From 45b806c35f923949ef4a57eedab6bf86ae513b9b Mon Sep 17 00:00:00 2001
From: Ciaran Liedeman <ciaran@stackworx.io>
Date: Fri, 26 Jun 2026 23:58:21 +0200
Subject: [PATCH] ci(fork): add fork release publisher to the default branch

Place release-fork.yml on main so the "Run workflow" button appears in the
Actions UI (workflow_dispatch is only surfaced from the default branch). When
dispatching, select the release/fork-<version> branch - main has no fork package
changes, so it must not be published from. This is the only fork commit on main,
which otherwise mirrors upstream; preserve it (or re-add) when syncing main.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release-fork.yml | 105 +++++++++++++++++++++++++++++
 1 file changed, 105 insertions(+)
 create mode 100644 .github/workflows/release-fork.yml

diff --git a/.github/workflows/release-fork.yml b/.github/workflows/release-fork.yml
new file mode 100644
index 00000000000..24102cad2cc
--- /dev/null
+++ b/.github/workflows/release-fork.yml
@@ -0,0 +1,105 @@
+name: 🚀 Release Fork Packages
+
+# Publishes ONLY the forked StrawberryShake packages, renamed under the Stackworx.* prefix:
+#   * Stackworx.StrawberryShake.Razor   - runtime base classes
+#   * Stackworx.StrawberryShake.Blazor  - meta package; bundles the patched dotnet-graphql tool
+#   * Stackworx.StrawberryShake.Tools   - dotnet-graphql CLI
+# Everything else is consumed from upstream nuget.org. See FORK.md "Packaging & publishing".
+#
+# How to run:
+#   * Manually: Actions -> "Release Fork Packages" -> Run workflow; pick the ref to publish
+#     (e.g. release/fork-16.3.0) and the version.
+#   * By tag:   push a tag like `fork-16.3.0` on the ref you want to publish (the version is the
+#     tag minus the `fork-` prefix).
+# Publishes via NuGet trusted publishing (OIDC) using the NuGet/login action; requires the
+# `NUGET_USER` organization variable and a trusted-publishing policy on nuget.org per package.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "NuGet package version to publish (e.g. 16.3.0)."
+        required: true
+        default: "16.3.0"
+      dry_run:
+        description: "Pack only; skip the push to NuGet."
+        type: boolean
+        default: false
+  push:
+    tags:
+      - "fork-*" # e.g. fork-16.3.0 -> publishes version 16.3.0
+
+permissions:
+  contents: read
+  id-token: write # required for NuGet trusted publishing (OIDC)
+
+jobs:
+  release-fork:
+    name: Pack and publish forked packages
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install .NET
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
+        with:
+          dotnet-version: |
+            8.x
+            9.x
+            10.x
+            11.0.100-preview.5.26302.115
+
+      - name: Resolve version
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "push" ]; then
+            version="${GITHUB_REF_NAME#fork-}"
+          else
+            version="${{ github.event.inputs.version }}"
+          fi
+          if [ -z "$version" ]; then
+            echo "::error::Could not resolve a package version."
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Publishing forked packages at version $version"
+
+      - name: Pack forked packages
+        shell: bash
+        run: |
+          set -euo pipefail
+          for proj in \
+            "src/StrawberryShake/Client/src/Razor/StrawberryShake.Razor.csproj" \
+            "src/StrawberryShake/MetaPackages/Blazor/StrawberryShake.Blazor.csproj" \
+            "src/StrawberryShake/Tooling/src/dotnet-graphql/dotnet-graphql.csproj"; do
+            dotnet pack "$proj" \
+              -c Release \
+              -o "${{ github.workspace }}/output/packages" \
+              -p:Version="${{ steps.version.outputs.version }}"
+          done
+          ls -l "${{ github.workspace }}/output/packages"
+
+      - name: NuGet login (trusted publishing)
+        id: login
+        if: ${{ github.event_name == 'push' || github.event.inputs.dry_run != 'true' }}
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
+        with:
+          user: ${{ vars.NUGET_USER }}
+
+      - name: Push to NuGet
+        if: ${{ github.event_name == 'push' || github.event.inputs.dry_run != 'true' }}
+        shell: bash
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+        run: |
+          set -euo pipefail
+          for nupkg in "${{ github.workspace }}"/output/packages/*.nupkg; do
+            echo "Pushing $(basename "$nupkg")"
+            dotnet nuget push "$nupkg" \
+              --source https://api.nuget.org/v3/index.json \
+              --api-key "$NUGET_API_KEY" \
+              --skip-duplicate
+          done