker lowercase returned true, the ! flipped to false, the validation step was silently skipped, and the bad input flowed through to mikepenz. The exact typo the guard was meant to catch. Rewrote as a bash case statement (case-sensitive by default).
4277ce4	NuGet workflow assumed xmllint was preinstalled on ubuntu-latest. It isn't (as of 2026 runner images). Added an explicit sudo apt-get install -y libxml2-utils step gated on is_release. Total overhead ~3-5s per release.

Without the smoke, every one of these would have shipped to production and broken the next real release.

Known limitations (documented in-file, not blocking)

• The .nuspec filename in the NuGet workflow is still hardcoded as UID2.Client.nuspec. Fix is package-id only; filename remains single-tenant. Follow-up tracked.
• mikepenz collapses to empty_template (default - no changes) when there are zero merged PRs in the fromTag..toTag range. Pre-existing behavior — not introduced by this PR — but worth a follow-up to set a sensible empty_template that preserves the platform install snippet.

🤖 Generated with Claude Code