1+ name : RedLightForWindows CI
2+
3+ on :
4+ push :
5+ tags : [ "v*" ]
6+
7+ permissions :
8+ contents : read
9+
10+ jobs :
11+ # --------------------------------------------------------
12+ # Release build for pushes & tags on main
13+ # --------------------------------------------------------
14+ build-release :
15+ if : github.event_name == 'push'
16+ runs-on : windows-latest
17+ permissions :
18+ contents : write # allow release-action to create GitHub Release
19+
20+ env :
21+ Solution_Name : RedLightForWindows.sln
22+ Configuration : Release
23+
24+ steps :
25+ - name : Checkout source
26+ uses : actions/checkout@v4
27+ with :
28+ fetch-depth : 0
29+
30+ - name : Setup .NET SDK
31+ uses : actions/setup-dotnet@v4
32+ with :
33+ dotnet-version : 10.0.x
34+ cache : true
35+ cache-dependency-path : ' **/*.csproj'
36+
37+ - name : Restore dependencies
38+ run : dotnet restore RedLightForWindows.csproj
39+
40+ - name : Build (Release)
41+ run : dotnet build RedLightForWindows.csproj --configuration ${{ env.Configuration }} --no-restore -p:Version=${{ github.run_number }}
42+
43+ - name : Publish self-contained
44+ run : dotnet publish RedLightForWindows.csproj --configuration ${{ env.Configuration }} --runtime win-x64 --self-contained false --output ./publish -p:Version=${{ github.run_number }}
45+
46+ - name : Compress artifact
47+ shell : pwsh
48+ run : Compress-Archive -Path ./publish/* -DestinationPath RedLightForWindows.zip
49+
50+ - name : Upload artifact
51+ uses : actions/upload-artifact@v4
52+ with :
53+ name : RedLightForWindows
54+ path : RedLightForWindows.zip
55+
56+ - name : Create GitHub Release (tag push)
57+ if : startsWith(github.ref, 'refs/tags/')
58+ uses : ncipollo/release-action@v1
59+ with :
60+ artifacts : |
61+ RedLightForWindows.zip
62+ publish/RedLightForWindows.exe
63+ body : " Automated release from GitHub Actions"
64+ token : ${{ secrets.GITHUB_TOKEN }}
65+
66+ # --------------------------------------------------------
67+ # Static code analysis with CodeQL
68+ # --------------------------------------------------------
69+ codeql :
70+ name : CodeQL
71+ runs-on : windows-latest
72+ permissions :
73+ security-events : write
74+
75+ steps :
76+ - uses : actions/checkout@v4
77+
78+ - name : Initialize CodeQL
79+ uses : github/codeql-action/init@v3
80+ with :
81+ languages : csharp
82+
83+ - name : Autobuild
84+ uses : github/codeql-action/autobuild@v3
85+
86+ - name : Perform CodeQL analysis
87+ uses : github/codeql-action/analyze@v3
88+
89+ # --------------------------------------------------------
90+ # Secret scanning with Gitleaks
91+ # --------------------------------------------------------
92+ secret-scan :
93+ runs-on : ubuntu-latest
94+ steps :
95+ - name : Checkout source
96+ uses : actions/checkout@v4
97+ with :
98+ fetch-depth : 0
99+
100+ - name : Run Gitleaks
101+ uses : gitleaks/gitleaks-action@v2
102+ with :
103+ fail : true
0 commit comments