release.yml

name: release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            frameworks: "net8.0 net10.0"
          - os: windows-latest
            frameworks: "net48 net8.0 net10.0"
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json
          dotnet-version: 8.0.x
      - name: Restore locked dependencies
        run: dotnet restore StreamFrame.slnx --locked-mode -p:AuditPipeline=true
      - name: Build
        run: dotnet build StreamFrame.slnx -c Release --no-restore
      - name: Test
        shell: bash
        env:
          FRAMEWORKS: ${{ matrix.frameworks }}
        run: |
          for fw in $FRAMEWORKS; do
            dotnet test StreamFrame.slnx -c Release --no-build -f "$fw"
          done
      - name: Cross-check security advisories
        if: runner.os == 'Linux'
        env:
          GH_TOKEN: ${{ github.token }}
        run: python3 build/security-audit.py

  package:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json
      - name: Verify tag matches both package versions
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          version="${GITHUB_REF_NAME#v}"
          for proj in src/StreamFrame/StreamFrame.csproj src/StreamFrame.Protocols.Xml/StreamFrame.Protocols.Xml.csproj; do
            csproj_version=$(grep -oPm1 '(?<=<Version>)[^<]+' "$proj")
            if [ "$csproj_version" != "$version" ]; then
              echo "::error::$proj version $csproj_version does not match tag $version"
              exit 1
            fi
          done
      - name: Restore production projects
        run: dotnet restore src/StreamFrame.Protocols.Xml/StreamFrame.Protocols.Xml.csproj --locked-mode -p:AuditPipeline=true
      - name: Build production projects
        run: dotnet build src/StreamFrame.Protocols.Xml/StreamFrame.Protocols.Xml.csproj -c Release --no-restore
      - name: Pack
        run: |
          dotnet pack src/StreamFrame/StreamFrame.csproj -c Release --no-build -o artifacts
          dotnet pack src/StreamFrame.Protocols.Xml/StreamFrame.Protocols.Xml.csproj -c Release --no-build -o artifacts
      - name: Prepare release metadata
        shell: bash
        run: |
          version="${GITHUB_REF_NAME#v}"
          awk -v header="## [$version]" '
            found == 0 && index($0, header) == 1 { found = 1; next }
            found == 1 && index($0, "## [") == 1 { exit }
            found == 1 { print }
          ' CHANGELOG.md > artifacts/release-notes.md
          printf '%s\n' "$GITHUB_SHA" > artifacts/commit.txt
          (cd artifacts && sha256sum *.nupkg *.snupkg release-notes.md commit.txt > SHA256SUMS)
      - name: Upload immutable packages
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-packages-${{ github.sha }}-${{ github.run_attempt }}
          path: artifacts/
          if-no-files-found: error
          retention-days: 14

  release:
    needs: package
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Set up publishing SDK
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: 10.0.402
      - name: Download packages from this run
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-packages-${{ github.sha }}-${{ github.run_attempt }}
          path: artifacts
      - name: Verify package identity and checksums
        shell: bash
        run: |
          test "$(cat artifacts/commit.txt)" = "$GITHUB_SHA"
          (cd artifacts && sha256sum --check SHA256SUMS)
          test -f "artifacts/StreamFrame.${GITHUB_REF_NAME#v}.nupkg"
          test -f "artifacts/StreamFrame.Protocols.Xml.${GITHUB_REF_NAME#v}.nupkg"
      - name: Create Release
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body_path: artifacts/release-notes.md
          generate_release_notes: true
          files: |
            artifacts/*.nupkg
            artifacts/*.snupkg
            artifacts/SHA256SUMS
      - name: Check NuGet user
        env:
          NUGET_USER: ${{ vars.NUGET_USER }}
        run: test -n "$NUGET_USER"
      - name: NuGet Login
        id: login
        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
        with:
          user: ${{ vars.NUGET_USER }}
      - name: Push verified packages
        env:
          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
        run: |
          dotnet nuget push "artifacts/*.nupkg" \
            --api-key "$NUGET_API_KEY" \
            --source https://www.nuget.org/api/v2/package \
            --skip-duplicate