Merge pull request #19 from moisesja/fix/anglesharp-1.5.2-issue-18 #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag-driven publish. Push a v-prefixed SemVer tag (e.g. v0.2.0) to build, gate, pack and push the | |
| # three NuGet packages. The package version is taken from the tag. | |
| on: | |
| push: | |
| tags: ['v*'] | |
| jobs: | |
| release: | |
| name: pack + publish | |
| runs-on: ubuntu-latest | |
| # Publishes via NuGet trusted publishing (OIDC) — no stored API key. Requires a Trusted Publishing | |
| # policy on nuget.org for repo moisesja/credentials-dotnet, workflow file release.yml, environment | |
| # nuget-release. The nuget.org account name is hardcoded in the login step (it is public). | |
| environment: nuget-release | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC token NuGet/login exchanges for a short-lived nuget.org API key | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| global-json-file: global.json | |
| - name: Derive version from tag | |
| id: version | |
| run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Restore + tools | |
| run: | | |
| dotnet restore Credentials.sln | |
| dotnet tool restore | |
| # Full gate before anything is published. | |
| - name: Build (warnings-as-errors) | |
| run: dotnet build Credentials.sln -c Release --no-restore -p:CredentialsVersion="${{ steps.version.outputs.version }}" | |
| - name: Test | |
| run: dotnet test Credentials.sln -c Release --no-build --filter "Category!=Conformance" | |
| - name: No-Newtonsoft closure | |
| run: ./tools/check-no-newtonsoft-closure.sh | |
| - name: ApiCompat against published baseline | |
| run: ./tools/check-api-compat.sh | |
| - name: Pack (.nupkg + .snupkg) | |
| run: | | |
| for proj in \ | |
| src/Credentials.Core/Credentials.Core.csproj \ | |
| src/Credentials.Extensions.DependencyInjection/Credentials.Extensions.DependencyInjection.csproj \ | |
| src/Credentials.Rdfc/Credentials.Rdfc.csproj ; do | |
| dotnet pack "$proj" -c Release --no-build \ | |
| -p:CredentialsVersion="${{ steps.version.outputs.version }}" \ | |
| -o ./artifacts/packages | |
| done | |
| - name: Upload package artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: packages | |
| path: ./artifacts/packages/*.*nupkg | |
| # Trusted publishing: exchange this job's GitHub OIDC token for a short-lived (~1h) nuget.org API | |
| # key — no long-lived secret is stored. Requires the id-token:write permission above and a matching | |
| # Trusted Publishing policy on nuget.org. `user` is the nuget.org account username (NOT an email). | |
| - name: NuGet login (OIDC → short-lived API key) | |
| uses: NuGet/login@v1 | |
| id: nuget-login | |
| with: | |
| user: moisesja # nuget.org account/profile name (public package owner), not an email | |
| - name: Push to nuget.org | |
| # Globbing *.nupkg is intentional: `dotnet nuget push` automatically pushes the matching | |
| # symbol package (`<id>.<ver>.snupkg`) sitting alongside each `.nupkg` to nuget.org's symbol | |
| # server, so symbols publish without a separate push (and without risking a double-push). | |
| run: | | |
| dotnet nuget push "./artifacts/packages/*.nupkg" \ | |
| --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \ | |
| --source https://api.nuget.org/v3/index.json \ | |
| --skip-duplicate |