ci: fix NuGet restore auth — use PAT_DISPATCH for cross-repo packages

Author: Jani Giannoudis

.github/workflows/release.yml

@@ -51,8 +51,6 @@ jobs:
             echo "make_draft=false" >> $GITHUB_OUTPUT
           fi
 
-      # Use PAT for checkout so the push triggers no recursive workflows
-      # and the tag/release is created on the correct commit
       - uses: actions/checkout@v4
         with:
           token: ${{ secrets.PAT_DISPATCH }}
@@ -71,7 +69,6 @@ jobs:
             const repo = context.repo.repo;
             const errors = [];
 
-            // 1. Check git tag
             try {
               await github.rest.git.getRef({ owner, repo, ref: `tags/${tag}` });
               errors.push(`Git tag '${tag}' already exists`);
@@ -80,7 +77,6 @@ jobs:
               console.log(`✅ Git tag '${tag}' is available`);
             }
 
-            // 2. Check GitHub Release
             try {
               await github.rest.repos.getReleaseByTag({ owner, repo, tag });
               errors.push(`GitHub Release '${tag}' already exists`);
@@ -89,33 +85,23 @@ jobs:
               console.log(`✅ GitHub Release '${tag}' is available`);
             }
 
-            // 3. Check GitHub Packages (NuGet)
             try {
               const packages = await github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
-                package_type: 'nuget',
-                package_name: repo,
-                org: owner
+                package_type: 'nuget', package_name: repo, org: owner
               });
-              const exists = packages.data.some(p => p.name === version);
-              if (exists) {
+              if (packages.data.some(p => p.name === version))
                 errors.push(`NuGet package version '${version}' already exists on GitHub Packages`);
-              } else {
+              else
                 console.log(`✅ NuGet package version '${version}' is available`);
-              }
             } catch (e) {
-              if (e.status === 404) {
-                console.log(`✅ No package found yet (first publish)`);
-              } else {
-                console.warn(`⚠️ Could not check packages: ${e.message}`);
-              }
+              if (e.status === 404) console.log(`✅ No package found yet (first publish)`);
+              else console.warn(`⚠️ Could not check packages: ${e.message}`);
             }
 
-            if (errors.length > 0) {
-              const msg = `❌ Version guard failed:\n${errors.map(e => `  - ${e}`).join('\n')}`;
-              core.setFailed(msg);
-            } else {
+            if (errors.length > 0)
+              core.setFailed(`❌ Version guard failed:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+            else
               console.log('\n✅ All version checks passed');
-            }
 
       # ── Update Directory.Build.props ─────────────────
       - name: Read current version
@@ -129,15 +115,12 @@ jobs:
         run: |
           VERSION="${{ steps.params.outputs.version }}"
           CURRENT="${{ steps.current.outputs.version }}"
-
           if [ "${VERSION}" = "${CURRENT}" ]; then
             echo "ℹ️ Version already set to ${VERSION}, no change needed"
           else
             sed -i "s|<Version>${CURRENT}</Version>|<Version>${VERSION}</Version>|" Directory.Build.props
             echo "✅ Updated Directory.Build.props: ${CURRENT} → ${VERSION}"
           fi
-
-          # Verify
           grep '<Version>' Directory.Build.props
 
       - name: Commit version bump
@@ -146,7 +129,6 @@ jobs:
           VERSION="${{ steps.params.outputs.version }}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-
           git add Directory.Build.props
           if git diff --cached --quiet; then
             echo "ℹ️ No changes to commit (version was already correct)"
@@ -168,7 +150,7 @@ jobs:
             "https://nuget.pkg.github.com/Payroll-Engine/index.json" \
             --name github \
             --username github-actions \
-            --password ${{ secrets.GITHUB_TOKEN }} \
+            --password ${{ secrets.PAT_DISPATCH }} \
             --store-password-in-clear-text
 
       - name: Restore