Fix release workflow NuGet publish gating for organization secret

[Copilot]

The release workflow failed to load because it referenced secrets.NUGET_API_KEY directly in a step-level if, which is not supported in this expression context. This change switches the workflow to consume the organization-level NuGet key through job environment state and uses that value to conditionally publish packages.

• Problem

  • Release workflow parsing failed before execution.
  • NuGet publish could not use the organization NUGET_API_KEY due to invalid if expression usage.

• Workflow change

  • Map secrets.NUGET_API_KEY into the release job env.
  • Gate the publish step with env.NUGET_API_KEY != '' instead of referencing secrets directly.
  • Reuse the mapped environment variable in dotnet nuget push.

• Result

  • The workflow remains optional when the NuGet key is absent.
  • When the organization secret is present, package publishing can proceed without invalid workflow syntax.

jobs:
  release:
    env:
      NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}

    steps:
      - name: Publish to NuGet
        if: env.NUGET_API_KEY != ''
        run: dotnet nuget push "./artifacts/*.nupkg" --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate

[Copilot]

Pull request overview

Updates the GitHub Actions release workflow to avoid a workflow parsing failure and to conditionally publish NuGet packages only when the NuGet API key is available.

Changes:

• Maps secrets.NUGET_API_KEY into the release job environment.
• Gates the “Publish to NuGet” step using env.NUGET_API_KEY != ''.
• Switches dotnet nuget push to use the mapped environment variable.

[Copilot]

NUGET_API_KEY is set at the job level, so it will be injected into the environment of all steps (including third-party actions like softprops/action-gh-release). To reduce accidental exposure/supply-chain risk, scope the secret to only the NuGet publish step (move the env: NUGET_API_KEY: ... mapping onto that step) and keep the if: env.NUGET_API_KEY != '' gate there as well.