ci: fail-closed NuGet publish unless NUGET_PUBLISH_ENABLED=true

[georgepwall1991]

Hold nuget.org publishing unless the repo Actions variable NUGET_PUBLISH_ENABLED is explicitly 'true', matching CancelCop.Analyzer.

Why

Unsigned v* tags currently fire .github/workflows/release.yml and dotnet nuget push. George (via CoS) authorised a default-disable. This gate is fail-closed: unset or any value other than 'true' skips the publish job even if a Release/tag fires.

Change

On the publish job (the job that runs dotnet nuget push):

# Hold: this job runs only when the repo Actions variable NUGET_PUBLISH_ENABLED is 'true'.
# Unset/false skips publish even if a Release/tag fires.
if: vars.NUGET_PUBLISH_ENABLED == 'true'

Explicitly not in this PR

• No package version bump
• No Release / tags
• Does not set NUGET_PUBLISH_ENABLED (leave unset)
• Does not unpublish or yank nuget.org packages
• Does not re-enable the Release workflow (disable is still required at the Actions workflow level)

Note

gh workflow disable Release from this agent returns 403 (actions=write missing). Until someone with repo admin disables workflow id 210954591, this job-level if is the in-repo stop for nuget.org pushes.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T09:14:40.121220Z	7ad5aaa	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-15T09:15:56.022333Z	7ad5aaa	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.