epic-129 S1: release path to ADR-9 (--ci, --preview, release on merge, tests gate the publish, ARM CI)

.github/workflows/ci.yml

@@ -5,12 +5,20 @@ on:
     branches: [ main, master, develop ]
     paths:
       - 'Sources/**'
+      - 'release.sh'
+      - 'release.test.sh'
       - '.github/workflows/ci.yml'
+      - '.github/workflows/publish-nuget.yml'
+      - '.github/workflows/release.yml'
   pull_request:
     branches: [ main, master, develop ]
     paths:
       - 'Sources/**'
+      - 'release.sh'
+      - 'release.test.sh'
       - '.github/workflows/ci.yml'
+      - '.github/workflows/publish-nuget.yml'
+      - '.github/workflows/release.yml'
 
 jobs:
   build-and-test:
@@ -41,6 +49,9 @@ jobs:
       working-directory: ./Sources
       run: dotnet test --configuration Release --no-build --verbosity normal --logger:"console;verbosity=detailed"
 
+    - name: Tests must not write into the repository
+      run: '[ -z "$(git status --porcelain)" ] || { git status --porcelain; echo "::error::tests wrote into the repository"; exit 1; }'
+
     - name: Pack (dry run)
       if: matrix.dotnet-version == '10.0.x'
       working-directory: ./Sources/ModelingEvolution.Drawing
@@ -62,4 +73,46 @@ jobs:
         echo "## CI Build Results" >> $GITHUB_STEP_SUMMARY
         echo "" >> $GITHUB_STEP_SUMMARY
         echo "- **.NET Version**: ${{ matrix.dotnet-version }}" >> $GITHUB_STEP_SUMMARY
-        echo "- **Build**: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+        echo "- **Build**: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+
+  build-and-test-arm64:
+    runs-on: ubuntu-24.04-arm
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Restore dependencies
+      working-directory: ./Sources
+      run: dotnet restore
+
+    - name: Build
+      working-directory: ./Sources
+      run: dotnet build --configuration Release --no-restore
+
+    - name: Test
+      working-directory: ./Sources
+      run: dotnet test --configuration Release --no-build --verbosity normal
+
+    - name: Tests must not write into the repository
+      run: '[ -z "$(git status --porcelain)" ] || { git status --porcelain; echo "::error::tests wrote into the repository"; exit 1; }'
+
+  release-script:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Syntax check
+      run: |
+        bash -n release.sh
+        bash -n release.test.sh
+
+    - name: Test release.sh
+      run: ./release.test.sh

.github/workflows/publish-nuget.yml

@@ -5,10 +5,17 @@ on:
     tags:
       - 'ModelingEvolution.Drawing/*.*.*.*'
       - 'v*.*.*'  # Also support v-prefixed tags for compatibility
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version to publish (X.Y.Z.B or X.Y.Z.B-preview.N)'
+        required: true
+        type: string
+  # Manual re-publish of an EXISTING release tag (e.g. after a failed push): the tag's commit is built.
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to publish (e.g., 1.0.53.35)'
+        description: 'Existing tag version to re-publish (e.g., 1.13.0.71)'
         required: true
         type: string
 
@@ -22,40 +29,73 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4
-
+      with:
+        # A dispatch run needs the tags to find and check out the release tag.
+        fetch-depth: ${{ github.event_name == 'workflow_dispatch' && '0' || '1' }}
+
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
         dotnet-version: '10.0.x'
 
     - name: Set version
       id: version
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
       run: |
-        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          VERSION="${{ github.event.inputs.version }}"
-        else
-          # Extract version from tag
+        # Resolution order: workflow_call input, workflow_dispatch input (both are `inputs.version`), then the tag.
+        if [ -n "$INPUT_VERSION" ]; then
+          VERSION="$INPUT_VERSION"
+        elif [[ "$GITHUB_REF" == refs/tags/* ]]; then
           TAG="${GITHUB_REF#refs/tags/}"
           # Handle both formats: ModelingEvolution.Drawing/1.0.57.35 and v1.0.57.35
           if [[ "$TAG" == ModelingEvolution.Drawing/* ]]; then
             VERSION="${TAG#ModelingEvolution.Drawing/}"
           else
             VERSION="${TAG#v}"
           fi
+        else
+          echo "::error::No version: not called with an input and not run on a tag (ref: $GITHUB_REF)"
+          exit 1
         fi
+        if ! [[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){2,3}(-preview\.[0-9]+)?$ ]]; then
+          echo "::error::Invalid version: $VERSION"
+          exit 1
+        fi
+        # AssemblyVersion/FileVersion cannot carry a pre-release suffix.
+        NUMERIC="${VERSION%%-*}"
+        echo "Version: $VERSION (assembly/file version: $NUMERIC)"
         echo "VERSION=$VERSION" >> $GITHUB_ENV
         echo "version=$VERSION" >> $GITHUB_OUTPUT
-
+        echo "numeric=$NUMERIC" >> $GITHUB_OUTPUT
+
+    # Also true when release.yml was itself dispatched and calls this workflow: its tag was just pushed on the
+    # same commit, so the check passes and the checkout is a no-op.
+    - name: Check out the release tag (workflow_dispatch only)
+      if: github.event_name == 'workflow_dispatch'
+      env:
+        VERSION: ${{ steps.version.outputs.version }}
+      run: |
+        TAG="ModelingEvolution.Drawing/$VERSION"
+        if ! git rev-parse -q --verify "refs/tags/$TAG" > /dev/null; then
+          echo "::error::Tag $TAG does not exist; a manual run only re-publishes an existing release tag"
+          exit 1
+        fi
+        git checkout -q "refs/tags/$TAG"
+        echo "Building $TAG at $(git rev-parse HEAD)"
+
     - name: Update version in csproj
+      env:
+        VERSION: ${{ steps.version.outputs.version }}
+        NUMERIC: ${{ steps.version.outputs.numeric }}
       run: |
-        VERSION="${{ steps.version.outputs.version }}"
         cd Sources/ModelingEvolution.Drawing
-        # Update all version-related properties
-        sed -i "s/<AssemblyVersion>.*<\/AssemblyVersion>/<AssemblyVersion>$VERSION<\/AssemblyVersion>/" ModelingEvolution.Drawing.csproj
-        sed -i "s/<FileVersion>.*<\/FileVersion>/<FileVersion>$VERSION<\/FileVersion>/" ModelingEvolution.Drawing.csproj
+        sed -i "s/<AssemblyVersion>.*<\/AssemblyVersion>/<AssemblyVersion>$NUMERIC<\/AssemblyVersion>/" ModelingEvolution.Drawing.csproj
+        sed -i "s/<FileVersion>.*<\/FileVersion>/<FileVersion>$NUMERIC<\/FileVersion>/" ModelingEvolution.Drawing.csproj
         sed -i "s/<Version>.*<\/Version>/<Version>$VERSION<\/Version>/" ModelingEvolution.Drawing.csproj
         sed -i "s/<PackageVersion>.*<\/PackageVersion>/<PackageVersion>$VERSION<\/PackageVersion>/" ModelingEvolution.Drawing.csproj
-
+        grep -E "<(AssemblyVersion|FileVersion|Version|PackageVersion)>" ModelingEvolution.Drawing.csproj
+
     - name: Restore dependencies
       working-directory: ./Sources
       run: dotnet restore
@@ -64,9 +104,9 @@ jobs:
       working-directory: ./Sources
       run: dotnet build --configuration Release --no-restore
 
-    - name: Run tests
+    - name: Run tests (a red suite publishes nothing)
       working-directory: ./Sources
-      run: dotnet test --configuration Release --no-build --verbosity normal || true
+      run: dotnet test --configuration Release --no-build --verbosity normal
 
     - name: Pack
       working-directory: ./Sources/ModelingEvolution.Drawing