Merge pull request #3 from StuartMeeks/chore/update-deps-and-trusted-… #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: | |
| - 'adobe-v*' | |
| - 'airtable-v*' | |
| - 'softwareone-v*' | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup .NET 10 | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '10.0.x' | |
| - name: Restore | |
| run: dotnet restore | |
| - name: Build | |
| run: dotnet build --configuration Release --no-restore | |
| - name: Test | |
| run: dotnet test --configuration Release --no-build --verbosity normal | |
| - name: Pack | |
| # Pack each provider explicitly. The csprojs no longer auto-pack on | |
| # build, so this step is the single point at which nupkgs / snupkgs | |
| # are produced for downstream consumption (publish job + uploaded | |
| # artifact). --no-build is safe because the build step above ran in | |
| # the same Release configuration. | |
| run: | | |
| dotnet pack src/NextIteration.SpectreConsole.Auth.Providers.Adobe --configuration Release --no-build --output ${{ github.workspace }}/artifacts | |
| dotnet pack src/NextIteration.SpectreConsole.Auth.Providers.Airtable --configuration Release --no-build --output ${{ github.workspace }}/artifacts | |
| dotnet pack src/NextIteration.SpectreConsole.Auth.Providers.SoftwareOne --configuration Release --no-build --output ${{ github.workspace }}/artifacts | |
| - name: Upload package artifacts | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: nuget-packages | |
| # Capture both .nupkg and .snupkg so the publish job's | |
| # `dotnet nuget push *.nupkg` can also push the matching | |
| # symbol package next to it. | |
| path: ${{ github.workspace }}/artifacts/*nupkg | |
| # Publishes a single provider's nupkg to nuget.org. Fired by tag push | |
| # only — per-package tag prefixes (adobe-v*, airtable-v*, softwareone-v*) | |
| # let each package ship independently: | |
| # | |
| # adobe-v0.1.1 -> publishes Adobe only | |
| # airtable-v0.2.0 -> publishes Airtable only | |
| # softwareone-v0.1.5 -> publishes SoftwareOne only | |
| # | |
| # The build job runs first and produces the nupkg artifact; this job | |
| # downloads it, narrows the glob to the package matching the tag | |
| # prefix, and pushes that single nupkg. Re-running a completed tag is | |
| # a no-op thanks to --skip-duplicate. | |
| publish: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| if: startsWith(github.ref, 'refs/tags/adobe-v') || startsWith(github.ref, 'refs/tags/airtable-v') || startsWith(github.ref, 'refs/tags/softwareone-v') | |
| permissions: | |
| # Required for NuGet trusted publishing: lets the job request a | |
| # short-lived OIDC token from GitHub, which NuGet/login exchanges | |
| # with nuget.org for a temporary (1-hour) API key. No long-lived | |
| # NUGET_API_KEY secret is involved anymore. | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Setup .NET 10 | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '10.0.x' | |
| - name: Download artifact | |
| uses: actions/download-artifact@v7 | |
| with: | |
| name: nuget-packages | |
| path: ./artifacts | |
| - name: Resolve package id from tag prefix | |
| id: prefix | |
| run: | | |
| ref="${GITHUB_REF_NAME}" | |
| case "$ref" in | |
| adobe-v*) echo "pkg=NextIteration.SpectreConsole.Auth.Providers.Adobe" >> "$GITHUB_OUTPUT" ;; | |
| airtable-v*) echo "pkg=NextIteration.SpectreConsole.Auth.Providers.Airtable" >> "$GITHUB_OUTPUT" ;; | |
| softwareone-v*) echo "pkg=NextIteration.SpectreConsole.Auth.Providers.SoftwareOne" >> "$GITHUB_OUTPUT" ;; | |
| *) echo "::error::Unrecognised tag prefix: $ref"; exit 1 ;; | |
| esac | |
| # Exchange the GitHub OIDC token for a short-lived nuget.org API key. | |
| # Run this immediately before the push: the key is valid for 1 hour | |
| # and a token can only be redeemed once. NUGET_USER is the nuget.org | |
| # profile name (username), NOT an email address. | |
| - name: NuGet login (OIDC -> temporary API key) | |
| uses: NuGet/login@v1 | |
| id: login | |
| with: | |
| user: ${{ secrets.NUGET_USER }} | |
| - name: Publish to NuGet | |
| run: | | |
| dotnet nuget push "./artifacts/${{ steps.prefix.outputs.pkg }}.*.nupkg" \ | |
| --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \ | |
| --source https://api.nuget.org/v3/index.json \ | |
| --skip-duplicate |