From e0d5264926f38395abc756a11a2c1e5012e0f97c Mon Sep 17 00:00:00 2001
From: mxtordev <64542491+mxtordev@users.noreply.github.com>
Date: Sun, 5 Jul 2026 23:01:40 +0200
Subject: [PATCH 1/2] Create GitHub release after NuGet publish

---
 .github/workflows/release.yml | 56 ++++++++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a396e30..a1a8ffa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ on:
         type: string
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
 
 jobs:
@@ -89,6 +89,7 @@ jobs:
           tests/PackageSmoke/run.sh artifacts/packages "$package_version" net8.0 8.0.100
 
           printf 'package_file=%s\n' "$package_file" >> "$GITHUB_OUTPUT"
+          printf 'package_version=%s\n' "$package_version" >> "$GITHUB_OUTPUT"
 
       - name: Upload package artifacts
         uses: actions/upload-artifact@v7
@@ -111,3 +112,56 @@ jobs:
           --api-key "${{ steps.login.outputs.NUGET_API_KEY }}"
           --source https://api.nuget.org/v3/index.json
           --skip-duplicate
+
+      - name: Create GitHub release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PACKAGE_VERSION: ${{ steps.package.outputs.package_version }}
+        run: |
+          set -euo pipefail
+
+          tag="v${PACKAGE_VERSION}"
+          notes_file="$RUNNER_TEMP/release-notes.md"
+
+          awk -v version="$PACKAGE_VERSION" '
+            $0 == "## " version || index($0, "## " version " ") == 1 {
+              in_section = 1
+              next
+            }
+
+            in_section && /^## / {
+              exit
+            }
+
+            in_section {
+              print
+            }
+          ' CHANGELOG.md > "$notes_file"
+
+          if ! grep -q '[^[:space:]]' "$notes_file"; then
+            printf 'Could not find changelog notes for version %s.\n' "$PACKAGE_VERSION" >&2
+            exit 1
+          fi
+
+          git fetch --tags --force origin
+
+          if gh release view "$tag" >/dev/null 2>&1; then
+            printf 'GitHub release %s already exists.\n' "$tag"
+            exit 0
+          fi
+
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            tagged_commit="$(git rev-list -n 1 "$tag")"
+            if [ "$tagged_commit" != "$GITHUB_SHA" ]; then
+              printf 'Tag %s already points to %s, expected %s.\n' "$tag" "$tagged_commit" "$GITHUB_SHA" >&2
+              exit 1
+            fi
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "$tag" -m "Release $tag" "$GITHUB_SHA"
+            git push origin "refs/tags/$tag"
+          fi
+
+          gh release create "$tag" --title "$tag" --notes-file "$notes_file" --verify-tag

From a9358f716610679c4f0367b354fc02bee4dcb92c Mon Sep 17 00:00:00 2001
From: mxtordev <64542491+mxtordev@users.noreply.github.com>
Date: Sun, 5 Jul 2026 23:06:53 +0200
Subject: [PATCH 2/2] Scope release workflow permissions

---
 .github/workflows/release.yml | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a1a8ffa..3c17ed7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,16 +13,20 @@ on:
         type: string
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 
 jobs:
   publish:
     name: Publish NuGet package
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     environment:
       name: release
       deployment: false
+    outputs:
+      package_version: ${{ steps.package.outputs.package_version }}
 
     steps:
       - name: Ensure main branch
@@ -113,11 +117,22 @@ jobs:
           --source https://api.nuget.org/v3/index.json
           --skip-duplicate
 
+  create-release:
+    name: Create GitHub release
+    runs-on: ubuntu-latest
+    needs: publish
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
       - name: Create GitHub release
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          PACKAGE_VERSION: ${{ steps.package.outputs.package_version }}
+          PACKAGE_VERSION: ${{ needs.publish.outputs.package_version }}
         run: |
           set -euo pipefail