feat: publish Purview.Build to nuget.org

.github/actions/purview-build/action.yml

@@ -1,10 +1,9 @@
 name: Purview Build
 
 description: >-
-  Installs the pinned Purview.Build dotnet tool from the Purview-Dev GitHub Packages feed and runs
-  it against the repository. Configuration flows through job environment variables (Build__*,
-  Release__*, NuGet__*, PublishLocalNuGet__*) and secrets (NUGET_APIKEY, GITHUB_TOKEN,
-  LOCAL_NUGET_FEED_PATH).
+  Installs the pinned Purview.Build dotnet tool from nuget.org and runs it against the repository.
+  Configuration flows through job environment variables (Build__*, Release__*, NuGet__*,
+  PublishLocalNuGet__*) and secrets (NUGET_APIKEY, GITHUB_TOKEN, LOCAL_NUGET_FEED_PATH).
 
 inputs:
   build-version:
@@ -23,22 +22,11 @@ runs:
       with:
         dotnet-version: ${{ inputs.dotnet-version }}
 
-    - name: Authenticate to Purview-Dev packages
-      shell: bash
-      run: >-
-        dotnet nuget add source
-        "https://nuget.pkg.github.com/purview-dev/index.json"
-        --name purview-dev
-        --username "${{ github.actor }}"
-        --password "${{ github.token }}"
-        --store-password-in-clear-text
-
     - name: Install pinned shared build
       shell: bash
       run: >-
         dotnet tool install Purview.Build
         --tool-path "${{ runner.temp }}/purview-build"
-        --source "https://nuget.pkg.github.com/purview-dev/index.json"
         --version "${{ inputs.build-version }}"
 
     - name: Run shared build

.github/workflows/purview-build.yml

@@ -50,7 +50,7 @@ on:
         required: false
 
 permissions:
-  contents: write
+  contents: read
   packages: read
 
 jobs:
@@ -68,20 +68,10 @@ jobs:
         with:
           dotnet-version: ${{ inputs.dotnet-version }}
 
-      - name: Authenticate to Purview-Dev packages
-        run: >-
-          dotnet nuget add source
-          "https://nuget.pkg.github.com/purview-dev/index.json"
-          --name purview-dev
-          --username "${{ github.actor }}"
-          --password "${{ github.token }}"
-          --store-password-in-clear-text
-
       - name: Install pinned shared build
         run: >-
           dotnet tool install Purview.Build
           --tool-path "${{ runner.temp }}/purview-build"
-          --source "https://nuget.pkg.github.com/purview-dev/index.json"
           --version "${{ inputs.build-version }}"
 
       - name: Run shared build

.github/workflows/purview-release.yml

@@ -100,22 +100,11 @@ jobs:
             echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Authenticate to Purview-Dev packages
-        if: steps.version.outputs.should_release == 'true'
-        run: >-
-          dotnet nuget add source
-          "https://nuget.pkg.github.com/purview-dev/index.json"
-          --name purview-dev
-          --username "${{ github.actor }}"
-          --password "${{ github.token }}"
-          --store-password-in-clear-text
-
       - name: Install pinned shared build
         if: steps.version.outputs.should_release == 'true'
         run: >-
           dotnet tool install Purview.Build
           --tool-path "${{ runner.temp }}/purview-build"
-          --source "https://nuget.pkg.github.com/purview-dev/index.json"
           --version "${{ inputs.build-version }}"
 
       - name: Run release pipeline

.github/workflows/release.yml

@@ -10,7 +10,6 @@ on:
 
 permissions:
   contents: write
-  packages: write
 
 concurrency:
   group: purview-build-release
@@ -66,6 +65,16 @@ jobs:
           -p:Version=${{ steps.version.outputs.version }}
           -p:PackageVersion=${{ steps.version.outputs.version }}
 
+      - name: Verify NuGet API key
+        if: steps.version.outputs.release == 'true'
+        env:
+          NUGET_APIKEY: ${{ secrets.NUGET_APIKEY }}
+        run: |
+          if [ -z "$NUGET_APIKEY" ]; then
+            echo "The NUGET_APIKEY secret is not set. It is required to publish Purview.Build to nuget.org." >&2
+            exit 1
+          fi
+
       - name: Install packed tool
         if: steps.version.outputs.release == 'true'
         run: >-
@@ -78,10 +87,10 @@ jobs:
         if: steps.version.outputs.release == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          NUGET_APIKEY: ${{ secrets.NUGET_APIKEY }}
           Release__Mode: NuGet
           Release__UploadArtifacts: "true"
-          NuGet__FeedUrl: https://nuget.pkg.github.com/purview-dev/index.json
-          NuGet__ApiKey: ${{ github.token }}
+          NuGet__FeedUrl: https://api.nuget.org/v3/index.json
           Build__RunTests: "false"
           Build__RunLint: "false"
           Build__ValidatePack: "false"

README.md

@@ -53,7 +53,7 @@ on:
 
 The reusable workflow checks whether `v{version}` (read from `package.json`) is already tagged and skips if so, so merging `main` into `release` releases exactly once.
 
-The reusable workflows authenticate to the internal feed and install the exact CLI version; the consuming repository adds `purview-build.json` and a root `package.json` version. It does not need a copied pipeline project or package-source credentials.
+The reusable workflows install the exact CLI version from nuget.org; the consuming repository adds `purview-build.json` and a root `package.json` version. It does not need a copied pipeline project or package-source credentials.
 
 ### Minimal repository setup (composite action)
 
@@ -73,7 +73,7 @@ jobs:
 ### Local use
 
 ```shell
-dotnet tool install Purview.Build --tool-path ./.tools --add-source https://nuget.pkg.github.com/purview-dev/index.json --version 0.2.0
+dotnet tool install Purview.Build --tool-path ./.tools --version 0.2.1
 ./.tools/purview-build
 ```
 
@@ -118,6 +118,6 @@ Version ───────────────┘
 
 This repository dogfoods the shared tool: CI builds and packs the tool from source, installs the generated package, then runs `purview-build` against this repository so the project builds and packs itself. Locked restore and warnings-as-errors compilation gate every pull request and merge.
 
-On a push to `main`, the release workflow rebuilds and reinstalls the tool from the current source, then runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` pointing at the Purview-Dev GitHub Packages registry, and `Release__UploadArtifacts=true`. The tool therefore publishes the immutable package to `https://nuget.pkg.github.com/purview-dev/index.json` and tags and releases itself (`v{Version}` + generated-notes GitHub release with the package attached) — exactly like every other purview-dev repository. Maintainers bump the `package.json` version and merge; they do not create release tags manually.
+On a push to `main`, the release workflow rebuilds and reinstalls the tool from the current source, then runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` pointing at nuget.org, and `Release__UploadArtifacts=true`. The tool therefore publishes the immutable package to `https://api.nuget.org/v3/index.json` and tags and releases itself (`v{Version}` + generated-notes GitHub release with the package attached) — exactly like every other purview-dev repository. Maintainers bump the `package.json` version and merge; they do not create release tags manually.
 
-After the first publication, an organization owner must set `Purview.Build` to **Internal** under Purview-Dev → Packages → Purview.Build → Package settings. GitHub initially creates NuGet packages as private. Also enable internal package creation under the organization's package settings if it is disabled.
+GitHub initially creates NuGet packages as private. To make sure every package is **Internal** (consumable by all Purview-Dev members), an organization owner should set the org default: Purview-Dev → Settings → Packages → **Package Creation** → **Internal**, and change any already-published package's visibility in its **Package settings** → **Danger Zone**. See [docs/releasing.md](docs/releasing.md) for the exact steps and the `gh api` alternative.

docs/releasing.md

@@ -23,9 +23,25 @@ In both models the reusable `purview-release.yml` workflow reads `package.json`'
 
 This repository dogfoods the shared tool. CI performs locked restore, warnings-as-errors compilation, packing, installation from the generated package, then runs `purview-build` against this repository so the project builds and packs itself.
 
-On a push to `main`, the release workflow reads and validates the `package.json` version, skips when `v{version}` already exists, then builds and installs the tool from the current source and runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` set to the Purview-Dev GitHub Packages registry, and `Release__UploadArtifacts=true`. The tool performs the release build/pack steps, publishes the immutable package to the registry, and creates `v{version}` plus a generated-notes GitHub release with the package attached — tagging itself exactly like every other purview-dev repository. The tool therefore owns tagging; maintainers must not push release tags manually.
+On a push to `main`, the release workflow reads and validates the `package.json` version, skips when `v{version}` already exists, then builds and installs the tool from the current source and runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` set to nuget.org, and `Release__UploadArtifacts=true`. The tool performs the release build/pack steps, publishes the immutable package to `https://api.nuget.org/v3/index.json` using the `NUGET_APIKEY` secret, and creates `v{version}` plus a generated-notes GitHub release with the package attached — tagging itself exactly like every other purview-dev repository. The tool therefore owns tagging; maintainers must not push release tags manually.
 
-GitHub creates the package as private on its first publication. An organization owner must make the package Internal once in the package settings so Purview-Dev members can consume it, and must permit internal package creation in the organization's package policy. NuGet versions are immutable; `--skip-duplicate` makes recovery safe if publication succeeded but tagging was interrupted.
+GitHub creates NuGet packages as private on first publication. To make sure every package is **Internal** (visible to all Purview-Dev members), set both:
+
+1. **Organization default (prevents future private packages)** — org owner:
+   GitHub → purview-dev → Settings → Packages → **Package Creation** → select **Internal**.
+   New NuGet packages published by organization members then default to Internal.
+2. **Existing packages already published while private** — org owner, per package:
+   `https://github.com/orgs/purview-dev/packages/nuget/package/<name>` → **Package settings** → **Danger Zone** → **Change visibility** → **Internal**.
+
+   Or via the CLI/API for every package on the registry:
+
+   ```shell
+   gh api --method PATCH "/orgs/purview-dev/packages/nuget/Purview.Build" -f visibility=internal
+   ```
+
+   Public packages cannot be made private again; private → internal is safe.
+
+NuGet versions are immutable; `--skip-duplicate` makes recovery safe if publication succeeded but tagging was interrupted.
 
 ## For local validation
 

package.json

@@ -1,5 +1,5 @@
 {
   "name": "purview-build",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true
 }