release.yml

name: release

on:
  release:
    types:
      - published

permissions:
  contents: write
  packages: write
  id-token: write  # enable GitHub OIDC token issuance for this job

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
      DOTNET_CLI_TELEMETRY_OPTOUT: 1

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Determine package version
        id: version
        run: |
          set -euo pipefail
          tag_name="${GITHUB_REF#refs/tags/}"
          if [ -z "$tag_name" ]; then
            tag_name="${{ github.event.release.tag_name }}"
          fi
          package_version=${tag_name##v}
          echo "Using package version: $package_version"
          echo "PACKAGE_VERSION=$package_version" >> "$GITHUB_ENV"
          echo "package_version=$package_version" >> "$GITHUB_OUTPUT"

      - name: Build package
        uses: ./.github/actions/build-pack
        with:
          package-version: ${{ env.PACKAGE_VERSION }}

       # Get a short-lived NuGet API key
      - name: NuGet login (OIDC → temp API key)
        uses: NuGet/login@v1
        id: login
        with:
          user: evolvedlight

      - name: Publish package to NuGet.org
        run: |
          dotnet nuget push artifacts/*.nupkg \
            --api-key ${{steps.login.outputs.NUGET_API_KEY}} \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate

      - name: Upload release assets
        uses: softprops/action-gh-release@v3
        with:
          files: artifacts/*.nupkg
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}