Automate releases from main and verify configurable limits #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: filecontext-release | |
| cancel-in-progress: false | |
| env: | |
| DOTNET_VERSION: '10.0.x' | |
| jobs: | |
| build: | |
| name: Validate and pack | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Read package version | |
| id: version | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| VERSION="$(dotnet msbuild src/ManagedCode.FileContext/ManagedCode.FileContext.csproj -nologo -getProperty:PackageVersion | tr -d '\r')" | |
| if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then | |
| echo "::error::Invalid release version: $VERSION" | |
| exit 1 | |
| fi | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Restore | |
| run: dotnet restore ManagedCode.FileContext.slnx | |
| - name: Verify formatting | |
| run: dotnet format ManagedCode.FileContext.slnx --verify-no-changes --no-restore | |
| - name: Build | |
| run: dotnet build ManagedCode.FileContext.slnx --configuration Release --no-restore | |
| - name: Test with coverage | |
| run: dotnet test tests/ManagedCode.FileContext.Tests/ManagedCode.FileContext.Tests.csproj --configuration Release --no-build /p:CollectCoverage=true | |
| - name: Pack | |
| run: dotnet pack src/ManagedCode.FileContext/ManagedCode.FileContext.csproj --configuration Release --no-build --output artifacts -p:IncludeSymbols=false | |
| - name: Upload validated package | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-package | |
| path: artifacts/ManagedCode.FileContext.${{ steps.version.outputs.version }}.nupkg | |
| if-no-files-found: error | |
| retention-days: 7 | |
| publish: | |
| name: Publish NuGet and GitHub release | |
| needs: build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: write | |
| env: | |
| VERSION: ${{ needs.build.outputs.version }} | |
| RELEASE_TAG: v${{ needs.build.outputs.version }} | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - name: Checkout validated commit | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| - name: Check existing release | |
| id: release | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/releases" > "$RUNNER_TEMP/releases.json" | |
| if jq -e --arg tag "$RELEASE_TAG" 'any(.[][]; .tag_name == $tag and .draft == false)' "$RUNNER_TEMP/releases.json" > /dev/null; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| echo "$RELEASE_TAG is already released; skipping publication." >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Validate existing tag | |
| if: steps.release.outputs.exists == 'false' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" > /dev/null; then | |
| TAG_COMMIT="$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" | |
| if [ "$TAG_COMMIT" != "$GITHUB_SHA" ]; then | |
| echo "::error::$RELEASE_TAG points to $TAG_COMMIT, not the validated commit $GITHUB_SHA." | |
| exit 1 | |
| fi | |
| fi | |
| - name: Download validated package | |
| if: steps.release.outputs.exists == 'false' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-package | |
| path: artifacts | |
| - name: Setup .NET | |
| if: steps.release.outputs.exists == 'false' | |
| uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - name: Publish to NuGet | |
| if: steps.release.outputs.exists == 'false' | |
| shell: bash | |
| env: | |
| NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "$NUGET_API_KEY" ]; then | |
| echo "::error::NUGET_API_KEY is not configured." | |
| exit 1 | |
| fi | |
| dotnet nuget push "artifacts/ManagedCode.FileContext.$VERSION.nupkg" \ | |
| --api-key "$NUGET_API_KEY" \ | |
| --source https://api.nuget.org/v3/index.json \ | |
| --skip-duplicate | |
| - name: Create version tag | |
| if: steps.release.outputs.exists == 'false' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if ! git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" > /dev/null; then | |
| git config user.name 'github-actions[bot]' | |
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | |
| git tag -a "$RELEASE_TAG" "$GITHUB_SHA" -m "Release $VERSION" | |
| git push origin "refs/tags/$RELEASE_TAG" | |
| fi | |
| - name: Create GitHub release | |
| if: steps.release.outputs.exists == 'false' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| FLAGS=() | |
| if [[ "$VERSION" == *-* ]]; then | |
| FLAGS+=(--prerelease) | |
| fi | |
| gh release create "$RELEASE_TAG" "artifacts/ManagedCode.FileContext.$VERSION.nupkg" \ | |
| --title "$RELEASE_TAG" \ | |
| --generate-notes \ | |
| --verify-tag \ | |
| "${FLAGS[@]}" |