TerminalStateGuard/.github/workflows/release.yml at main · sbay-dev/TerminalStateGuard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: Release to NuGet

permissions:
  contents: read

on:
  push:
    tags: ['v*']
  workflow_dispatch:

env:
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET 10
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'

    - name: Restore
      run: dotnet restore src/TSG/TSG.csproj --locked-mode

    - name: Vulnerability scan
      run: |
        echo "## 🔍 Vulnerability Scan" >> $GITHUB_STEP_SUMMARY
        dotnet list src/TSG/TSG.csproj package --vulnerable --include-transitive 2>&1 | tee vuln.txt
        if grep -q "has no vulnerable" vuln.txt; then
          echo "✅ No vulnerable packages found" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Vulnerable packages detected!" >> $GITHUB_STEP_SUMMARY
          exit 1
        fi

    - name: Deprecated scan
      run: |
        echo "## 📦 Deprecated Scan" >> $GITHUB_STEP_SUMMARY
        dotnet list src/TSG/TSG.csproj package --deprecated --include-transitive 2>&1 | tee dep.txt
        if grep -q "has no deprecated" dep.txt; then
          echo "✅ No deprecated packages" >> $GITHUB_STEP_SUMMARY
        else
          echo "⚠️ Deprecated packages found" >> $GITHUB_STEP_SUMMARY
        fi

    - name: Build with full analysis
      run: |
        echo "## 🛡️ Static Analysis" >> $GITHUB_STEP_SUMMARY
        dotnet build src/TSG/TSG.csproj -c Release --no-restore -warnaserror 2>&1 | tee build.txt
        if grep -q "Build succeeded" build.txt; then
          echo "✅ Zero warnings with AnalysisLevel=latest-all" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ Build warnings/errors detected" >> $GITHUB_STEP_SUMMARY
          exit 1
        fi

  build-and-publish:
    name: Build & Publish
    needs: security-audit
    runs-on: windows-latest
    permissions:
      contents: write

    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET 10
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'

    - name: Extract version
      id: ver
      shell: pwsh
      run: |
        $v = "${{ github.ref_name }}" -replace '^v', ''
        if (-not $v) { $v = "1.0.0" }
        "VERSION=$v" >> $env:GITHUB_OUTPUT

    - name: Restore locked dependencies
      run: dotnet restore src/TSG/TSG.csproj --locked-mode

    - name: Build
      run: dotnet build src/TSG/TSG.csproj -c Release --no-restore -p:Version=${{ steps.ver.outputs.VERSION }}

    - name: Pack
      run: dotnet pack src/TSG/TSG.csproj -c Release --no-build --no-restore -o artifacts -p:Version=${{ steps.ver.outputs.VERSION }}

    - name: Push to NuGet
      shell: pwsh
      run: |
        $pkg = Get-ChildItem artifacts/*.nupkg | Select-Object -First 1
        dotnet nuget push $pkg.FullName --api-key ${{ secrets.NUGET_TSG_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate

    - name: GitHub Release
      uses: softprops/action-gh-release@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: artifacts/*.nupkg
        generate_release_notes: true
        body: |
          ## 🛡️ Security Audit: ✅ Passed
          - Vulnerability scan: 0 issues
          - Static analysis: 0 warnings (AnalysisLevel=latest-all)
          - Direct package references: Microsoft.Data.Sqlite + patched SQLite native pin

          ## 📦 Install
          ```bash
          dotnet tool install -g TerminalStateGuard
          tsg install
          ```