sigit-code 1.5.2__tar.gz → 1.5.4__tar.gz

{sigit_code-1.5.2 → sigit_code-1.5.4}/.agents/AGENTS.md

@@ -211,6 +211,18 @@ feeds results back. Neither the loop nor ACP/TUI surfaces depend on a concrete b
   those read env vars once at init.
 - **`src/account.rs`** — siGit Code Cloud auth (`/login`, `/logout`, `/whoami`); authenticates
   against the account API and stores a session token. Performs no console I/O.
+- **`src/browser_auth.rs`** — browser sign-in, the path the editor's "Sign in to siGit Code"
+  button takes. sigit is a public OAuth client (client id `sigit-code-cli`, no secret, PKCE
+  S256) against the authorization server at `$SIGIT_API_URL/oauth`. Two ways the code gets
+  back: a loopback listener on `127.0.0.1:0` (the registration lists `http://127.0.0.1/callback`
+  with no port, and RFC 8252 §7.3 matching ignores the port, so one registration covers every
+  run), or the out-of-band URN, where the server renders the code and the user pastes it. The
+  resulting token goes into `credentials` like any other, and is served by `/api/v1/user` rather
+  than the deprecated `/api/v1/me` — OAuth tokens are rejected there. The scopes requested are
+  `user:read code:agent`; `code:agent` is what reaches `chat/completions` and the official MCP
+  server. Surfaces: ACP `authenticate` (loopback only — nowhere to show a code), a bare `/login`
+  in either chat surface, and `sigit login` (which adds the paste fallback, plus `--paste` to
+  force it and `--password` for the old email/password prompt).
 - **`src/credentials.rs`** — local session-token store (TOML, `0600` on Unix).
 - **`src/models.rs`** — model-picker types shared across platforms.
 
@@ -249,6 +261,47 @@ mutating tools; the escape hatch for clients without permission-request support)
 
 ## Releasing
 
-Version lives in `Cargo.toml`. The binary is published to five registries via separate workflows
-(`release-crates`, `release-github`, `release-homebrew`, `release-npm`, `release-pypi`); the
-`npm/` and `pypi/` dirs hold the wrapper-package templates. Update `CHANGELOG.md` for releases.
+Version lives in `Cargo.toml`. Update `CHANGELOG.md` for releases.
+
+Publishing splits into two groups. **Language registries** each get their own tag-triggered
+workflow: `release-crates`, `release-npm`, `release-nuget`, `release-pypi`. The `npm/`, `nuget/`,
+and `pypi/` dirs hold their wrapper-package templates.
+
+**OS package managers** all publish somewhere outside this repo and all need checksums from the
+GitHub release, so `release-github` builds the binaries, attaches the assets, and then dispatches
+`release-homebrew`, `release-scoop`, `release-winget`, and `release-aur`. A dispatch failure in one
+is logged as a warning rather than failing the others, so an unconfigured channel does not block a
+release. Their inputs live in `packaging/`.
+
+Every release asset now carries a `.sha256` sidecar, not just the macOS Homebrew tarball. Scoop,
+winget, and the AUR PKGBUILD each need one, and they consume the raw binaries rather than the
+tarball. `release-github` also builds a `.deb` and `.rpm` per Linux target with nfpm
+(`packaging/nfpm.yaml`), packaging the already-built binary rather than re-invoking cargo.
+
+Three of these need credentials or a one-time manual step before they work:
+
+- Scoop needs a `getsigit/scoop-bucket` repo and a `SCOOP_BUCKET_TOKEN` secret, mirroring the
+  Homebrew tap setup.
+- winget needs a `WINGET_TOKEN` (PAT with `public_repo`) so `wingetcreate` can fork
+  `microsoft/winget-pkgs`. The workflow only handles *updates*; the first submission has to be made
+  by hand with `wingetcreate new`, since a package must exist before it can be updated.
+- The AUR needs `AUR_USERNAME`, `AUR_EMAIL`, and `AUR_SSH_PRIVATE_KEY`. It publishes `sigit-bin`
+  (a prebuilt binary) so Arch users are not compiling the on-device inference stack to install a
+  CLI.
+
+`[profile.release]` sets `strip = "symbols"` because binary size is a distribution constraint, not
+just a nicety. See the NuGet note below.
+
+The NuGet package (`SiGit.Code`, installed with `dotnet tool install --global SiGit.Code`) is the
+odd one out among the language registries: npm and PyPI publish one artifact per platform, but a
+.NET tool is a single package, so `nuget/sigit/` bundles all six binaries under
+`native/<os>-<arch>/` and a small managed shim (`Program.cs`) execs the right one. That shim leaves
+stdin/stdout/stderr unredirected on purpose, since siGit Code chooses TUI or ACP mode by testing
+whether stdin is a TTY. It also sets `RollForward=Major`: it targets `net8.0`, and without that a
+machine carrying only the .NET 10 runtime installs a tool that refuses to start.
+
+Bundling every target means the package is large, so `release-nuget.yml` fails the pack job if the
+`.nupkg` crosses nuget.org's 250 MB limit. At v1.5.1 it lands around 160 MB. If a future release
+trips that check, the fix is not to drop targets but to split into RID-specific tool packages
+(.NET 10's `DotnetToolRidPackage`), which ship one binary per platform the way npm already does.
+That also needs a fallback package for pre-.NET-10 SDKs.

{sigit_code-1.5.2 → sigit_code-1.5.4}/.github/workflows/ci.yml

@@ -78,7 +78,7 @@ jobs:
           key: clippy-${{ matrix.target }}
 
       - name: Clippy
-        run: cargo clippy --tests --target ${{ matrix.target }} -- -D warnings
+        run: cargo clippy --locked --tests --target ${{ matrix.target }} -- -D warnings
 
   test:
     name: Test — ${{ matrix.name }}

sigit_code-1.5.4/.github/workflows/release-aur.yml

@@ -0,0 +1,99 @@
+name: AUR Release
+
+# Dispatched by release-github.yml once the release and its checksums exist.
+#
+# Publishes the `sigit-bin` package: a prebuilt binary rather than a source
+# build, so Arch users are not compiling the whole dependency tree (and the
+# on-device inference stack in particular) to install a CLI.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.5.2)"
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  REPO: getsigit/sigit
+
+jobs:
+  publish-aur-package:
+    name: Publish sigit-bin to the AUR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag }}
+
+      - name: Resolve tag and version
+        id: release
+        shell: bash
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          VERSION="${TAG#v}"
+
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Read SHA256 checksums from release
+        id: sha
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          mkdir -p artifacts
+
+          gh release download "${{ steps.release.outputs.tag }}" \
+            --repo "${{ env.REPO }}" \
+            --pattern "sigit-linux-*.sha256" \
+            --dir artifacts/
+
+          X86_64_SHA=$(cat artifacts/sigit-linux-amd64.sha256)
+          AARCH64_SHA=$(cat artifacts/sigit-linux-arm64.sha256)
+
+          echo "x86_64=${X86_64_SHA}" >> "$GITHUB_OUTPUT"
+          echo "aarch64=${AARCH64_SHA}" >> "$GITHUB_OUTPUT"
+
+          echo "x86_64 SHA256:  ${X86_64_SHA}"
+          echo "aarch64 SHA256: ${AARCH64_SHA}"
+
+      - name: Render PKGBUILD
+        shell: bash
+        run: |
+          mkdir -p aur-build
+
+          sed \
+            -e "s/@VERSION@/${{ steps.release.outputs.version }}/g" \
+            -e "s/@SHA256_X86_64@/${{ steps.sha.outputs.x86_64 }}/g" \
+            -e "s/@SHA256_AARCH64@/${{ steps.sha.outputs.aarch64 }}/g" \
+            packaging/aur/PKGBUILD.in > aur-build/PKGBUILD
+
+          if grep -q '@[A-Z0-9_]*@' aur-build/PKGBUILD; then
+            echo "::error::PKGBUILD still contains unsubstituted placeholders" >&2
+            grep -n '@[A-Z0-9_]*@' aur-build/PKGBUILD >&2
+            exit 1
+          fi
+
+          # Catches an unbalanced quote or paren before it reaches the AUR.
+          bash -n aur-build/PKGBUILD
+
+          echo "Rendered PKGBUILD:"
+          cat aur-build/PKGBUILD
+
+      # The action runs makepkg in an Arch container to generate .SRCINFO and
+      # pushes over SSH. Generating .SRCINFO by hand is possible but drifts
+      # from the PKGBUILD the moment a field is added.
+      - name: Publish to the AUR
+        uses: KSXGitHub/github-actions-deploy-aur@v3
+        with:
+          pkgname: sigit-bin
+          pkgbuild: aur-build/PKGBUILD
+          commit_username: ${{ secrets.AUR_USERNAME }}
+          commit_email: ${{ secrets.AUR_EMAIL }}
+          ssh_private_key: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+          commit_message: "Update sigit-bin to ${{ steps.release.outputs.version }}"
+          updpkgsums: false

{sigit_code-1.5.2 → sigit_code-1.5.4}/.github/workflows/release-github.yml

@@ -119,6 +119,87 @@ jobs:
           echo "Archive: ${ARCHIVE_NAME}"
           echo "SHA256:  $(cat "${ARCHIVE_NAME}.sha256")"
 
+      # Debian and RPM packages are built from the binary staged above rather
+      # than by re-invoking cargo, so each Linux target compiles once and gets
+      # packaged twice.
+      - name: Build Linux packages
+        if: contains(matrix.target, 'linux')
+        shell: bash
+        env:
+          NFPM_VERSION: "2.43.0"
+        run: |
+          case "$(uname -m)" in
+            x86_64)  nfpm_arch="x86_64"; export PKG_ARCH="amd64" ;;
+            aarch64) nfpm_arch="arm64";  export PKG_ARCH="arm64" ;;
+            *) echo "Unsupported Linux build host $(uname -m)" >&2; exit 1 ;;
+          esac
+
+          curl -sSfL \
+            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_Linux_${nfpm_arch}.tar.gz" \
+            | tar -xz -C /tmp nfpm
+
+          export PKG_VERSION="${RELEASE_VERSION}"
+          export PKG_BINARY="./release/${PROJECT_NAME}-${{ matrix.name }}"
+
+          # An empty version is worse than a hard failure here: nfpm accepts it
+          # and silently emits a "0.0.0~rc0" package that would be attached to
+          # the release. Same for a missing binary, which only surfaces as an
+          # opaque glob error. Fail loudly instead.
+          if [ -z "${PKG_VERSION}" ]; then
+            echo "RELEASE_VERSION is empty; refusing to build packages" >&2
+            exit 1
+          fi
+          if [ ! -f "${PKG_BINARY}" ]; then
+            echo "Staged binary ${PKG_BINARY} not found" >&2
+            exit 1
+          fi
+
+          # nfpm expands ${VAR} in most fields but NOT in contents.src, so the
+          # config is rendered up front and nfpm only ever sees literal values.
+          # envsubst comes from gettext-base, preinstalled on the Ubuntu runner
+          # images. The explicit variable list keeps it from clobbering any
+          # other shell-looking text added to the config later.
+          if ! command -v envsubst >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y gettext-base
+          fi
+
+          envsubst '${PKG_ARCH} ${PKG_VERSION} ${PKG_BINARY}' \
+            < packaging/nfpm.yaml > /tmp/nfpm.rendered.yaml
+
+          /tmp/nfpm package --config /tmp/nfpm.rendered.yaml --packager deb --target ./release/
+          /tmp/nfpm package --config /tmp/nfpm.rendered.yaml --packager rpm --target ./release/
+
+          # Guard against a packager silently producing nothing.
+          for ext in deb rpm; do
+            if ! compgen -G "./release/*.${ext}" >/dev/null; then
+              echo "No .${ext} produced" >&2
+              exit 1
+            fi
+          done
+
+          ls -la ./release/
+
+      # Homebrew has always had a checksum because the tap needs one. Scoop,
+      # winget, and the AUR PKGBUILD each need one too, and they consume the
+      # raw binaries rather than the macOS tarball, so every asset gets a
+      # sidecar. Windows runners use bash from Git for Windows, which has
+      # sha256sum; macOS only has shasum.
+      - name: Checksum release assets
+        shell: bash
+        run: |
+          cd release
+          for asset in *; do
+            case "${asset}" in *.sha256) continue ;; esac
+
+            if command -v sha256sum >/dev/null 2>&1; then
+              sha256sum "${asset}" | awk '{print $1}' > "${asset}.sha256"
+            else
+              shasum -a 256 "${asset}" | awk '{print $1}' > "${asset}.sha256"
+            fi
+
+            echo "${asset}: $(cat "${asset}.sha256")"
+          done
+
       - name: Upload binary artifact
         uses: actions/upload-artifact@v4
         with:
@@ -171,17 +252,37 @@ jobs:
           tag_name: ${{ steps.tag.outputs.tag }}
           files: release/*
 
-      - name: Trigger Homebrew release
+      # These channels all publish somewhere outside this repo (a tap, a Scoop
+      # bucket, microsoft/winget-pkgs, the AUR) and every one of them reads
+      # checksums off the release created above, so they hang off this job
+      # rather than firing on the tag directly.
+      - name: Trigger OS package manager releases
         uses: actions/github-script@v7
         with:
           script: |
-            await github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'release-homebrew.yml',
-              ref: 'main',
-              inputs: {
-                tag: '${{ steps.tag.outputs.tag }}'
+            const tag = '${{ steps.tag.outputs.tag }}'
+            const workflows = [
+              'release-homebrew.yml',
+              'release-scoop.yml',
+              'release-winget.yml',
+              // New AUR account registration is temporarily closed
+              //'release-aur.yml',
+            ]
+
+            for (const workflow_id of workflows) {
+              try {
+                await github.rest.actions.createWorkflowDispatch({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id,
+                  ref: 'main',
+                  inputs: { tag },
+                })
+                console.log(`Dispatched ${workflow_id} for tag ${tag}`)
+              } catch (error) {
+                // One packaging channel being unconfigured (a missing secret,
+                // a bucket repo that does not exist yet) should not take the
+                // rest of the fan-out down with it.
+                core.warning(`Failed to dispatch ${workflow_id}: ${error.message}`)
               }
-            })
-            console.log('Dispatched release-homebrew.yml for tag ${{ steps.tag.outputs.tag }}')
+            }

sigit_code-1.5.4/.github/workflows/release-nuget.yml

@@ -0,0 +1,315 @@
+name: NuGet Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v1.5.2)"
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  DOTNET_VERSION: 8.0.x
+  NUGET_PACKAGE_ID: SiGit.Code
+
+jobs:
+  build-native-binaries:
+    name: Build native binary (${{ matrix.build.NAME }})
+    runs-on: ${{ matrix.build.OS }}
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - {
+              NAME: linux-x64,
+              OS: ubuntu-latest,
+              TARGET: x86_64-unknown-linux-gnu,
+            }
+          - {
+              NAME: linux-arm64,
+              OS: ubuntu-24.04-arm,
+              TARGET: aarch64-unknown-linux-gnu,
+            }
+          - {
+              NAME: windows-x64,
+              OS: windows-2022,
+              TARGET: x86_64-pc-windows-msvc,
+            }
+          - {
+              NAME: windows-arm64,
+              OS: windows-2022,
+              TARGET: aarch64-pc-windows-msvc,
+            }
+          - { NAME: darwin-x64, OS: macos-26, TARGET: x86_64-apple-darwin }
+          - { NAME: darwin-arm64, OS: macos-26, TARGET: aarch64-apple-darwin }
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Read Rust toolchain
+        shell: bash
+        run: |
+          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
+          if [ -z "$rust_toolchain" ]; then
+            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
+            exit 1
+          fi
+          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
+      - name: Install Rust target
+        shell: bash
+        run: |
+          rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}
+          rustup target list --installed
+
+      - name: Setup Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: nuget-${{ matrix.build.TARGET }}
+
+      - name: Build binary
+        shell: bash
+        run: cargo build --locked --release --target ${{ matrix.build.TARGET }}
+
+      - name: Prepare artifact
+        shell: bash
+        run: |
+          executable_name="sigit"
+          if [[ "${{ matrix.build.OS }}" == "windows-2022" ]]; then
+            executable_name="sigit.exe"
+          fi
+
+          mkdir -p "nuget-artifacts/native/${{ matrix.build.NAME }}"
+          cp "target/${{ matrix.build.TARGET }}/release/${executable_name}" \
+            "nuget-artifacts/native/${{ matrix.build.NAME }}/${executable_name}"
+
+      - name: Upload native artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuget-native-${{ matrix.build.NAME }}
+          path: nuget-artifacts/native
+
+  pack-nuget:
+    name: Pack NuGet .NET tool
+    runs-on: ubuntu-latest
+    needs: build-native-binaries
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set the release version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_version="${GITHUB_REF_NAME#v}"
+          else
+            release_version="${{ github.event.inputs.tag }}"
+            release_version="${release_version#v}"
+          fi
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Download native artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: nuget-native-*
+          path: nuget/sigit/native
+          merge-multiple: true
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Pack .NET tool
+        shell: bash
+        run: |
+          dotnet pack nuget/sigit/SiGit.Code.csproj \
+            --configuration Release \
+            --output nuget/dist \
+            -p:PackageVersion=${RELEASE_VERSION}
+
+      # All six binaries ship in one package, so this sits closer to nuget.org's
+      # 250 MB ceiling than the single-platform npm and PyPI artifacts do. Fail
+      # here with a clear message rather than at `dotnet nuget push`, where the
+      # error is just "the package file exceeds the size limit".
+      - name: Check package size against the NuGet limit
+        shell: bash
+        run: |
+          package="$(ls nuget/dist/*.nupkg | head -n 1)"
+          size_bytes="$(wc -c < "${package}")"
+          limit_bytes=$((250 * 1024 * 1024))
+
+          echo "Package: ${package}"
+          echo "Size:    $((size_bytes / 1024 / 1024)) MiB"
+
+          if [ "${size_bytes}" -gt "${limit_bytes}" ]; then
+            echo "::error::${package} is over nuget.org's 250 MB package limit. Split the tool into RID-specific packages (.NET 10 DotnetToolRidPackage) instead of bundling every target." >&2
+            exit 1
+          fi
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuget-package
+          path: nuget/dist/*.nupkg
+
+  smoke-test:
+    name: Smoke test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    needs: pack-nuget
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-2022
+          - macos-26
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set the release version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_version="${GITHUB_REF_NAME#v}"
+          else
+            release_version="${{ github.event.inputs.tag }}"
+            release_version="${release_version#v}"
+          fi
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Download package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: nuget-package
+          path: nuget/dist
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Install tool from local package
+        shell: pwsh
+        run: |
+          $packageSource = (Resolve-Path "nuget/dist").Path
+          @"
+          <?xml version="1.0" encoding="utf-8"?>
+          <configuration>
+            <packageSources>
+              <clear />
+              <add key="local" value="$packageSource" />
+            </packageSources>
+          </configuration>
+          "@ | Set-Content -Path "nuget/NuGet.Config"
+
+          dotnet tool install `
+            --tool-path ".tool" `
+            --configfile "nuget/NuGet.Config" `
+            --version "$env:RELEASE_VERSION" `
+            "$env:NUGET_PACKAGE_ID"
+
+      - name: Verify bundled native binary
+        shell: pwsh
+        run: |
+          $runtimeIdentifier = if ($IsWindows) {
+            if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq [System.Runtime.InteropServices.Architecture]::Arm64) { "windows-arm64" } else { "windows-x64" }
+          } elseif ($IsMacOS) {
+            if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq [System.Runtime.InteropServices.Architecture]::Arm64) { "darwin-arm64" } else { "darwin-x64" }
+          } else {
+            if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq [System.Runtime.InteropServices.Architecture]::Arm64) { "linux-arm64" } else { "linux-x64" }
+          }
+
+          $binaryName = if ($IsWindows) { "sigit.exe" } else { "sigit" }
+          $nativeBinary = Get-ChildItem ".tool/.store" -Recurse -File | Where-Object {
+            $_.FullName -like "*native*${runtimeIdentifier}*${binaryName}"
+          } | Select-Object -First 1
+
+          if (-not $nativeBinary) {
+            Write-Error "The sigit native binary for ${runtimeIdentifier} was not bundled in the installed .NET tool package."
+          }
+
+          Write-Host "Found bundled native binary at $($nativeBinary.FullName)"
+
+  publish-nuget:
+    name: Publish to NuGet
+    runs-on: ubuntu-latest
+    needs: smoke-test
+    # Trusted Publishing exchanges a GitHub OIDC token for a short-lived NuGet
+    # API key, so no long-lived NUGET_API_KEY secret is stored. Requires the
+    # `sigit-nuget` trusted publisher policy on nuget.org (owner getsigit, repo
+    # sigit, workflow release-nuget.yml).
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Set the release version
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            release_version="${GITHUB_REF_NAME#v}"
+          else
+            release_version="${{ github.event.inputs.tag }}"
+            release_version="${release_version#v}"
+          fi
+          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"
+
+      - name: Download package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: nuget-package
+          path: nuget/dist
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Check whether release already exists on NuGet
+        id: nuget-check
+        shell: bash
+        run: |
+          package_index_url="https://api.nuget.org/v3-flatcontainer/sigit.code/index.json"
+          if curl -fsS "${package_index_url}" | grep -F "\"${RELEASE_VERSION}\"" >/dev/null; then
+            echo "${NUGET_PACKAGE_ID} ${RELEASE_VERSION} already exists on NuGet, skipping publish"
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Exchange the workflow's OIDC token for a short-lived NuGet API key. The
+      # key is written to the environment for the subsequent `dotnet nuget push`
+      # via the NUGET_API_KEY variable this action sets.
+      - name: NuGet trusted-publishing login
+        if: steps.nuget-check.outputs.exists != 'true'
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: setoelkahfi
+
+      - name: Publish package
+        if: steps.nuget-check.outputs.exists != 'true'
+        shell: bash
+        run: |
+          dotnet nuget push nuget/dist/*.nupkg \
+            --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate