From 025e0af23b1ce95b7a3f73abfe542ea14aa0a01b Mon Sep 17 00:00:00 2001
From: telli <tellikoroma@gmail.com>
Date: Thu, 15 Oct 2026 23:13:17 -0700
Subject: [PATCH] fix: prepare first release publication

---
 .github/workflows/release.yml | 16 ++++++++++++++--
 docs/binary-distribution.md   |  2 ++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4a8f362..4574128 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -132,9 +132,21 @@ jobs:
       - name: Push to NuGet
         env:
           NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
-        run: dotnet nuget push 'release/*.nupkg' --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate
+        run: |
+          if [ -z "$NUGET_API_KEY" ]; then
+            echo '::error::Configure the NUGET_API_KEY Actions secret before publishing.'
+            exit 1
+          fi
+          dotnet nuget push 'release/*.nupkg' --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ github.ref_name }}
-        run: gh release create "$RELEASE_TAG" release/* --verify-tag --generate-notes --title "$RELEASE_TAG"
+          RELEASE_VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          flags=()
+          if [[ "$RELEASE_VERSION" == *-* ]]; then
+            flags+=(--prerelease --latest=false)
+          fi
+          gh release create "$RELEASE_TAG" release/* --verify-tag --generate-notes --title "$RELEASE_TAG" "${flags[@]}"
diff --git a/docs/binary-distribution.md b/docs/binary-distribution.md
index 7679ea4..cf45a82 100644
--- a/docs/binary-distribution.md
+++ b/docs/binary-distribution.md
@@ -35,3 +35,5 @@ pwsh -File .github/scripts/Test-Binary.ps1 -Runtime osx-arm64 -Version 0.1.0-pre
 Smoke tests validate the checksum and three-file archive, unpack into a clean directory, start `version` with an empty PATH and isolated runtime roots, run offline non-.NET commands and SQLite index state, then launch the relocated executable from real SDK MCP clients. Those clients exercise read-only denials, semantic evaluation, reversible rename, and actual build/TRX test results. The installed SDK is used only for the SDK-dependent acceptance portion.
 
 The release workflow validates build, tests, scenarios, documentation, dependency audit, and local NuGet installation before binary jobs. NuGet push and GitHub release assembly wait for all six native smoke jobs. Local success does not prove the other platform jobs have run. No release is created until a version tag triggers the gated workflow.
+
+Before pushing the first version tag, configure the `NUGET_API_KEY` Actions secret at repository scope or in the `nuget` environment with permission to publish all `SharpClaw.Code*` packages. A missing key fails publication with an explicit error after artifact validation. After configuring the key, rerun failed jobs on the same tagged workflow to retain the validated artifacts. Tags with prerelease versions, such as `v0.1.0-preview.1`, create GitHub prereleases.