Harden package release workflows

[andymeierdev]

Summary

• replace the long-lived NuGet API key path with NuGet Trusted Publishing through GitHub OIDC and the protected release environment
• centralize release validation, metadata, checksums, NuGet publish/reconciliation, tag creation, and GitHub Release reconciliation in the FAKE Build project
• add a dedicated Build.Tests project for operational release policy and package-integrity behavior
• keep Core as repository-wide Latest while Docs remains an independent non-Latest release train
• update and pin every external GitHub Action to a full commit SHA, with Dependabot maintenance
• add job timeouts and remove unnecessary gcloud setup warnings

External setup

Before the next package publication, create one organization-owned NuGet Trusted Publishing policy:

• owner: meiermade
• repository owner: meiermade
• repository: FSharp.ViewEngine
• workflow: _publish-package.yml
• environment: release

The GitHub release environment is restricted to main and defines NUGET_USER=meiermade.

Verification

• Build operational tests: 9 passed
• Core tests: 81 passed on the locally available .NET 10 runtime
• Docs tests: 26 passed
• Release solution build: zero warnings and errors
• workflow and Dependabot YAML parsed successfully
• every external Action reference is a full 40-character SHA
• FAKE checksum target produced checksums for package and symbols
• signed NuGet retry integrity check passed; tampered package was rejected
• git diff --check passed

[github-actions]

🍹 preview on fsharp-view-engine/prod

Pulumi report

View in Pulumi Cloud

  Previewing update (prod)

View Live: https://app.pulumi.com/meiermade/fsharp-view-engine/prod/previews/7b2541bc-f81e-482a-a781-b08285385d58

pulumi:pulumi:Stack: (same)
  [urn=urn:pulumi:prod::fsharp-view-engine::pulumi:pulumi:Stack::fsharp-view-engine-prod]
  ~ docker-build:index:Image: (update)
      [id=sha256:59c08fe493a66e70d4a5f8fe76d6022c2e053db11b573e20e6ab64b754b09fc2]
      [urn=urn:pulumi:prod::fsharp-view-engine::docker-build:index:Image::fsharpviewengine]
    - contextHash: "6950f9a3597936c407286cfbee488360b0483845c03eef4ac6909cb5ebd8ce77"
  ~ kubernetes:apps/v1:Deployment: (update)
      [id=fsharpviewengine/fsharpviewengine]
      [urn=urn:pulumi:prod::fsharp-view-engine::kubernetes:apps/v1:Deployment::fsharpviewengine]
    ~ spec: {
        ~ template: {
            ~ spec: {
                ~ containers: [
                    ~ [0]: {
                            ~ env  : [
                                ~ [0]: {
                                        ~ value: "2026.8.0" => "preview"
                                      }
                                ~ [1]: {
                                        ~ value: "4c84b7ac72ce00436e1a344c0adf72c021333c77" => "6d17058827133d06fca75389c3ecf6f17d001a4e"
                                      }
                              ]
                            ~ image: "us-east1-docker.pkg.dev/meiermade-platform/platform/fsharpviewengine:latest@sha256:3ef84bf7a51bd419bfa447722e51ea1816d140bac6f0ade5673acd01ced006b9" => [unknown]
                          }
                  ]
              }
          }
      }
Resources:
  ~ 2 to update
  8 unchanged