ci: attach the built nupkg to a GitHub Release on develop

Add a release job that, on develop, publishes the LibGit2Sharp.UiPath
nupkg to a GitHub Release tagged pkg-<version> (prefix keeps it out of
MinVer's tag space). The interactive feed-publish step can then fetch the
package from the release instead of rebuilding locally. No feed push runs
in CI — that stays deliberate/manual. SKILL.md Step 3 updated to match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: andrei-balint

.claude/skills/release-libgit2-natives/SKILL.md

@@ -154,9 +154,15 @@ number keeps climbing. Only pitfall: never tag **below** the current `v<N>`, or
 backwards (NuGet forbids). New upstream base → `git tag X.Y.Z-v0`. Same scheme in the nativebinaries repo.
 
 **Publishing to the uipath-internal feed — done interactively from here** (like the gates: there is
-no CI publish job). Once the Gate B PR is merged to `develop` and CI is green, get the
-`LibGit2Sharp.UiPath` nupkg — download the managed CI's **NuGet packages** artifact, or build locally
-(`dotnet build -c Release` emits it under `bin/Packages/`, via `GeneratePackageOnBuild`).
+no CI publish job). Once the Gate B PR is merged to `develop`, the managed `ci.yml` builds the nupkg
+and attaches it to a GitHub Release **`pkg-<version>`** (e.g. `pkg-1.9.1-v14`). Pull it straight from
+there — no local rebuild:
+
+```bash
+gh release download pkg-<version> --repo UiPath/libgit2sharp --pattern '*.nupkg' --dir ./pkg
+```
+
+(Or build locally: `dotnet build -c Release` emits it under `bin/Packages/`.)
 
 **Recommended — mint a short-lived Azure DevOps token via the Azure CLI** (no stored PAT, reuses your
 `az login` SSO):

.github/workflows/ci.yml

@@ -73,3 +73,42 @@ jobs:
         # and does not exercise our native packaging, so it is excluded here.
         run: dotnet test LibGit2Sharp.sln --configuration Release --framework ${{ matrix.tfm }} --logger "GitHubActions" /p:ExtraDefine=LEAKS_IDENTIFYING --filter "FullyQualifiedName!~CanInspectCertificateOnClone"
 
+  release:
+    name: Release nupkg
+    needs: build
+    # On develop, attach the built LibGit2Sharp.UiPath nupkg to a GitHub Release so the interactive
+    # feed-publish step can pull it straight from the release (gh release download) instead of
+    # rebuilding locally. No feed push happens here — that stays a deliberate manual step.
+    if: github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download packages
+        uses: actions/download-artifact@v4
+        with:
+          name: NuGet packages
+          path: packages
+      - name: Publish nupkg to GitHub Release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference = 'Continue'
+          $PSNativeCommandUseErrorActionPreference = $false
+          $nupkg = Get-ChildItem packages -Recurse -File |
+            Where-Object { $_.Extension -eq '.nupkg' } | Select-Object -First 1
+          if (-not $nupkg) { throw "No .nupkg found in the build artifact." }
+          # Version = the nupkg filename minus the package-id prefix. The tag is prefixed 'pkg-' so it
+          # is NOT a bare SemVer and MinVer ignores it (only the manual X.Y.Z-vN tag drives versions).
+          $version = $nupkg.BaseName -replace '^LibGit2Sharp\.UiPath\.', ''
+          $tag = "pkg-$version"
+          Write-Host "Publishing $($nupkg.Name) to release $tag"
+          gh release view $tag *> $null
+          if ($LASTEXITCODE -ne 0) {
+            gh release create $tag --title $tag --notes "LibGit2Sharp.UiPath $version, built from develop. Fetch with: gh release download $tag --pattern '*.nupkg'"
+          }
+          gh release upload $tag "$($nupkg.FullName)" --clobber
+          if ($LASTEXITCODE -ne 0) { throw "gh release upload failed ($LASTEXITCODE)" }
+          Write-Host "Published $($nupkg.Name) to release $tag"
+