[jonathan-kosgei]

Summary

Merging a pull request that bumps VersionPrefix in src/IPData/IPData.csproj is now enough to tag the release, create the GitHub release and publish the package to NuGet. No manual tagging is needed any more; a merge whose version is already tagged publishes nothing.

• .github/workflows/ci.yml: new release job (push to the default branch only, after build-and-test) and a publish job that calls the NuGet workflow when a release was created.
• .github/workflows/publish.yml: also callable (workflow_call with a tag input); the version comes from the input and falls back to the ref name, so the existing release: published trigger keeps working for manually published releases.
• .github/README.md: a maintainer-facing "Releasing" section.

How it works

1. release runs only for push events on the repository's default branch, after build-and-test succeeds, with contents: write and a release concurrency group so two merges cannot race.
2. It reads VersionPrefix from src/IPData/IPData.csproj, derives the tag vX.Y.Z and checks git ls-remote --exit-code --tags origin refs/tags/vX.Y.Z. Exit status 2 (tag missing) leads to gh release create vX.Y.Z --target $GITHUB_SHA --title vX.Y.Z --generate-notes, which creates the tag and the release in one step; exit status 0 (tag exists) logs that there is nothing to release; any other status fails the job. The job exposes the outputs tag and created.
3. A tag or release created with the workflow's own token does not trigger other workflows, so publishing happens in the same run: the publish job (needs: release, if: needs.release.outputs.created == 'true') calls publish.yml with the tag and secrets: inherit. The build, test, pack and push steps and the secret they use are unchanged.
4. Pull request CI and a manually published release behave exactly as before.

Verification

• Both workflows parse as YAML and pass actionlint 1.7.12 with no findings.
• The version command prints 3.1.0 for the checked-out csproj; v3.1.0 is not tagged yet, so the first merge of this change tags and publishes 3.1.0 (v3.0.2 is the latest existing tag).
• The release step's shell logic was run locally against the real remote with a stubbed gh: a missing tag produces the expected gh release create call and created=true; an existing tag (v3.0.2) produces created=false; an unreachable remote and a csproj without VersionPrefix fail the step.
• The push-triggered release job itself cannot run before this is merged; the pull request CI run covers build-and-test.

🤖 Generated with Claude Code