From 602d5db210ad78f581a0516ad2e6c7bde8e733e4 Mon Sep 17 00:00:00 2001
From: Vineeth Thomas Alex
 <16733941+vineeththomasalex@users.noreply.github.com>
Date: Fri, 16 Oct 2026 15:57:32 -0500
Subject: [PATCH 1/2] Separate package build and publication

---
 .github/workflows/publish.yml | 40 ++++++++++++++++++++++++++++++++---
 README.md                     | 12 +++++++++++
 2 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8ca204e..0c15ed0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches:
       - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -11,14 +15,14 @@ jobs:
     steps:
     - name: checkout project
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: setup msbuild
       uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
 
     - name: setup nuget
       uses: NuGet/setup-nuget@fd55a6f3b34392fa83fde1454582407d8c714123 # v4.0
-      env:
-        ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
 
     - name: setup cppwinrt
       run: nuget restore test.sln
@@ -32,5 +36,35 @@ jobs:
     - name: nuget pack
       run: nuget.exe pack TestComponent/TestComponent.nuspec -OutputFileNamesWithoutVersion
 
+    - name: upload package
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: testwinrt-package
+        path: KennyKerr.Windows.TestWinRT.nupkg
+        if-no-files-found: error
+        retention-days: 1
+
+  publish:
+    needs: build
+    if: github.event_name == 'workflow_dispatch' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: windows-latest
+    environment: nuget-publish
+    permissions: {}
+    steps:
+    - name: download package
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      with:
+        name: testwinrt-package
+        path: ${{ runner.temp }}\testwinrt-package
+
+    - name: setup nuget
+      uses: NuGet/setup-nuget@fd55a6f3b34392fa83fde1454582407d8c714123 # v4.0
+
     - name: nuget push
-      run: nuget push KennyKerr.Windows.TestWinRT.nupkg ${{ secrets.NUGET_KEY }} -Source nuget.org
+      env:
+        NUGET_KEY: ${{ secrets.NUGET_KEY }}
+      run: |
+        if ([string]::IsNullOrWhiteSpace($env:NUGET_KEY)) {
+          throw "Configure NUGET_KEY in the nuget-publish environment before publishing."
+        }
+        nuget push "${{ runner.temp }}\testwinrt-package\KennyKerr.Windows.TestWinRT.nupkg" -ApiKey $env:NUGET_KEY -Source https://api.nuget.org/v3/index.json
diff --git a/README.md b/README.md
index b489cce..580b349 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,15 @@
+## Publishing
+
+Pushes to the default branch build and retain the package without publishing it.
+To publish, run the **Publish** workflow manually from the default branch. A separate
+job downloads that run's package without checking out or building repository code.
+
+Before enabling publication, configure the `nuget-publish` environment with required
+reviewers, prevent self-review, and restrict deployments to the default branch.
+Store `NUGET_KEY` only as an environment secret, removing any repository-level or
+organization-level copy available to this repository. Environment protection rules
+must be configured in repository settings; declaring an environment in YAML does
+not create approval rules. Review the selected commit and package before approving.
 
 ## Contributing
 

From 0ca2b9b8fdf251e860169b599cc84afda359c7ae Mon Sep 17 00:00:00 2001
From: Vineeth Thomas Alex
 <16733941+vineeththomasalex@users.noreply.github.com>
Date: Fri, 16 Oct 2026 17:07:43 -0500
Subject: [PATCH 2/2] Remove README changes

---
 README.md | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/README.md b/README.md
index 580b349..b489cce 100644
--- a/README.md
+++ b/README.md
@@ -1,15 +1,3 @@
-## Publishing
-
-Pushes to the default branch build and retain the package without publishing it.
-To publish, run the **Publish** workflow manually from the default branch. A separate
-job downloads that run's package without checking out or building repository code.
-
-Before enabling publication, configure the `nuget-publish` environment with required
-reviewers, prevent self-review, and restrict deployments to the default branch.
-Store `NUGET_KEY` only as an environment secret, removing any repository-level or
-organization-level copy available to this repository. Environment protection rules
-must be configured in repository settings; declaring an environment in YAML does
-not create approval rules. Review the selected commit and package before approving.
 
 ## Contributing