credentials-dotnet/.github/workflows/release.yml at main · moisesja/credentials-dotnet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Release

# Tag-driven publish. Push a v-prefixed SemVer tag (e.g. v0.2.0) to build, gate, pack and push the
# three NuGet packages. The package version is taken from the tag.
on:
  push:
    tags: ['v*']

jobs:
  release:
    name: pack + publish
    runs-on: ubuntu-latest
    # Publishes via NuGet trusted publishing (OIDC) — no stored API key. Requires a Trusted Publishing
    # policy on nuget.org for repo moisesja/credentials-dotnet, workflow file release.yml, environment
    # nuget-release. The nuget.org account name is hardcoded in the login step (it is public).
    environment: nuget-release
    permissions:
      contents: read
      id-token: write # OIDC token NuGet/login exchanges for a short-lived nuget.org API key
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Derive version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Restore + tools
        run: |
          dotnet restore Credentials.sln
          dotnet tool restore

      # Full gate before anything is published.
      - name: Build (warnings-as-errors)
        run: dotnet build Credentials.sln -c Release --no-restore -p:CredentialsVersion="${{ steps.version.outputs.version }}"
      - name: Test
        run: dotnet test Credentials.sln -c Release --no-build --filter "Category!=Conformance"
      - name: No-Newtonsoft closure
        run: ./tools/check-no-newtonsoft-closure.sh
      - name: ApiCompat against published baseline
        run: ./tools/check-api-compat.sh

      - name: Pack (.nupkg + .snupkg)
        run: |
          for proj in \
            src/Credentials.Core/Credentials.Core.csproj \
            src/Credentials.Extensions.DependencyInjection/Credentials.Extensions.DependencyInjection.csproj \
            src/Credentials.Rdfc/Credentials.Rdfc.csproj ; do
            dotnet pack "$proj" -c Release --no-build \
              -p:CredentialsVersion="${{ steps.version.outputs.version }}" \
              -o ./artifacts/packages
          done

      - name: Upload package artifacts
        uses: actions/upload-artifact@v4
        with:
          name: packages
          path: ./artifacts/packages/*.*nupkg

      # Trusted publishing: exchange this job's GitHub OIDC token for a short-lived (~1h) nuget.org API
      # key — no long-lived secret is stored. Requires the id-token:write permission above and a matching
      # Trusted Publishing policy on nuget.org. `user` is the nuget.org account username (NOT an email).
      - name: NuGet login (OIDC → short-lived API key)
        uses: NuGet/login@v1
        id: nuget-login
        with:
          user: moisesja # nuget.org account/profile name (public package owner), not an email

      - name: Push to nuget.org
        # Globbing *.nupkg is intentional: `dotnet nuget push` automatically pushes the matching
        # symbol package (`<id>.<ver>.snupkg`) sitting alongside each `.nupkg` to nuget.org's symbol
        # server, so symbols publish without a separate push (and without risking a double-push).
        run: |
          dotnet nuget push "./artifacts/packages/*.nupkg" \
            --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate