Ship the required third-party notices; remove mufplib from the boot R… #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish NuGet | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Versioning is handled by MinVer (Directory.Build.props): a `v*` tag produces a | |
| # stable release version, any other ref produces a preview version derived from | |
| # the last tag + commit height. Packages are always built and uploaded as a | |
| # workflow artifact; they are pushed to nuget.org only for `v*` tags (or when a | |
| # manual run sets push_public=true). | |
| # | |
| # Publishing uses NuGet Trusted Publishing (OIDC) — no long-lived API key. A short-lived | |
| # key is minted at push time via NuGet/login from the GitHub OIDC token. This requires: | |
| # 1) a Trusted Publishing policy on nuget.org (Repository Owner: PyMCU, | |
| # Repository: RP2040Sharp, Workflow File: publish.yml), and | |
| # 2) a repo secret NUGET_USER set to your nuget.org profile name (NOT your email). | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| inputs: | |
| push_public: | |
| description: "Push to nuget.org as well? (otherwise pack + artifact only)" | |
| required: false | |
| default: "false" | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for the GitHub OIDC token (Trusted Publishing) | |
| steps: | |
| # ── Checkout ──────────────────────────────────────────────────────────── | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # MinVer derives the version from the full tag history | |
| # ── .NET setup ────────────────────────────────────────────────────────── | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: "10.0.x" | |
| # ── Restore ───────────────────────────────────────────────────────────── | |
| - name: Restore | |
| run: dotnet restore RP2040Sharp.sln | |
| # ── Build ─────────────────────────────────────────────────────────────── | |
| - name: Build | |
| run: dotnet build RP2040Sharp.sln -c Release --no-restore /p:ContinuousIntegrationBuild=true | |
| # ── Test (unit only; integration tests download firmware) ─────────────── | |
| - name: Test | |
| run: > | |
| dotnet test tests/RP2040Sharp.Tests/RP2040Sharp.Tests.csproj | |
| -c Release | |
| --no-build | |
| --logger "console;verbosity=normal" | |
| # ── Rolling BUSL Change Date: stamp each packed license file with | |
| # (release date + 4 years) so every published version gets a full | |
| # 4-year BUSL window before it converts to the Change License (MIT). ── | |
| - name: Stamp BUSL Change Date (release + 4 years) | |
| run: | | |
| CHANGE_DATE=$(date -u -d "+4 years" +%Y-%m-%d) | |
| stamped=0 | |
| for f in LICENSE-BUSL.txt LICENSE; do | |
| if [ -f "$f" ] && grep -qE '^Change Date:' "$f"; then | |
| sed -i -E "s|^(Change Date: +).*|\1$CHANGE_DATE|" "$f" | |
| echo "$f -> Change Date $CHANGE_DATE" | |
| stamped=1 | |
| fi | |
| done | |
| [ "$stamped" = 1 ] || { echo "::error::no BUSL license file with a Change Date found"; exit 1; } | |
| # ── Pack ──────────────────────────────────────────────────────────────── | |
| - name: Pack RP2040Sharp | |
| run: > | |
| dotnet pack src/RP2040Sharp/RP2040Sharp.csproj | |
| -c Release | |
| --no-build | |
| --output ./nupkgs | |
| - name: Pack RP2040Sharp.TestKit | |
| run: > | |
| dotnet pack src/RP2040.TestKit/RP2040.TestKit.csproj | |
| -c Release | |
| --no-build | |
| --output ./nupkgs | |
| # ── BUSL-1.1 package: CYW43439 Wi-Fi + BLE virtualization ─────────────── | |
| - name: Pack RP2040Sharp.Wireless | |
| run: > | |
| dotnet pack src/RP2040Sharp.Wireless/RP2040Sharp.Wireless.csproj | |
| -c Release | |
| --no-build | |
| --output ./nupkgs | |
| # ── BUSL-1.1 package: bundles the NanoSymbols generator as an analyzer ─── | |
| - name: Pack RP2040Sharp.NanoFramework.TestKit | |
| run: > | |
| dotnet pack src/RP2040Sharp.NanoFramework.TestKit/RP2040Sharp.NanoFramework.TestKit.csproj | |
| -c Release | |
| --no-build | |
| --output ./nupkgs | |
| # ── Licensing guard ───────────────────────────────────────────────────── | |
| # Everything published before 2026-07-17 shipped without its third-party | |
| # notices, and some of it shipped mufplib, which we have no right to | |
| # redistribute. Both were invisible from the repo: the LICENSE was fine, | |
| # the package was not. Check the artifact, not the source, and check it | |
| # before the push rather than after. | |
| - name: Verify the boot ROMs carry no mufplib | |
| run: > | |
| python3 tools/strip_mufplib.py --check | |
| src/RP2040Sharp/bootrom_b1.bin src/RP2040Sharp/bootrom_b2.bin | |
| - name: Verify every package carries its licence and NOTICE | |
| run: python3 tools/verify_packages.py ./nupkgs/*.nupkg | |
| # ── Trusted Publishing: mint a short-lived API key from the OIDC token ──── | |
| - name: NuGet login (OIDC → temporary API key) | |
| if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event.inputs.push_public == 'true' }} | |
| uses: NuGet/login@v1 | |
| id: login | |
| with: | |
| user: ${{ secrets.NUGET_USER }} | |
| # ── Push to nuget.org (tags, or a manual push_public run) ─────────────── | |
| - name: Push to nuget.org | |
| if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event.inputs.push_public == 'true' }} | |
| run: > | |
| dotnet nuget push "./nupkgs/*.nupkg" | |
| --source https://api.nuget.org/v3/index.json | |
| --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" | |
| --skip-duplicate | |
| # ── Always upload the packages as an artifact ─────────────────────────── | |
| - name: Upload NuGet Packages | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: nupkgs | |
| path: ./nupkgs/*.nupkg | |
| retention-days: 14 | |
| if-no-files-found: error |