From 8923e9b621e824b7ce2caa755424a7a8eff7bc2b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 1 Oct 2026 04:46:45 +0000
Subject: [PATCH 1/2] Add release workflow for automatic PyPI and NuGet
 publishing on tags

Co-authored-by: filmor <30848+filmor@users.noreply.github.com>
---
 .github/workflows/release.yml | 109 ++++++++++++++++++++++++++++++++++
 pythonnet.slnx                |   1 +
 2 files changed, 110 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..e17fc0ea0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,109 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    env:
+      PYTHONNET_SHUTDOWN_MODE: Normal
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Set up Python
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: cpython-3.11
+          cache-python: true
+          activate-environment: true
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --managed-python
+
+      - name: Set Python DLL path
+        run: |
+          echo PYTHONNET_PYDLL=$(python -m find_libpython) >> $GITHUB_ENV
+
+      - name: Python Tests
+        run: pytest
+
+      - name: Embedding tests
+        run: dotnet test --runtime any-ubuntu src/embed_tests/
+
+      - name: Build wheels and sdist
+        run: |
+          uv build
+          uv build --wheel -C="--global-option=--net46-support"
+
+      - name: Build NuGet package
+        run: |
+          dotnet pack --configuration Release --output nuget-dist
+
+      - name: Upload PyPI artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: pypi-artifacts
+          path: dist/
+          if-no-files-found: error
+
+      - name: Upload NuGet artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: nuget-artifacts
+          path: nuget-dist/
+          if-no-files-found: error
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Download PyPI artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: pypi-artifacts
+          path: dist/
+
+      - name: Deploy to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+
+  publish-nuget:
+    name: Publish to NuGet
+    needs: build
+    runs-on: ubuntu-latest
+    environment: NuGet
+    steps:
+      - name: Download NuGet artifacts
+        uses: actions/download-artifact@v8
+        with:
+          name: nuget-artifacts
+          path: nuget-dist/
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Deploy to NuGet
+        run: |
+          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY || secrets.NUGET_MONTHLY }} --skip-duplicate nuget-dist/*.nupkg
+          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY || secrets.NUGET_MONTHLY }} --skip-duplicate nuget-dist/*.snupkg
diff --git a/pythonnet.slnx b/pythonnet.slnx
index 0434ecd6d..f4cf2f385 100644
--- a/pythonnet.slnx
+++ b/pythonnet.slnx
@@ -14,6 +14,7 @@
     <File Path=".github/workflows/ARM.yml" />
     <File Path=".github/workflows/main.yml" />
     <File Path=".github/workflows/nuget-preview.yml" />
+    <File Path=".github/workflows/release.yml" />
   </Folder>
   <Folder Name="/Repo/">
     <File Path=".editorconfig" />

From 1b36f368baa4882e069fe59a63b58017c3efaaec Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 1 Oct 2026 04:49:22 +0000
Subject: [PATCH 2/2] Fix secret fallback and add explicit workflow permissions
 in release.yml

Co-authored-by: filmor <30848+filmor@users.noreply.github.com>
---
 .github/workflows/release.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e17fc0ea0..94b1cdc32 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and Test
@@ -73,6 +76,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       id-token: write
     steps:
       - name: Download PyPI artifacts
@@ -104,6 +108,10 @@ jobs:
           dotnet-version: '10.0.x'
 
       - name: Deploy to NuGet
+        env:
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_MONTHLY: ${{ secrets.NUGET_MONTHLY }}
         run: |
-          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY || secrets.NUGET_MONTHLY }} --skip-duplicate nuget-dist/*.nupkg
-          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY || secrets.NUGET_MONTHLY }} --skip-duplicate nuget-dist/*.snupkg
+          API_KEY="${NUGET_API_KEY:-$NUGET_MONTHLY}"
+          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key "$API_KEY" --skip-duplicate nuget-dist/*.nupkg
+          dotnet nuget push --source https://api.nuget.org/v3/index.json --api-key "$API_KEY" --skip-duplicate nuget-dist/*.snupkg