ci(packages): never publish 3.10.x release events to nuget.org

[sfmskywalker]

3.10.x is feedz-only. A GitHub Release event for 3.10.x / v3.10.x must never publish to nuget.org. This PR adds a fail-closed guard on the only public job (Publish release to nuget.org). There is no public npm job in this workflow. Feedz publishing, triggers, build, and versioning are unchanged.

This mirrors the same guard on elsa-studio main.

The build job still derives the package version from the tag name by stripping the refs/tags/ prefix only (a leading v is not stripped). The public-job guard therefore checks both 3.10. and v3.10. prefixes on github.event.release.tag_name.

Truth table

Trigger	Tag	Public nuget.org job
release / published	3.10.0	skipped
release / published	v3.10.1-preview.2	skipped
release / published	3.9.0	allowed
release / published	3.11.0	allowed
push	n/a	unchanged (already does not run this job)
workflow_dispatch	n/a	unchanged (already does not run this job)

Defense in depth: if the job-level if: is later weakened, the first step still fails with a clear message when the tag is 3.10.x.

3.9.x releases are unaffected

A 3.9.0 tag is cut from release/3.9.0 and uses that branch's packages.yml. This PR only changes main. It does not touch release/3.9.0.

Verification

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/packages.yml'))" succeeds.
• actionlint was not available in the environment.

  

[sfmskywalker]

Code Review, Round 1/4: APPROVE + HIGH @ c4b18a9

This is a guard-only change to .github/workflows/packages.yml. The single public job, publish_nuget ("Publish release to nuget.org"), no longer publishes 3.10.x. publish_preview_feedz is untouched, and this repo has no npm job.

Guard logic (checked explicitly as requested)

• The job-level if skips any tag starting with 3.10. or v3.10.. The build doesn't strip a leading v, so checking both forms is correct. The trailing dot keeps 3.1.x, 3.100.x and 3.9.x unaffected, and 3.10.0-preview.* tags are covered, as intended.
• The fail-closed [[ ]] step runs before the package download and before the OIDC exchange, so a weakened if would turn the job red instead of letting it publish.
• No job needs: publish_nuget, so nothing downstream is affected.
• This is the simplest of the three guards (no redundant == 3.10.0 clauses). The ::error:: annotation is a nice touch.
• The branch is 2 commits behind main, but those commits only touch Dapper files (#237), not packages.yml, so nothing needs to be done.

Non-blocking: tag interpolation into bash stays as-is, the same call as core#8485.

Gate: APPROVE + HIGH, and Greptile is waived for elsa-extensions. ubuntu-latest and CodeQL are still pending. Merge once they're green.

[sfmskywalker]

Closing as superseded by the stronger public-publisher gates merged in #274 (c638939), verified present on current main. Public NuGet publication now requires workflow_dispatch, an explicit default-off input, and a computed version outside 3.10.x. This draft only adds release-event checks and does not add a missing dispatch guard. Feedz ownership/cutover remains separate program work in elsa-workflows/elsa-core#8194; this closure does not claim that cutover or publication is complete.