Add NuGet publish workflow + shared package metadata

The publish job runs on `v*.*.*` tag pushes (or via manual workflow_dispatch
with a version input). It restores, builds Release with the resolved version
threaded through `-p:Version=`, runs unit tests as a release-gate sanity
check, packs all six src projects with symbol packages (.snupkg), and
pushes to nuget.org with --skip-duplicate so re-runs are idempotent.

Directory.Build.props now carries the shared NuGet metadata (Authors,
Repository*, license expression, readme, source-link config). Each
.csproj keeps its Description / RootNamespace; Cel.Parser was missing
both, so add them.

Local pack smoke-tested with -p:Version=0.1.0-dev — produces six nupkgs
+ snupkgs with the expected inter-package dependencies (Cel depends on
Cel.Checker, Cel.Core, Cel.Parser, Cel.Runtime).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: suhdev

.github/workflows/publish.yml

@@ -0,0 +1,80 @@
+name: Publish to NuGet
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  # Manual fallback — pick a version when running:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Package version (e.g. 0.1.0). Leave blank to derive from current tag.'
+        required: false
+        default: ''
+
+# A publish run is a release event — never let two race for the same tag.
+concurrency:
+  group: nuget-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Pack & push to nuget.org
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          # Source linking embeds the commit hash; full history isn't needed.
+          fetch-depth: 1
+
+      - name: Resolve package version
+        id: version
+        # Tag push: strip the leading 'v' from refs/tags/v0.1.0 → 0.1.0.
+        # Manual dispatch: trust the input verbatim. Reject anything else.
+        run: |
+          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then
+            v="${GITHUB_REF#refs/tags/v}"
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ inputs.version }}" ]]; then
+            v="${{ inputs.version }}"
+          else
+            echo "Cannot determine version: not a v*.*.* tag and no input.version given." >&2
+            exit 1
+          fi
+          echo "Version: $v"
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Restore
+        run: dotnet restore
+
+      - name: Build
+        run: dotnet build --configuration Release --no-restore -p:Version=${{ steps.version.outputs.version }}
+
+      - name: Test (sanity)
+        # Treat a failing test on a release as a hard stop — better to refuse a
+        # broken release than to publish it.
+        run: dotnet test tests/Cel.UnitTests --configuration Release --no-build
+
+      - name: Pack
+        run: dotnet pack --configuration Release --no-build -p:Version=${{ steps.version.outputs.version }} --output artifacts
+
+      - name: Push to nuget.org
+        # --skip-duplicate so re-running the workflow on a tag that's been
+        # partially published doesn't fail; nuget.org is the source of truth.
+        run: dotnet nuget push 'artifacts/*.nupkg' --api-key ${{ secrets.NUGET }} --source https://api.nuget.org/v3/index.json --skip-duplicate
+
+      - name: Upload nupkgs as run artifacts
+        # Keep the built nupkgs around for a week so they're easy to inspect
+        # if the push fails at the nuget.org side.
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: nupkgs-${{ steps.version.outputs.version }}
+          path: artifacts/*.nupkg
+          retention-days: 7

Directory.Build.props

@@ -16,6 +16,32 @@
     <NoWarn>$(NoWarn);CA1014;CA1062;CA1303;CA1716;CA1720;CA1724;CA2225;CA1034;CA1859;CA1725</NoWarn>
   </PropertyGroup>
 
+  <!-- Shared NuGet package metadata. Per-project Description / PackageId stay
+       in each .csproj. Version is set on the publish workflow via -p:Version=
+       so this file doesn't need to be edited per release. -->
+  <PropertyGroup>
+    <Authors>suhdev</Authors>
+    <Company>suhdev</Company>
+    <Product>Cel for .NET</Product>
+    <Copyright>Copyright (c) suhdev</Copyright>
+    <PackageProjectUrl>https://github.com/suhdev/csharp-cel</PackageProjectUrl>
+    <RepositoryUrl>https://github.com/suhdev/csharp-cel.git</RepositoryUrl>
+    <RepositoryType>git</RepositoryType>
+    <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageTags>cel;expression-language;policy;rule-engine;cel-spec;dotnet</PackageTags>
+    <!-- Embed source + symbols so consumers can step through into the package. -->
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(IsPackable)' != 'false'">
+    <None Include="$(MSBuildThisFileDirectory)README.md" Pack="true" PackagePath="\" />
+  </ItemGroup>
+
   <PropertyGroup Condition="$([System.String]::Copy('$(MSBuildProjectName)').EndsWith('Tests')) or '$(MSBuildProjectName)' == 'Cel.Conformance'">
     <IsPackable>false</IsPackable>
     <NoWarn>$(NoWarn);CA1707;CA1822;CA2007;CA1515</NoWarn>

src/Cel.Parser/Cel.Parser.csproj

@@ -8,6 +8,8 @@
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <Description>CEL parser: hand-written lexer and Pratt parser, with macro expansion.</Description>
+    <RootNamespace>Cel</RootNamespace>
   </PropertyGroup>
 
 </Project>