fix(template): set environment 'nuget' + concurrency on canonical nuget-publish

[ANcpLua]

Why

The nuget.org Trusted Publisher policies for the .NET fleet repos require Environment = nuget (verified on Qyl.OpenTelemetry.SemanticConventions, .Autoinstrumentation, ancplua.evaluation.template), but the canonical nuget-publish.yml set no environment: on the publish job. So every fleet release fails OIDC token exchange:

Token exchange failed (HTTP 401) ... Environment mismatch for policy '<pkg>': expected 'nuget', actual ''

(This already bit the Qyl.OpenTelemetry.SemanticConventions v3.1.0 release, which is currently carrying a per-repo CANONICAL-DEPARTURE workaround.)

Fix

• Add environment: nuget to the publish job → OIDC environment claim matches the policy.
• Add a concurrency group (serialize per ref, cancel-in-progress: false) so overlapping tag pushes can't race a publish (also addresses a CodeRabbit note).

Rollout

Propagates to fleet repos on the next enforce-repo-settings sweep (or targeted sync-nuget-publish.sh). Repos carrying a per-repo departure marker for this exact reason can drop it once synced.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "tools"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cdde20f8-49b6-4d75-afa8-0bd0dd23d24f

📥 Commits

Reviewing files that changed from the base of the PR and between 1879c24 and 3a2fbd4.

📒 Files selected for processing (1)

• templates/nuget-publish.yml

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (1)

templates/**

⚙️ CodeRabbit configuration file

Treat templates as fleet source of truth. Verify downstream sync behavior and avoid template-workflow drift.

Files:

• templates/nuget-publish.yml

🔇 Additional comments (1)

templates/nuget-publish.yml (1)

64-76: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • NuGet publishing now runs one at a time per branch or ref, reducing the chance of interrupted releases.
  • Publish jobs now use the required deployment environment, helping authentication succeed reliably during releases.

Walkthrough

The workflow now serializes NuGet publish runs per git ref and assigns the publish job to the nuget environment with an OIDC-related note.

Changes

NuGet publish workflow

Layer / File(s)	Summary
Ref-scoped concurrency templates/nuget-publish.yml	The workflow groups publish runs by github.ref and keeps in-progress runs from being canceled within the same ref group.
Publish job environment templates/nuget-publish.yml	The publish job uses the nuget environment and documents that it must match the nuget.org Trusted Publisher Environment value for OIDC token exchange.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the concrete workflow changes: nuget environment and per-ref concurrency.
Description check	✅ Passed	The description directly explains the same nuget publish environment and concurrency updates in the workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Retired Reviewers	✅ Passed	The only changed workflow is templates/nuget-publish.yml, and it adds NuGet publish concurrency/environment settings with no Codacy, triage-bot, or reviewer-bot automation.
Automation Is Event Scoped	✅ Passed	The PR only updates the NuGet publish workflow to run on tag push/manual dispatch; it adds no schedule or reviewer/repair polling automation.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nuget-publish-template-environment

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/nuget-publish-template-environment

• 🛠️ repair automation
• 🛠️ cleanup stale review automation

---

_{Comment @coderabbitai help to get the list of available commands.}

[ANcpLua]

Closing — this blanket environment: nuget is UNSAFE for the fleet.

Investigation of actual release history shows the fleet is split but internally consistent:

• Empty-environment policies (publish successfully with NO environment: in the workflow): ANcpLua.NET.Sdk (2026-06-26), ANcpLua.Analyzers, qyl. Forcing environment: nuget here would flip the 401 the other way ("expected '', actual 'nuget'").
• 'nuget' policies (already have environment: nuget in their workflow and publish fine): Qyl.OpenTelemetry.SemanticConventions (now), .Autoinstrumentation, ANcpLua.Agents, ANcpLua.Roslyn.Utilities, ancplua.evaluation.template, dotcov, ErrorOrX.

So a single hardcoded environment in the canonical template can't be right for both groups. SemanticConventions (the only mismatch) is fixed per-repo via its CANONICAL-DEPARTURE marker.

If the fleet wants to standardize, the robust template change is environment: ${{ vars.NUGET_ENVIRONMENT }} (each repo sets the variable to match its policy) — but that also needs the nuget.org policies reconciled (web console), so it's a deliberate fleet decision, not a safe auto-merge.