|
| 1 | +name: CI Workflow |
| 2 | +run-name: '${{ github.workflow }} [${{ github.event_name }}:${{ github.ref_name }}]' |
| 3 | + |
| 4 | +on: |
| 5 | + push: |
| 6 | + tags: |
| 7 | + - '*' # Create nuget.org releases from tags only (must verify source branch in job) |
| 8 | + pull_request: |
| 9 | + branches: # pull requests into the main branch publish to GitHub packages, all others merely publish build artifacts |
| 10 | + - main |
| 11 | + - release/* |
| 12 | + - Release/* |
| 13 | + workflow_dispatch: |
| 14 | + |
| 15 | +env: |
| 16 | + ENVIRONMENT: >- |
| 17 | + ${{ (github.event_name == 'push' && github.ref_type == 'tag' && github.event.base_ref == 'refs/heads/main') |
| 18 | + && 'nuget.org' |
| 19 | + || ((github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main') |
| 20 | + && 'github' |
| 21 | + || 'dev') }} |
| 22 | +
|
| 23 | +jobs: |
| 24 | + build-pack-test: |
| 25 | + runs-on: ubuntu-latest |
| 26 | + |
| 27 | + steps: |
| 28 | + - uses: actions/checkout@v4 |
| 29 | + with: |
| 30 | + fetch-depth: 0 |
| 31 | + - name: 'Cache: ~/.nuget/packages' |
| 32 | + uses: actions/cache@v4 |
| 33 | + with: |
| 34 | + path: | |
| 35 | + ~/.nuget/packages |
| 36 | + key: nuget-${{ hashFiles('**/global.json', '**/*.csproj', '**/Directory.Packages.props') }} |
| 37 | + restore-keys: | |
| 38 | + nuget- |
| 39 | + - name: Setup .NET SDK |
| 40 | + uses: actions/setup-dotnet@v4 |
| 41 | + - name: dotnet info |
| 42 | + run: dotnet --info |
| 43 | + - name: dotnet restore |
| 44 | + run: dotnet restore |
| 45 | + - name: dotnet build & pack |
| 46 | + run: | |
| 47 | + dotnet build \ |
| 48 | + -c Release \ |
| 49 | + -p:ENVIRONMENT=${{env.ENVIRONMENT}} \ |
| 50 | + --no-restore |
| 51 | + - name: dotnet test |
| 52 | + run: | |
| 53 | + dotnet test -c Release -f net8.0 --no-restore --verbosity normal -p:GeneratePackageOnBuild=false |
| 54 | + dotnet test -c Release -f net9.0 --no-restore --verbosity normal -p:GeneratePackageOnBuild=false |
| 55 | + - name: List output files |
| 56 | + run: ls -la ./out |
| 57 | + - name: Upload Artifact |
| 58 | + id: upload-nupkg |
| 59 | + uses: actions/upload-artifact@v4 |
| 60 | + with: |
| 61 | + name: nuget-packages |
| 62 | + path: ./out/*nupkg |
| 63 | + - name: Job Summary |
| 64 | + run: | |
| 65 | + echo "# Build/Pack/Test: ${{ env.GitVersion_SemVer }} from branch: ${{ env.GitVersion_BranchName }}" >> $GITHUB_STEP_SUMMARY |
| 66 | + echo "" >> $GITHUB_STEP_SUMMARY |
| 67 | + echo "NUPKG Artifact Url: ${{ steps.upload-nupkg.outputs.artifact-url }}" >> $GITHUB_STEP_SUMMARY |
| 68 | + echo "" >> $GITHUB_STEP_SUMMARY |
| 69 | +
|
| 70 | + outputs: |
| 71 | + PKG_VERSION: ${{ env.GitVersion_SemVer }} |
| 72 | + BRANCH_NAME: ${{ env.GitVersion_BranchName }} |
| 73 | + |
| 74 | + sign-packages: |
| 75 | + if: > |
| 76 | + (github.event_name == 'pull_request' && |
| 77 | + github.event.pull_request.base.ref == 'main') || |
| 78 | + (github.event_name == 'push' && |
| 79 | + github.ref_type == 'tag' && |
| 80 | + github.event.base_ref == 'refs/heads/main') |
| 81 | + runs-on: windows-latest |
| 82 | + needs: build-pack-test |
| 83 | + permissions: |
| 84 | + id-token: write |
| 85 | + |
| 86 | + steps: |
| 87 | + - name: Download NUPKG |
| 88 | + uses: actions/download-artifact@v4 |
| 89 | + with: |
| 90 | + name: nuget-packages |
| 91 | + path: ./packages |
| 92 | + - name: List downloaded files |
| 93 | + run: ls -R ./packages |
| 94 | + |
| 95 | + - name: Install AzureSignTool |
| 96 | + run: dotnet tool install -g NuGetKeyVaultSignTool |
| 97 | + |
| 98 | + - name: Azure Login |
| 99 | + uses: azure/login@v2 |
| 100 | + with: |
| 101 | + client-id: ${{ secrets.PBITOOLS_KVI }} |
| 102 | + tenant-id: ${{ secrets.PBITOOLS_KVT }} |
| 103 | + subscription-id: ${{ secrets.PBITOOLS_AKV_SUBSCRIPTION_ID }} |
| 104 | + allow-no-subscriptions: true |
| 105 | + |
| 106 | + - name: Sign packages |
| 107 | + shell: cmd |
| 108 | + working-directory: ./packages |
| 109 | + env: |
| 110 | + AKV_URL: ${{ secrets.PBITOOLS_KVU }} |
| 111 | + AKV_CERT_NAME: ${{ secrets.PBITOOLS_KVC }} |
| 112 | + run: | |
| 113 | + NuGetKeyVaultSignTool sign ^ |
| 114 | + -kvu %AKV_URL% ^ |
| 115 | + -kvc %AKV_CERT_NAME% ^ |
| 116 | + -kvm ^ |
| 117 | + -tr http://timestamp.globalsign.com/tsa/advanced ^ |
| 118 | + -td sha256 ^ |
| 119 | + -fd sha256 ^ |
| 120 | + -o ./signed ^ |
| 121 | + *.nupkg |
| 122 | + NuGetKeyVaultSignTool sign ^ |
| 123 | + -kvu %AKV_URL% ^ |
| 124 | + -kvc %AKV_CERT_NAME% ^ |
| 125 | + -kvm ^ |
| 126 | + -tr http://timestamp.globalsign.com/tsa/advanced ^ |
| 127 | + -td sha256 ^ |
| 128 | + -fd sha256 ^ |
| 129 | + -o ./signed ^ |
| 130 | + *.snupkg |
| 131 | +
|
| 132 | + - name: List signed packages |
| 133 | + run: ls -R ./packages/signed |
| 134 | + - name: Upload Artifact |
| 135 | + id: upload-nupkg |
| 136 | + uses: actions/upload-artifact@v4 |
| 137 | + with: |
| 138 | + name: nuget-packages-signed |
| 139 | + path: ./packages/signed |
| 140 | + outputs: |
| 141 | + PKG_VERSION: ${{ needs.build-pack-test.outputs.PKG_VERSION }} |
| 142 | + |
| 143 | + publish-github-packages: # Push to GitHub Packages if inside pull-request targeting main |
| 144 | + if: github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' |
| 145 | + runs-on: ubuntu-latest |
| 146 | + needs: sign-packages |
| 147 | + permissions: |
| 148 | + packages: write |
| 149 | + # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token |
| 150 | + steps: |
| 151 | + - name: Download NUPKG |
| 152 | + uses: actions/download-artifact@v4 |
| 153 | + with: |
| 154 | + name: nuget-packages-signed |
| 155 | + path: ./artifacts |
| 156 | + - name: List packages |
| 157 | + run: ls -la ./artifacts |
| 158 | + - name: Publish to GitHub Packages |
| 159 | + run: | |
| 160 | + dotnet nuget push \ |
| 161 | + ./artifacts/*nupkg \ |
| 162 | + --api-key ${{ secrets.GITHUB_TOKEN }} \ |
| 163 | + --source https://nuget.pkg.github.com/${{ github.repository_owner }} |
| 164 | + - name: Job Summary |
| 165 | + run: | |
| 166 | + echo "## Published $VERSION to GitHub Packages" >> $GITHUB_STEP_SUMMARY |
| 167 | + env: |
| 168 | + VERSION: ${{ needs.sign-packages.outputs.PKG_VERSION }} |
| 169 | + |
| 170 | + publish-nuget-org: # Sign nupkg & Push to nuget.org if tag was created on main branch |
| 171 | + if: github.event_name == 'push' && github.ref_type == 'tag' && github.event.base_ref == 'refs/heads/main' |
| 172 | + runs-on: ubuntu-latest |
| 173 | + needs: sign-packages |
| 174 | + steps: |
| 175 | + - name: Download NUPKG |
| 176 | + uses: actions/download-artifact@v4 |
| 177 | + with: |
| 178 | + name: nuget-packages-signed |
| 179 | + path: ./artifacts |
| 180 | + - name: List packages |
| 181 | + run: ls -la ./artifacts |
| 182 | + - name: Publish to nuget.org |
| 183 | + env: |
| 184 | + NUGET_API_KEY: ${{ secrets.NUGET_ORG_API_KEY_navidataIO }} |
| 185 | + run: | |
| 186 | + dotnet nuget push \ |
| 187 | + ./artifacts/*nupkg \ |
| 188 | + --api-key ${{env.NUGET_API_KEY}} \ |
| 189 | + --source https://api.nuget.org/v3/index.json |
| 190 | + - name: Job Summary |
| 191 | + run: | |
| 192 | + echo "## Published $VERSION to nuget.org" >> $GITHUB_STEP_SUMMARY |
| 193 | + env: |
| 194 | + VERSION: ${{ needs.sign-packages.outputs.PKG_VERSION }} |
0 commit comments