chore: add GitHub Actions workflow for automated NuGet package release process

Author: Shewart

.github/workflows/release.yml

@@ -0,0 +1,75 @@
+name: Release
+
+# Fires on any v*.*.* tag push (and prerelease suffixes -alpha/-beta/-rc).
+# Version comes from Directory.Build.props. Publishes via NuGet Trusted
+# Publishing (OIDC — no long-lived API key). Setup steps in docs/RELEASING.md.
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Pack and validate only — skip nuget push"
+        type: boolean
+        default: true
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write   # for creating the GitHub Release
+      id-token: write   # required for Trusted Publishing OIDC exchange
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Restore
+        run: dotnet restore shelldocs.slnx
+
+      - name: Build
+        run: dotnet build shelldocs.slnx --configuration Release --no-restore
+
+      - name: Test
+        run: dotnet test shelldocs.slnx --configuration Release --no-build --verbosity normal
+
+      - name: Pack
+        run: dotnet pack shelldocs.slnx --configuration Release --no-build --output nupkgs
+
+      - name: List produced packages
+        run: ls -la nupkgs/
+
+      # Runs immediately before push — the temp API key is valid only 1 hour.
+      # `user` is the nuget.org profile name (NOT email, NOT the GH org name),
+      # kept as a secret so it never lives in the workflow file.
+      - name: Login to NuGet via Trusted Publishing
+        if: github.event_name == 'push' || inputs.dry_run == false
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Push to NuGet
+        if: github.event_name == 'push' || inputs.dry_run == false
+        env:
+          NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
+        run: |
+          for pkg in nupkgs/*.nupkg; do
+            echo "Publishing $pkg"
+            dotnet nuget push "$pkg" \
+              --api-key "$NUGET_API_KEY" \
+              --source https://api.nuget.org/v3/index.json \
+              --skip-duplicate
+          done
+
+      - name: Create GitHub Release
+        if: github.event_name == 'push'
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: nupkgs/*.nupkg