Workflow drift in derived single-target repos: action-pin lag + id-vs-pattern artifact handoff

[ptr727]

Surfaced during a template re-sync into a derived single-target (.NET NuGet-only) repo, per the AGENTS.md "Report drift upstream" rule. Two pieces of drift between the template and the derived repo's build-nugetlibrary-task.yml / build-release-task.yml. Neither blocks the re-sync; both will keep re-surfacing on every future sync until the template decides the canonical form.

1. Action pins: template is behind

The derived repo carries newer pins than the template for the same actions:

Action	Template	Derived repo
actions/setup-dotnet	v5.2.0	v5.3.0
actions/checkout	v6.0.2	v7.0.0
actions/upload-artifact	v6.0.0	v7.0.1
actions/download-artifact	v7.0.0	v8.0.1

If the template is meant to be the source of truth for pins, it should lead (or at least not trail) its derived repos. Suggest bumping the template to the current major/minor for these four.

2. Artifact handoff: id-based vs pattern-based (design fork)

The build → github-release handoff has diverged in a way that is internally consistent on each side but conflicts on every re-sync:

Template (multi-target — nuget + pypi + executable + docker feed one release):

• upload: name: release-asset-<branch>-<target>, no workflow output
• download: pattern: release-asset-<branch>-* + merge-multiple: true
• A stable name pattern is the right abstraction here — the release job globs every target's asset without threading N separate output ids.

Derived repo (single-target):

• upload: name: nugetlibrary-build-<branch>, exposes an artifact-id workflow output
• download: artifact-ids: ${{ needs.build-nugetlibrary.outputs.artifact-id }}
• For one target this is arguably cleaner: an exact 1:1 handle with no name-collision surface.

This is a real fork, not a placeholder substitution, so a verbatim re-sync can't reconcile it. The decision is the template's to make:

• (a) Standardize all derived repos on the template's pattern-based handoff (uniformity; single-target repos carry slightly more machinery than they need), or
• (b) Bless the id-based handoff as the sanctioned single-target variant and document it as a droppable/swappable block (like the .editorconfig [*.cs] block), so single-target repos stop drifting against it.

Happy to send a PR for whichever direction you pick. Holding the derived repo as-is (id-based, newer pins) until you weigh in.

[ptr727]

Both parts are resolved in the template; closing.

1. Action-pin lag — fixed in bb62f18 (#204): the template now leads the four pins (setup-dotnet v5.3.0, checkout v7.0.0, upload-artifact v7.0.1, download-artifact v8.0.1), the same SHAs the derived repos were already running. Reinforced repo-wide in 9eb242a (#207).

2. id-vs-pattern artifact handoff — resolved as option (a): #204 affirmed the name-pattern handoff (release-asset-<branch>-* + merge-multiple) as canonical for every repo including single-target, documented in AGENTS.md. The template's build-nugetlibrary-task.yml uses name: release-asset-<branch>-nugetlibrary with no artifact-id output. The id-based variant is not blessed.

Downstream verification: the two single-target NuGet repos (ptr727/LanguageTags, ptr727/Utilities) already carry the pattern-based handoff (release-asset-<branch>-nugetlibrary, no artifact-id), so they are converged — no downstream change needed for this issue.