ci: Improve consistency for nuget publish

.github/workflows/build-release.yaml

@@ -12,34 +12,48 @@ on:
         default: false
         type: boolean
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
+  validate-release:
+    permissions:
+      contents: read
+    uses: Cysharp/Actions/.github/workflows/validate-release.yaml@main
+    with:
+      tag: ${{ inputs.tag }}
+
   update-packagejson:
+    needs: [validate-release]
     permissions:
       actions: read
       contents: write
     uses: Cysharp/Actions/.github/workflows/update-packagejson.yaml@main
     with:
       file-path: ./src/GrpcWebSocketBridge.Client/package.json
-      tag: ${{ inputs.tag }}
+      tag: ${{ needs.validate-release.outputs.tag }}
       dry-run: ${{ inputs.dry-run }}
+      use-bot-token: true
+    secrets: inherit
 
   build:
+    needs: [validate-release, update-packagejson]
     name: "Build & pack GrpcWebSocketBridge"
     permissions:
       contents: read
     runs-on: ubuntu-24.04
-    needs: [update-packagejson]
     timeout-minutes: 10
     steps:
       - uses: Cysharp/Actions/.github/actions/checkout@main
         with:
           ref: ${{ needs.update-packagejson.outputs.sha }}
       - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
       # Build & Pack
-      - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ inputs.tag }}
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
-      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ inputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
+      - run: dotnet build ./src/GrpcWebSocketBridge.AspNetCore/ -c Release -p:VersionSuffix=${{ needs.validate-release.outputs.tag }}
+      - run: dotnet build ./src/GrpcWebSocketBridge.Client/ -c Release -p:VersionSuffix=${{ needs.validate-release.outputs.tag }}
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ needs.validate-release.outputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.AspNetCore
+      - run: dotnet pack -c Release --no-build -p:VersionPrefix=${{ needs.validate-release.outputs.tag }} --include-symbols --include-source -p:SymbolPackageFormat=snupkg -o ./publish/ ./src/GrpcWebSocketBridge.Client
       - uses: Cysharp/Actions/.github/actions/upload-artifact@main
         with:
           name: nuget
@@ -48,7 +62,7 @@ jobs:
 
   build-unity:
     name: "Build Unity package"
-    needs: [update-packagejson]
+    needs: [validate-release, update-packagejson]
     permissions:
       contents: read
     strategy:
@@ -75,52 +89,37 @@ jobs:
         with:
           directory: tool/GrpcWebSocketBridge.Client.Unity
 
-  # release
-  publish:
-    name: "Publish NuGet packages"
-    needs: [build, build-unity]
-    permissions:
-      contents: read
-      id-token: write # required for NuGet Trusted Publish
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
-      - uses: Cysharp/Actions/.github/actions/download-artifact@main
-      # push nuget
-      - name: NuGet login (OIDC)
-        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
-        id: login
-        with:
-          user: ${{ secrets.NUGET_USER }}
-      - run: dotnet nuget push "./nuget/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
-        if: ${{ !inputs.dry-run }}
-        env:
-          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
-      - run: dotnet nuget push "./nuget/*.snupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
-        if: ${{ !inputs.dry-run }}
-        env:
-          NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
-
   # release
   create-release:
-    needs: [update-packagejson, publish]
+    needs: [validate-release, update-packagejson, build, build-unity]
     permissions:
       contents: write
-      id-token: write # required for NuGet Trusted Publish
     uses: Cysharp/Actions/.github/workflows/create-release.yaml@main
     with:
       commit-id: ${{ needs.update-packagejson.outputs.sha }}
       dry-run: ${{ inputs.dry-run }}
-      tag: ${{ inputs.tag }}
-      nuget-push: false
-      release-upload: false
+      tag: ${{ needs.validate-release.outputs.tag }}
       release-format: "{0}"
     secrets: inherit
 
+  publish-package:
+    needs: [validate-release, create-release]
+    if: ${{ !inputs.dry-run }}
+    permissions:
+      contents: read
+      id-token: write # required for NuGet Trusted Publish
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: Cysharp/Actions/.github/actions/publish-nuget@main
+        with:
+          artifact-name: nuget
+          user: ${{ secrets.NUGET_USER }}
+          version: ${{ needs.validate-release.outputs.version }}
+
   cleanup:
-    if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }}
-    needs: [update-packagejson, create-release]
+    if: ${{ always() && needs.update-packagejson.outputs.is-branch-created == 'true' }}
+    needs: [update-packagejson, create-release, publish-package]
     permissions:
       contents: write
     uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main