Update release workflow to include new jobs and permissions

Author: ChrisPulman

.github/workflows/release.yml

@@ -1,21 +1,55 @@
 name: Release
 
 on:
-  push:
-    branches: [ main ]
-    
-env:
-  productNamespacePrefix: "SourceGenerators"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
 
 jobs:
   release:
     uses: reactiveui/actions-common/.github/workflows/workflow-common-release.yml@main
     with:
-      configuration: Release
+      solutionFile: reactiveui.sourcegenerators.slnx
+      installWorkloads: true
     secrets:
-      SIGN_ACCOUNT_NAME: ${{ secrets.SIGN_ACCOUNT_NAME }}
-      SIGN_PROFILE_NAME: ${{ secrets.SIGN_PROFILE_NAME }}
-      AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-      NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+      ES_USERNAME: ${{ secrets.ES_USERNAME }}
+      ES_PASSWORD: ${{ secrets.ES_PASSWORD }}
+      CREDENTIAL_ID: ${{ secrets.CREDENTIAL_ID }}
+      ES_TOTP_SECRET: ${{ secrets.ES_TOTP_SECRET }}
+
+  publish-nuget:
+    needs: release
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      id-token: write
+    steps:
+      - name: Download signed packages
+        uses: actions/download-artifact@v8
+        with:
+          name: signed-nuget
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v5
+
+      - name: NuGet login (OIDC trusted publishing)
+        id: nuget-login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Push to NuGet
+        shell: bash
+        run: |
+          for pkg in *.nupkg; do
+            dotnet nuget push "$pkg" --source https://api.nuget.org/v3/index.json --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}"
+          done
+
+  create-release:
+    needs: [release, publish-nuget]
+    uses: reactiveui/actions-common/.github/workflows/workflow-common-create-release.yml@main
+    with:
+      version: ${{ needs.release.outputs.semver2 }}