build.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Build, Test, and Publish DevTunnels.Client

on:
  workflow_dispatch:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  release:
    types: [ published ]

env:
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
  DOTNET_NOLOGO: true
  NuGetDirectory: ${{ github.workspace }}/nuget

defaults:
  run:
    shell: pwsh

jobs:
  build_and_test:
    name: Build, Test, and Pack
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Signing the provenance statement for the packages this job produces. Stated
      # explicitly because attestation needs more than the read-only default.
      id-token: write
      attestations: write

    steps:
    - name: Checkout code
      uses: actions/checkout@v7
      with:
        fetch-depth: 0

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: |
          10.0.x
          11.0.100-preview.7.26381.103

    - name: Restore dependencies
      run: dotnet restore DevTunnels.Client.slnx

    - name: Build solution
      run: dotnet build DevTunnels.Client.slnx --configuration Release --no-restore

    - name: Run unit tests
      run: dotnet test tests/DevTunnels.Client.Tests/DevTunnels.Client.Tests.csproj --configuration Release --no-build --verbosity normal -- --coverage --coverage-settings coverage.settings.xml --coverage-output-format cobertura --coverage-output coverage.cobertura.xml

    - name: Summarize coverage
      # Renders the cobertura totals into the run summary. Uploading the raw XML alone means nobody
      # ever looks at it; this puts the numbers on the run page itself.
      if: always()
      shell: bash
      run: |
        python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
        import glob, xml.etree.ElementTree as ET

        files = sorted(glob.glob('**/coverage.cobertura.xml', recursive=True))
        if not files:
            print('### Coverage\n\nNo coverage report was produced.')
            raise SystemExit(0)

        # Multi-targeted runs emit one report per TFM; they cover the same code, so report the first
        # and note how many were produced rather than double-counting.
        root = ET.parse(files[0]).getroot()

        def pct(attr):
            return float(root.get(attr) or 0) * 100

        print('### Coverage\n')
        print('| Metric | Covered | Total | Rate |')
        print('| --- | ---: | ---: | ---: |')
        print(f"| Lines | {root.get('lines-covered')} | {root.get('lines-valid')} | {pct('line-rate'):.1f}% |")
        print(f"| Branches | {root.get('branches-covered')} | {root.get('branches-valid')} | {pct('branch-rate'):.1f}% |")

        packages = root.findall('.//package')
        if packages:
            print('\n<details><summary>Per assembly</summary>\n')
            print('| Assembly | Lines | Branches |')
            print('| --- | ---: | ---: |')
            for p in sorted(packages, key=lambda p: p.get('name') or ''):
                lr = float(p.get('line-rate') or 0) * 100
                br = float(p.get('branch-rate') or 0) * 100
                print(f"| {p.get('name')} | {lr:.1f}% | {br:.1f}% |")
            print('\n</details>')

        if len(files) > 1:
            print(f"\n_{len(files)} reports produced (one per target framework); totals shown for `{files[0]}`._")
        PY

    - name: Upload coverage report
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: coverage
        if-no-files-found: warn
        path: '**/coverage.cobertura.xml'

    - name: Pack packages
      if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'release'
      run: |
        dotnet pack src/DevTunnels.Client/DevTunnels.Client.csproj --configuration Release --no-build --output ${{ env.NuGetDirectory }}
        dotnet pack src/DevTunnels.Client.DependencyInjection/DevTunnels.Client.DependencyInjection.csproj --configuration Release --no-build --output ${{ env.NuGetDirectory }}
        dotnet pack src/DevTunnels.Client.Installer/DevTunnels.Client.Installer.csproj --configuration Release --no-build --output ${{ env.NuGetDirectory }}

    - name: Attest build provenance
      # Records, in a signed statement GitHub hosts, which workflow and which commit produced these
      # exact package files. Anyone who downloads the package can verify it came from this repository
      # rather than from someone who republished it under the same name.
      if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'release'
      uses: actions/attest-build-provenance@v3
      with:
        subject-path: ${{ env.NuGetDirectory }}/*.nupkg
    - name: Upload package artifacts
      if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'release'
      uses: actions/upload-artifact@v7
      with:
        name: nuget-package
        if-no-files-found: error
        retention-days: 1
        path: ${{ env.NuGetDirectory }}/*.nupkg

  publish_nuget:
    name: Publish NuGet Package
    needs: [ build_and_test ]
    if: github.event_name == 'release' && github.event.action == 'published'
    runs-on: ubuntu-latest
    # Declaring an environment is what makes GitHub record a deployment, which is what
    # surfaces the Deployments tab and the package link on the repo home page.
    environment:
      name: nuget.org
      url: https://www.nuget.org/packages/DevTunnels.Client
    permissions:
      contents: read
      id-token: write

    steps:
    - name: Download NuGet package artifact
      uses: actions/download-artifact@v8
      with:
        name: nuget-package
        path: ${{ env.NuGetDirectory }}

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v6

    - name: NuGet login
      uses: NuGet/login@v1
      id: login
      with:
        user: Agash

    - name: Publish packages
      run: |
        foreach($file in (Get-ChildItem "${{ env.NuGetDirectory }}" -Recurse -Include *.nupkg)) {
            Write-Host "Pushing package: $($file.FullName)"
            dotnet nuget push $file --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
        }