publish.yml

# Publishes the ARCP NuGet package to nuget.org.
#
# Triggers:
#   - push of a tag matching `v*` (version is derived from the tag, minus the `v`)
#   - workflow_dispatch (version supplied as input)
#
# Required repository secret:
#   - NUGET_API_KEY  — an API key from https://www.nuget.org/account/apikeys
#
# Action pinning policy:
#   - First-party `actions/*` actions are pinned to a major version tag (e.g. @v4).
#   - Any third-party action must be pinned to a full commit SHA with a
#     version comment. (None are currently used.)
name: publish

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      version:
        description: "Package version (e.g. 0.1.0). Required for manual runs."
        required: true
        type: string

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write  # needed to create GitHub Releases

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      DOTNET_NOLOGO: "true"
      DOTNET_CLI_TELEMETRY_OPTOUT: "true"
      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "true"
      NUGET_XMLDOC_MODE: skip

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          # Sourcelink embeds the commit; full history isn't required but
          # fetch-depth: 0 makes git describe usable if we want it later.
          fetch-depth: 0

      - name: Setup .NET (from global.json)
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: global.json

      - name: Resolve version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            VERSION="${{ inputs.version }}"
          else
            VERSION="${GITHUB_REF_NAME#v}"
          fi
          if ! printf '%s' "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
            echo "Invalid version: '$VERSION'" >&2
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Publishing version: $VERSION"

      - name: Cache NuGet packages
        uses: actions/cache@v5
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/Directory.Packages.props', '**/global.json', '**/nuget.config') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      # Restore, build, and pack target each .csproj directly (via src/*/*.csproj
      # glob) rather than using ARCP.slnx or a directory glob.  This avoids two
      # Linux case-sensitivity pitfalls that are invisible on macOS:
      #   1. ARCP.slnx references some paths in the wrong case (MSB3202).
      #   2. A directory glob (src/*/) would also visit legacy split directories
      #      that contain no .csproj and produce MSB1003.
      - name: Restore
        run: |
          for csproj in src/*/*.csproj; do
            dotnet restore "$csproj"
          done

      - name: Build
        run: |
          for csproj in src/*/*.csproj; do
            dotnet build "$csproj" \
              --configuration Release \
              --no-restore \
              -p:Version=${{ steps.version.outputs.version }}
          done

      - name: Pack
        # Pack each library project under src/ so that all eight packages
        # (Arcp, Arcp.Core, Arcp.Client, Arcp.Runtime, Arcp.AspNetCore,
        # Arcp.Otel, Arcp.Hosting, Arcp.Cli) land in the artifacts folder.
        # --no-build reuses the binaries already produced by the Build step.
        run: |
          for csproj in src/*/*.csproj; do
            dotnet pack "$csproj" \
              --configuration Release \
              --no-build \
              --output "${{ github.workspace }}/artifacts" \
              -p:Version=${{ steps.version.outputs.version }} \
              -p:ContinuousIntegrationBuild=true
          done

      - name: Upload packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-packages-${{ steps.version.outputs.version }}
          path: ${{ github.workspace }}/artifacts/*.*nupkg
          if-no-files-found: error
          retention-days: 30

      - name: Push to nuget.org
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: >
          dotnet nuget push "${{ github.workspace }}/artifacts/*.nupkg"
          --source https://api.nuget.org/v3/index.json
          --api-key "$NUGET_API_KEY"
          --skip-duplicate

      - name: Create GitHub Release
        # Only create a release when triggered by a tag push (not workflow_dispatch).
        # --generate-notes auto-populates the body from merged PRs / commits since
        # the previous tag.  --skip-duplicate-check is not needed; gh release create
        # fails if the release already exists, which is the correct behaviour.
        if: github.event_name == 'push'
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          gh release create "v${{ steps.version.outputs.version }}"
          --title "v${{ steps.version.outputs.version }}"
          --generate-notes