Unlist mispublished historical package versions

[woksin]

Workflow-dispatch republishing of historical versions 0.2.0-0.4.0 built current main rather than their immutable tags. NuGet packages therefore carry repository commit ba0d4bed... (v0.5.0 source) instead of the v0.2/v0.3/v0.4 tag commits.

Affected IDs:

• Cratis.Screenplay.Generation.Contracts 0.2.0-0.4.0
• Cratis.Screenplay.Generation 0.2.0-0.4.0
• Cratis.Screenplay.Generation.DotNet 0.2.0-0.4.0
• Cratis.Screenplay.Generation.DotNet.Vogen 0.2.0-0.4.0

Remediation:

• unlist affected immutable versions; do not attempt overwrite;
• keep correct 0.1.0, 0.5.0, 0.6.0 listed;
• move Vogen package-validation baseline to first correct listed Vogen package 0.5.0;
• document exact source-commit verification for future historical publication.

Detected by comparing NuGet nuspec repository commits to Git tags after trusted publishing activation.

[woksin]

Automated unlisting was attempted with a one-time branch workflow using the trusted-publishing OIDC temp key (run 32598141361). NuGet returned 403: the temp key can push but has no delete/unlist permission. Owner action is required in nuget.org UI: unlist versions 0.2.0, 0.3.0, 0.4.0 for Contracts, Generation, DotNet, and DotNet.Vogen. Do not delete correct 0.1.0 or 0.5.0+. PR #14 moves the Vogen compatibility baseline to first correctly sourced listed version 0.5.0.

[woksin]

PR #14 is merged: Vogen package validation and the baseline binary consumer now use first correctly sourced listed version 0.5.0. Manual NuGet UI unlisting of 0.2.0-0.4.0 remains required because trusted-publishing keys cannot unlist.

[cratis-stagehand]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.