Attach NuGet packages and SBOM to GitHub Release

[jbogard]

Summary

• Grants contents: write to the Release workflow so it can attach assets to the release the maintainer creates in the UI.
• Adds an "Attach assets to GitHub Release" step in the build-windows job that uses the preinstalled gh CLI to upload the signed *.nupkg, *.snupkg, and SBOM (manifest.spdx.json + .sha256) to the release for the pushed tag. Runs after Push to NuGet, uses --clobber so re-runs of the same tag refresh assets instead of failing.

Test plan

No safe pre-merge rehearsal: the workflow triggers on any *.*.* tag and the new step runs after Push to MyGet/NuGet, so a throwaway tag like 99.0.0-test1 would publish a real package to NuGet.org (which only allows unlisting, not deletion within 72 hours).

Verification happens on the next real release:

• After the next release, confirm the "Attach assets to GitHub Release" step succeeds.
• Confirm four assets land on the release page: AutoMapper.<ver>.nupkg, AutoMapper.<ver>.snupkg, manifest.spdx.json, manifest.spdx.json.sha256.

If the new step fails, the packages are already on the public feeds; re-run the job (idempotent via --clobber) or run gh release upload <tag> <files> --clobber locally as a fallback.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Extends the Release workflow so that, after publishing to NuGet, the signed packages and the generated SBOM are uploaded as assets to the GitHub Release that the maintainer created for the pushed tag.

Changes:

• Elevates the workflow's contents permission from read to write so the workflow can attach release assets.
• Adds a new "Attach assets to GitHub Release" step in build-windows that uses gh release upload with --clobber to push *.nupkg, *.snupkg, and the SPDX SBOM (manifest.spdx.json and its .sha256) to the release for the current tag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.