From e687fc46be2c63bf8d4ecee637442192316a5878 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 15:55:20 +0900
Subject: [PATCH 01/11] ci: use OIDC for NuGet package push authentication

This updates the build-release workflow to leverage OpenID Connect (OIDC) for authenticating with NuGet.org. The package push operation is now performed directly within the build job, replacing static API key usage with ephemeral credentials for enhanced security.
---
 .github/workflows/build-release.yaml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 4427567..352992d 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -43,6 +43,16 @@ jobs:
           name: nuget
           path: ./publish/
           retention-days: 1
+      # push nuget
+      - name: NuGet login (OIDC)
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - run: dotnet nuget push "./publish/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
 
   build-unity:
     name: "Build Unity package"
@@ -82,7 +92,7 @@ jobs:
       commit-id: ${{ needs.update-packagejson.outputs.sha }}
       dry-run: ${{ inputs.dry-run }}
       tag: ${{ inputs.tag }}
-      nuget-push: true
+      nuget-push: false
       release-upload: false
       release-format: "{0}"
     secrets: inherit

From 684bd70e33379887a76531fcb915c37738066584 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 16:40:37 +0900
Subject: [PATCH 02/11] ci: id-token permission

---
 .github/workflows/build-release.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 352992d..10abf8a 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -27,6 +27,7 @@ jobs:
     name: "Build & pack GrpcWebSocketBridge"
     permissions:
       contents: read
+      id-token: write # required for NuGet Trusted Publish
     runs-on: ubuntu-24.04
     needs: [update-packagejson]
     timeout-minutes: 10

From 66a3da00f4525b3615a95d31c1fc523fadda2b79 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 08:11:53 +0000
Subject: [PATCH 03/11] ci: align release build ref and NuGet symbol package
 push

Agent-Logs-Url: https://github.com/Cysharp/GrpcWebSocketBridge/sessions/54bcd0a8-8cad-422a-aed3-b55a9700e4f2

Co-authored-by: guitarrapc <3856350+guitarrapc@users.noreply.github.com>
---
 .github/workflows/build-release.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 10abf8a..1007e43 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -33,12 +33,14 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
+        with:
+          ref: ${{ needs.update-packagejson.outputs.sha }}
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
       # Build & Pack
       - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
       - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --include-symbols --include-source --no-build -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --include-symbols --include-source --no-build -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --include-source --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --include-source --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget
@@ -54,6 +56,10 @@ jobs:
         if: ${{ !inputs.dry-run }}
         env:
           NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+      - run: dotnet nuget push "./publish/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
 
   build-unity:
     name: "Build Unity package"

From 80fac02ece37546e4ad16fa9a687c5277b981ee6 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 17:21:50 +0900
Subject: [PATCH 04/11] ci: add --include-source on PR Build

---
 .github/workflows/build-pr.yaml      | 4 ++--
 .github/workflows/build-release.yaml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-pr.yaml b/.github/workflows/build-pr.yaml
index 4b8e164..bbacaca 100644
--- a/.github/workflows/build-pr.yaml
+++ b/.github/workflows/build-pr.yaml
@@ -29,8 +29,8 @@ jobs:
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Debug
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Release
       # Pack
-      - run: dotnet pack -c Release --no-build  -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build  -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
 
   build-unity:
     if: ${{ ! github.event.pull_request.head.repo.fork }}
diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 1007e43..a200d6c 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -39,8 +39,8 @@ jobs:
       # Build & Pack
       - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
       - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --include-source --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --include-source --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget

From f74ae7ef5f9e3e966ded7b4d111d1cd85513ff1e Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 17:49:19 +0900
Subject: [PATCH 05/11] ci: handle SymbolPackageFormat on build

---
 .github/workflows/build-pr.yaml      | 4 ++--
 .github/workflows/build-release.yaml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-pr.yaml b/.github/workflows/build-pr.yaml
index bbacaca..103be96 100644
--- a/.github/workflows/build-pr.yaml
+++ b/.github/workflows/build-pr.yaml
@@ -29,8 +29,8 @@ jobs:
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Debug
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Release
       # Pack
-      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
 
   build-unity:
     if: ${{ ! github.event.pull_request.head.repo.fork }}
diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index a200d6c..30fa79f 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -39,8 +39,8 @@ jobs:
       # Build & Pack
       - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
       - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:VersionPrefix=${{ inputs.tag }} -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget

From 87f317011812e0361e3dbcef3175fcb9b14fc775 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 18:12:13 +0900
Subject: [PATCH 06/11] ci: pass version on build-pr for concistency

---
 .github/workflows/build-pr.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-pr.yaml b/.github/workflows/build-pr.yaml
index 103be96..978a7d7 100644
--- a/.github/workflows/build-pr.yaml
+++ b/.github/workflows/build-pr.yaml
@@ -29,8 +29,8 @@ jobs:
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Debug
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Release
       # Pack
-      - run: dotnet pack -c Release --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
 
   build-unity:
     if: ${{ ! github.event.pull_request.head.repo.fork }}

From 812f7e29685c1de16278eb53bf62d0c1aefaf7aa Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 18:13:47 +0900
Subject: [PATCH 07/11] ci: align rebase build ref

---
 .github/workflows/build-release.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 30fa79f..2b1f10a 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -84,6 +84,8 @@ jobs:
           UNITY_SERIAL: "op://${{ vars.OP_VAULT_ACTIONS_PUBLIC }}/UNITY_LICENSE/serial"
 
       - uses: Cysharp/Actions/.github/actions/checkout@main
+        with:
+          ref: ${{ needs.update-packagejson.outputs.sha }}
       - uses: Cysharp/Actions/.github/actions/check-metas@main # check meta files
         with:
           directory: tool/GrpcWebSocketBridge.Client.Unity

From d496c1867c9b65309a8326a79efd75f29ac8a6d8 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 18:52:55 +0900
Subject: [PATCH 08/11] ci: originally added --include-symbols --include-source

---
 .github/workflows/build-pr.yaml      | 4 ++--
 .github/workflows/build-release.yaml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-pr.yaml b/.github/workflows/build-pr.yaml
index 978a7d7..395b24b 100644
--- a/.github/workflows/build-pr.yaml
+++ b/.github/workflows/build-pr.yaml
@@ -29,8 +29,8 @@ jobs:
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Debug
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Release
       # Pack
-      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
 
   build-unity:
     if: ${{ ! github.event.pull_request.head.repo.fork }}
diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 2b1f10a..fc19e24 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -39,8 +39,8 @@ jobs:
       # Build & Pack
       - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
       - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget

From 0777f1ae67b83a3752a17ffb4d72c6ccb7303f99 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 19:06:36 +0900
Subject: [PATCH 09/11] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/build-release.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index fc19e24..27781dc 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -39,8 +39,8 @@ jobs:
       # Build & Pack
       - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
       - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget

From b61a33dcb350064482e86b899734bf2881f01640 Mon Sep 17 00:00:00 2001
From: Ikiru Yoshizaki <3856350+guitarrapc@users.noreply.github.com>
Date: Wed, 20 May 2026 19:07:10 +0900
Subject: [PATCH 10/11] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/build-pr.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-pr.yaml b/.github/workflows/build-pr.yaml
index 395b24b..2dc73a7 100644
--- a/.github/workflows/build-pr.yaml
+++ b/.github/workflows/build-pr.yaml
@@ -29,8 +29,8 @@ jobs:
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Debug
       - run: dotnet test ./tests/GrpcWebSocketBridge.Tests/ -c Release
       # Pack
-      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionSuffix=${PACKAGE_VERSION} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o $GITHUB_WORKSPACE/artifacts ./src/GrpcWebSocketBridge.Client
 
   build-unity:
     if: ${{ ! github.event.pull_request.head.repo.fork }}

From 8d5a399c690fefb6132be1251f8b3ef88e113f08 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 20 May 2026 10:14:53 +0000
Subject: [PATCH 11/11] ci: add dedicated publish job gated on build and
 build-unity

Agent-Logs-Url: https://github.com/Cysharp/GrpcWebSocketBridge/sessions/343f0462-f3ca-4ad4-8261-3d7f198659dd

Co-authored-by: guitarrapc <3856350+guitarrapc@users.noreply.github.com>
---
 .github/workflows/build-release.yaml | 44 ++++++++++++++++++----------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
index 27781dc..1b62ae8 100644
--- a/.github/workflows/build-release.yaml
+++ b/.github/workflows/build-release.yaml
@@ -27,7 +27,6 @@ jobs:
     name: "Build & pack GrpcWebSocketBridge"
     permissions:
       contents: read
-      id-token: write # required for NuGet Trusted Publish
     runs-on: ubuntu-24.04
     needs: [update-packagejson]
     timeout-minutes: 10
@@ -46,20 +45,6 @@ jobs:
           name: nuget
           path: ./publish/
           retention-days: 1
-      # push nuget
-      - name: NuGet login (OIDC)
-        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
-        id: login
-        with:
-          user: ${{ secrets.NUGET_USER }}
-      - run: dotnet nuget push "./publish/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
-        if: ${{ !inputs.dry-run }}
-        env:
-          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
-      - run: dotnet nuget push "./publish/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
-        if: ${{ !inputs.dry-run }}
-        env:
-          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
 
   build-unity:
     name: "Build Unity package"
@@ -90,9 +75,36 @@ jobs:
         with:
           directory: tool/GrpcWebSocketBridge.Client.Unity
 
+  # release
+  publish:
+    name: "Publish NuGet packages"
+    needs: [build, build-unity]
+    permissions:
+      contents: read
+      id-token: write # required for NuGet Trusted Publish
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
+      - uses: Cysharp/Actions/.github/actions/download-artifact@main
+      # push nuget
+      - name: NuGet login (OIDC)
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - run: dotnet nuget push "./nuget/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+      - run: dotnet nuget push "./nuget/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
+        if: ${{ !inputs.dry-run }}
+        env:
+          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+
   # release
   create-release:
-    needs: [update-packagejson, build, build-unity]
+    needs: [update-packagejson, publish]
     permissions:
       contents: write
       id-token: write # required for NuGet Trusted Publish