release-nuget.yml

name: Build & Publish NuGet (Tag Release)

permissions:
  contents: write

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g. v0.2.0.12)"
        required: true
        type: string
      ref:
        description: "Git reference (commit SHA, branch, or tag) to create the release from"
        required: true
        type: string
        default: "main"

jobs:
  # Blocking gate: all tests must pass before any packing/publishing can run.
  test-gate:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ inputs.ref || github.ref }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
          cache: true
          cache-dependency-path: |
            FluentAAS/**/*.csproj
            FluentAAS/global.json

      - name: Locate solution file
        id: solution
        shell: bash
        run: |
          SOLUTION=$(find . -maxdepth 5 -name "*.sln" | head -n 1)
          if [ -z "$SOLUTION" ]; then
            echo "❌ No solution file (*.sln) found in the repo."
            exit 1
          fi
          echo "SOLUTION_PATH=$SOLUTION" >> $GITHUB_OUTPUT
          echo "✅ Found solution: $SOLUTION"

      - name: Restore dependencies
        run: dotnet restore "${{ steps.solution.outputs.SOLUTION_PATH }}"

      - name: Build solution
        run: dotnet build "${{ steps.solution.outputs.SOLUTION_PATH }}" -c Release --no-restore

      - name: Test solution (blocking gate)
        run: dotnet test "${{ steps.solution.outputs.SOLUTION_PATH }}" -c Release --no-build --verbosity normal

  build-pack-push:
    runs-on: ubuntu-latest
    needs: test-gate

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ inputs.ref || github.ref }}

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'
          cache: true
          cache-dependency-path: |
            FluentAAS/**/*.csproj
            FluentAAS/global.json

      - name: Determine version (from tag or input)
        id: version
        shell: bash
        env:
          INPUT_VERSION: ${{ inputs.version }}
          GITHUB_REF_NAME: ${{ github.ref_name }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            TAG="$INPUT_VERSION"
          else
            TAG="$GITHUB_REF_NAME"
          fi

          echo "Tag: $TAG"

          # Guardrail: must start with v and look like vX.Y.Z(.W)
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
            echo "❌ Invalid tag format: $TAG"
            echo "Expected format: v<major>.<minor>.<patch>[.<revision>] (e.g., v0.2.0.12 or v1.2.3)"
            exit 1
          fi

          VERSION="${TAG#v}"
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "TAG=$TAG" >> $GITHUB_OUTPUT
          echo "✅ Valid version format: $VERSION"

      - name: Locate solution file
        id: solution
        shell: bash
        run: |
          SOLUTION=$(find . -maxdepth 5 -name "*.sln" | head -n 1)
          if [ -z "$SOLUTION" ]; then
            echo "❌ No solution file (*.sln) found in the repo."
            exit 1
          fi
          echo "SOLUTION_PATH=$SOLUTION" >> $GITHUB_OUTPUT
          echo "✅ Found solution: $SOLUTION"

      - name: Restore dependencies
        run: dotnet restore "${{ steps.solution.outputs.SOLUTION_PATH }}"

      - name: Build solution
        run: dotnet build "${{ steps.solution.outputs.SOLUTION_PATH }}" -c Release --no-restore

      - name: Pack NuGet packages
        run: dotnet pack "${{ steps.solution.outputs.SOLUTION_PATH }}" -c Release -o ./artifacts --no-build /p:PackageVersion=${{ steps.version.outputs.VERSION }}

      - name: Verify package versions
        shell: bash
        run: |
          shopt -s nullglob
          packages=(./artifacts/*.nupkg)

          if [ ${#packages[@]} -eq 0 ]; then
            echo "❌ No NuGet packages found in ./artifacts/"
            exit 1
          fi

          echo "📦 Generated NuGet packages:"
          VERSION="${{ steps.version.outputs.VERSION }}"
          ESCAPED_VERSION="${VERSION//./\\.}"

          for pkg in "${packages[@]}"; do
            filename=$(basename "$pkg")
            echo "  - $filename"
            # Verify the package name contains the expected version using escaped dots
            if [[ "$filename" =~ \.$ESCAPED_VERSION\.nupkg$ ]]; then
              echo "✅ Version matches tag: $VERSION"
            else
              echo "❌ Version mismatch in package name"
              exit 1
            fi
          done

      - name: Publish to NuGet
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: dotnet nuget push "artifacts/*.nupkg" --api-key "$NUGET_API_KEY" --source "https://api.nuget.org/v3/index.json" --skip-duplicate

      - name: Build Changelog
        id: build_changelog
        uses: mikepenz/release-changelog-builder-action@v6
        with:
          fetchReleaseInformation: true
          failOnError: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload NuGet Artifacts
        uses: actions/upload-artifact@v7
        with:
          name: nuget-packages-${{ steps.version.outputs.VERSION }}
          path: ./artifacts/*.nupkg

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.version.outputs.TAG }}
          name: FluentAAS ${{ steps.version.outputs.VERSION }}
          body: ${{ steps.build_changelog.outputs.changelog || 'Release notes will be added here.' }}
          files: ./artifacts/*.nupkg
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}