Prepare preview.3 package releases

Author: kMutagene

.github/workflows/release-all.yml

@@ -157,48 +157,59 @@ jobs:
             ]];
 
             for (const packageDefinition of packages) {
-              const registryStates = [];
+              try {
+                const registryStates = [];
 
-              for (const [registry, check] of packageDefinition.checks) {
-                const exists = await check(packageDefinition.version);
-                registryStates.push(`${registry}: ${exists ? "published" : "missing"}`);
-              }
+                for (const [registry, check] of packageDefinition.checks) {
+                  const exists = await check(packageDefinition.version);
+                  registryStates.push(`${registry}: ${exists ? "published" : "missing"}`);
+                }
+
+                const missing = registryStates.some(state => state.endsWith(": missing"));
+                let action = "Skipped: version is fully published";
 
-              const missing = registryStates.some(state => state.endsWith(": missing"));
-              let action = "Skipped: version is fully published";
-
-              if (missing) {
-                const activeRuns = await github.rest.actions.listWorkflowRuns({
-                  owner,
-                  repo,
-                  workflow_id: packageDefinition.workflow,
-                  branch: ref,
-                  per_page: 20
-                });
-
-                const alreadyRunning = activeRuns.data.workflow_runs.some(run =>
-                  run.head_sha === context.sha && run.status !== "completed"
-                );
-
-                if (alreadyRunning) {
-                  action = "Skipped: workflow already running for this revision";
-                } else {
-                  await github.rest.actions.createWorkflowDispatch({
+                if (missing) {
+                  const activeRuns = await github.rest.actions.listWorkflowRuns({
                     owner,
                     repo,
                     workflow_id: packageDefinition.workflow,
-                    ref
+                    branch: ref,
+                    per_page: 20
                   });
-                  action = `Dispatched ${packageDefinition.workflow}`;
+
+                  const alreadyRunning = activeRuns.data.workflow_runs.some(run =>
+                    run.head_sha === context.sha && run.status !== "completed"
+                  );
+
+                  if (alreadyRunning) {
+                    action = "Skipped: workflow already running for this revision";
+                  } else {
+                    await github.rest.actions.createWorkflowDispatch({
+                      owner,
+                      repo,
+                      workflow_id: packageDefinition.workflow,
+                      ref
+                    });
+                    action = `Dispatched ${packageDefinition.workflow}`;
+                  }
                 }
-              }
 
-              rows.push([
-                packageDefinition.name,
-                packageDefinition.version,
-                registryStates.join("; "),
-                action
-              ]);
+                rows.push([
+                  packageDefinition.name,
+                  packageDefinition.version,
+                  registryStates.join("; "),
+                  action
+                ]);
+              } catch (error) {
+                core.error(`${packageDefinition.name}: ${error.message}`);
+                core.setFailed("One or more package checks or dispatches failed; remaining packages were still processed.");
+                rows.push([
+                  packageDefinition.name,
+                  packageDefinition.version,
+                  "Check incomplete",
+                  `Failed: ${error.message}`
+                ]);
+              }
             }
 
             await core.summary

AGENTS.md

@@ -211,6 +211,9 @@ When adding tests:
   `## <version> - YYYY-MM-DD`; the service may append ` - <release title>`.
   Run `./build.cmd ValidateReleaseMetadata` after changing either side. Main
   builds, staging checks, and every package target enforce the same gate.
+- During a prerelease line, keep one rolling top release-notes entry and bump
+  its preview version in place. Preserve published non-preview entries as
+  immutable history.
 - `ci.yml` owns path-focused main solution tests for core libraries and clients. Downstream package compatibility belongs to the downstream repository's normal CI and release process; AVPR workflows must not clone and rebuild `arc-validate`.
 - `portable-ci.yml` owns cross-target Model and Codecs tests. It runs both portable targets when either portable implementation, consumer test, or shared build tool changes.
 - `staging-ci.yml` owns `StagingArea/**`, staging-checker, staging-model/codec, and relevant build-tool changes. It runs `TestStagingArea` on Windows with `uv` installed.
@@ -222,12 +225,13 @@ When adding tests:
 - Model and Codecs NuGet trusted-publisher policies must name their direct workflow (`release-model.yml` or `release-codecs.yml`). Client and Interop policies must name the called reusable workflow `release-package.yml`, which NuGet observes through `job_workflow_ref`.
 - npm trusted-publisher policies for the scoped Model and Codecs packages must name the corresponding direct package workflow and allow `npm publish`. These workflows use Node 24, npm with trusted-publishing support, and no npm token.
 - PyPI trusted-publisher policies for Model and Codecs must name the corresponding direct, top-level package workflow. Do not move PyPI publishing into a reusable workflow.
-- The `nfdi4plants` NuGet organization must own every actively released NuGet
-  package and every NuGet trusted-publishing policy. `NUGET_USER` is the
-  personal nuget.org username that creates those organization policies, not
-  the organization name. npm publishers are configured per scoped package and
-  PyPI publishers per project, using the exact field matrix in
-  `docs/operations/releases.md`.
+- NuGet trusted-publishing policies are owner-wide and cannot be scoped to an
+  individual package. The current policy owner and package owner is the
+  `Mutagene` nuget.org account, and `NUGET_USER` must contain that same profile
+  name. Separate policies restrict the repository/workflow identity, but each
+  successful policy can publish any NuGet package owned by that account. npm
+  publishers are configured per scoped package and PyPI publishers per project,
+  using the exact field matrix in `docs/operations/releases.md`.
 - All package publish jobs need `id-token: write` and the `release` environment. `NuGet/login` exchanges OIDC for a temporary key; never restore a long-lived `NUGET_KEY`. `NUGET_USER` is only the nuget.org profile name associated with the policy. Reusable publishers must read it directly from their job environment because GitHub cannot pass environment secrets through `workflow_call`.
 - A staged package marked for publication can be pushed to the production registry after checks pass.
 - Workflow actions should remain pinned to deliberate versions/commits. Preserve least-privilege permissions and never print secrets.

docs/operations/releases.md

@@ -105,6 +105,10 @@ Release workflows rerun their required tests before publishing. No
 `RELEASE_NOTES.md` change or branch push publishes a library package
 automatically.
 
+Prerelease notes use one rolling top entry: bump that entry in place and keep
+accumulating the unreleased preview changes beneath it. Once a non-preview
+version is published, its release-notes entry is immutable.
+
 To release every new package version in this repository, manually dispatch
 `release-all.yml` against the intended ref. It validates the version gate,
 checks the exact committed versions on each package's target registries, and
@@ -149,17 +153,19 @@ Create a protected GitHub environment named `release` in both repositories.
 Add required reviewers and allow deployments from both `dev` and `release` so
 the manually dispatched package workflows can publish reviewed preview versions
 from `dev` as well as production versions from `release`. Store one environment
-secret, `NUGET_USER`, whose value is the personal nuget.org
-username that creates the trusted-publishing policies (currently `Mutagene`),
+secret, `NUGET_USER`, whose value is the nuget.org profile that owns the
+trusted-publishing policies (currently `Mutagene`),
 not an email address, GitHub username, organization name, or API key.
 
-On nuget.org, select the `nfdi4plants` organization as the policy owner. Every
-NuGet package below must be owned by that organization. If it currently shows a
-personal owner, add `nfdi4plants` as co-owner first and remove the personal
-owner only after organization ownership and publishing have been verified.
-Create these policies; workflow values are filenames only:
+On nuget.org, select the personal account `Mutagene` as the policy owner and
+keep the NuGet packages owned by that account. NuGet policies are owner-wide:
+they cannot be restricted to an individual package. Consequently, each policy
+below can technically publish any package owned by `Mutagene`; the package
+column documents the intended use of the authorized workflow, not a NuGet
+enforcement boundary. Create these policies; workflow values are filenames
+only:
 
-| Packages covered | Repository owner | Repository | Workflow file | Environment |
+| Intended packages | Repository owner | Repository | Workflow file | Environment |
 | --- | --- | --- | --- | --- |
 | `ValidationPackage.Model` | `nfdi4plants` | `arc-validate-package-registry` | `release-model.yml` | `release` |
 | `ValidationPackage.Codecs` | `nfdi4plants` | `arc-validate-package-registry` | `release-codecs.yml` | `release` |
@@ -169,7 +175,9 @@ Create these policies; workflow values are filenames only:
 The Client and Interop policy names the called reusable workflow because that
 is the workflow NuGet observes in the `job_workflow_ref` claim. The reusable
 workflow reads `NUGET_USER` directly from its `release` environment; environment
-secrets cannot be passed through `workflow_call` by the caller.
+secrets cannot be passed through `workflow_call` by the caller. The four policy
+rows distinguish trusted workflow identities, but they do not create four
+package-level scopes.
 
 On npmjs.com, open each package's **Settings → Trusted Publisher**, select
 **GitHub Actions**, and enter:

src/AVPRClient.Interop/AVPRClient.Interop.csproj

@@ -22,7 +22,7 @@
     <RepositoryType>git</RepositoryType>
     <PackageReleaseNotes>$([System.IO.File]::ReadAllText("$(MSBuildProjectDirectory)/RELEASE_NOTES.md"))</PackageReleaseNotes>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    <PackageVersion>0.1.0-preview.2</PackageVersion>
+    <PackageVersion>0.1.0-preview.3</PackageVersion>
   </PropertyGroup>
 
   <ItemGroup>

src/AVPRClient.Interop/RELEASE_NOTES.md

@@ -1,4 +1,6 @@
-## 0.1.0-preview.2 - 2026-07-31
+## 0.1.0-preview.3 - 2026-08-07
 
 - Add bidirectional mappings between generated AVPR DTOs and `ValidationPackage.Model`.
 - Cover nested authors, ontology annotations, CWL inputs, collection defaults, and full semantic-version suffixes.
+- Add an independently versioned, manually approved NuGet trusted-publishing
+  workflow with retry-safe duplicate handling.

src/AVPRClient/AVPRClient.csproj

@@ -22,7 +22,7 @@
     <RepositoryType>git</RepositoryType>
     <PackageReleaseNotes>$([System.IO.File]::ReadAllText("$(MSBuildProjectDirectory)/RELEASE_NOTES.md"))</PackageReleaseNotes>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    <PackageVersion>0.3.0-preview.2</PackageVersion>
+    <PackageVersion>0.3.0-preview.3</PackageVersion>
   </PropertyGroup>
 
   <ItemGroup>

src/AVPRClient/RELEASE_NOTES.md

@@ -1,6 +1,8 @@
-## 0.3.0-preview.2 - 2026-07-31
+## 0.3.0-preview.3 - 2026-08-07
 - Regenerate the client for the supported CWL v1.2 scalar `Inputs` contract.
 - Move all handwritten model and staging mappings to `AVPRClient.Interop` and `AVPRCI`, leaving this package generated-only.
+- Replace token-based publication with a manually approved, retry-safe NuGet
+  trusted-publishing workflow.
 
 ## v0.2.1
 - fix : Correct `ProgrammingLanguage` field mapping in `ValidationPackage` type extension.

src/ValidationPackage.Codecs/RELEASE_NOTES.md

@@ -1,7 +1,9 @@
-## 0.1.0-preview.2 - 2026-07-31
+## 0.1.0-preview.3 - 2026-08-07
 
 - Add portable frontmatter extraction and YAML/JSON codecs for validation-package metadata.
 - Preserve the AVPR CWL scalar and wire-name contract across .NET, JavaScript, and Python.
 - Use YAMLicious for YAML writing with the Fable 5.11 Python compiler fix.
 - Organize JSON and YAML encoders and decoders into separate source trees.
 - Build installable npm and Python packages with an explicit native Model dependency.
+- Publish one versioned artifact set through independently retriable NuGet,
+  npm, and PyPI trusted-publishing jobs.

src/ValidationPackage.Codecs/ValidationPackage.Codecs.fsproj

@@ -17,7 +17,7 @@
     <RepositoryType>git</RepositoryType>
     <PackageReadmeFile>README.md</PackageReadmeFile>
     <PackageReleaseNotes>$([System.IO.File]::ReadAllText("$(MSBuildProjectDirectory)/RELEASE_NOTES.md"))</PackageReleaseNotes>
-    <PackageVersion>0.1.0-preview.2</PackageVersion>
+    <PackageVersion>0.1.0-preview.3</PackageVersion>
   </PropertyGroup>
 
   <ItemGroup>

src/ValidationPackage.Model/RELEASE_NOTES.md

@@ -1,7 +1,9 @@
-## 0.1.0-preview.2 - 2026-07-31
+## 0.1.0-preview.3 - 2026-08-07
 
 - Add the portable validation-package metadata domain.
 - Add CWL scalar command-input types and behavior.
 - Add semantic-version and package-identity behavior.
 - Include Fable sources for .NET, JavaScript, and Python consumers.
 - Build installable npm and Python packages alongside the NuGet package.
+- Publish one versioned artifact set through independently retriable NuGet,
+  npm, and PyPI trusted-publishing jobs.