OSOE-1149: Only allow publishing a major release via publish-nuget if CompatibilitySuppressions files are present in Lombiq.GitHub.Actions

.github/actions/publish-nuget/action.yml

@@ -33,7 +33,15 @@ inputs:
       version is derived from the latest non-prerelease version tag and the current run number to create a preview
       version (e.g. "1.0.1-preview-1" if the current version is 1.0.0). With "USE_NEXT_PATCH_VERSION" the version is
       derived from the latest non-prerelease version tag to create the next patch version (e.g. "1.0.1" if the current
-      version is 1.0.0).
+      version is 1.0.0). If a literal version is provided, an optional leading `v` is ignored.
+  require-major-version-for-compatibility-suppressions:
+    required: false
+    default: 'true'
+    description: >
+      If set to "true", publishing fails when any CompatibilitySuppressions.xml file exists in the repository and the
+      publish version's major version is not greater than the latest stable tag's major version. Versions in the format
+      `vM.N.O-[alpha|beta|preview|rc]` with an optional `".X.<issue-code>`" suffix are exempt. Set to "false" for
+      intentional compatibility suppressions that don't require a SemVer major release.
   nuget-artifact-retention-days:
     required: false
     default: '14'
@@ -84,6 +92,11 @@ runs:
         ${{ inputs.publish-version }}
         '@.Trim()
 
+        if ($version -notin @('USE_GITHUB_REF_NAME', 'USE_GITHUB_RUN_NUMBER', 'USE_NEXT_PATCH_VERSION'))
+        {
+            $version = $version.TrimStart('v')
+        }
+
         if ($version -eq 'USE_GITHUB_REF_NAME')
         {
             $version = $Env:GITHUB_REF_NAME.Trim().TrimStart("v")
@@ -129,6 +142,41 @@ runs:
             $baselineVersion = ''
         }
 
+        $isPreReleaseVersion = $version -match '^\d+\.\d+\.\d+-(alpha|beta|preview|rc)(\.\d+(\.[a-zA-Z]{2,}(-\d+)?)?)?$'
+
+        if ('${{ inputs.require-major-version-for-compatibility-suppressions }}' -eq 'true' -and -not $isPreReleaseVersion)
+        {
+            $compatibilitySuppressionsFiles = @(Get-ChildItem -Path . -Recurse -File -Filter CompatibilitySuppressions.xml -ErrorAction SilentlyContinue)
+
+            if ($compatibilitySuppressionsFiles.Count -gt 0)
+            {
+                Write-Output 'CompatibilitySuppressions.xml file(s) found:'
+                $compatibilitySuppressionsFiles | ForEach-Object { Write-Output "- $($PSItem.FullName)" }
+
+                $versionMatch = [regex]::Match($version, '^(?<major>\d+)\.\d+\.\d+($|-)')
+                if (-not $versionMatch.Success)
+                {
+                    Write-Output ("::error::CompatibilitySuppressions.xml files indicate breaking changes, but " +
+                        "`"$version`" doesn't use an x.y.z version format. Following Semantic Versioning, publish a " +
+                        'new major version.')
+
+                    exit 1
+                }
+
+                $publishMajorVersion = [int]$versionMatch.Groups['major'].Value
+
+                if ($publishMajorVersion -le $current.Major)
+                {
+                    Write-Output ("::error::CompatibilitySuppressions.xml files indicate breaking changes. Following " +
+                        "Semantic Versioning, publish a new major version. The current version is $current, so the " +
+                        "publish version's major version must be greater than $($current.Major), but it is " +
+                        "$publishMajorVersion in `"$version`".")
+
+                    exit 1
+                }
+            }
+        }
+
         Write-Output "Baseline version: $baselineVersion"
         Write-Output "Publish version: $version"
 
@@ -306,4 +354,5 @@ runs:
       with:
         allowUpdates: true
         generateReleaseNotes: true
+        tag: v${{ steps.setup.outputs.publish-version }}
         artifacts: artifacts/*.nupkg, artifacts/*.snupkg

.github/workflows/publish-nuget.yml

@@ -32,6 +32,12 @@ on:
         type: string
         default: https://api.nuget.org/v3/index.json
         description: The NuGet server URL used by the `dotnet nuget push` command's `--source` argument.
+      checkout-ref:
+        type: string
+        default: ''
+        description: >
+          The branch, tag, or SHA to check out before publishing. This is useful for `workflow_dispatch`-triggered
+          one-off publishes where the package should be built from a specific tag.
       verbosity:
         type: string
         default: minimal
@@ -87,7 +93,15 @@ on:
           version is derived from the latest non-prerelease version tag and the current run number to create a preview
           version (e.g. "1.0.1-preview-1" if the current version is 1.0.0). With "USE_NEXT_PATCH_VERSION" the version is
           derived from the latest non-prerelease version tag to create the next patch version (e.g. "1.0.1" if the current
-          version is 1.0.0).
+          version is 1.0.0). If a literal version is provided, an optional leading `v` is ignored.
+      require-major-version-for-compatibility-suppressions:
+        type: string
+        default: 'true'
+        description: >
+          If set to "true", publishing fails when any CompatibilitySuppressions.xml file exists in the repository and the
+          publish version's major version is not greater than the latest stable tag's major version. Versions in the
+          format `vM.N.O-[alpha|beta|preview|rc]` with an optional `".X.<issue-code>`" suffix are exempt. Set to
+          "false" for intentional compatibility suppressions that don't require a SemVer major release.
       nuget-artifact-retention-days:
         type: string
         default: '14'
@@ -133,6 +147,7 @@ jobs:
       - name: Checkout
         uses: Lombiq/GitHub-Actions/.github/actions/checkout@dev
         with:
+          ref: ${{ inputs.checkout-ref }}
           token: ${{ secrets.CHECKOUT_TOKEN }}
 
       - name: Set up .NET
@@ -147,14 +162,15 @@ jobs:
           package-manager-cache: ${{ inputs.node-package-manager-cache }}
 
       - name: Publish to NuGet
-        uses: Lombiq/GitHub-Actions/.github/actions/publish-nuget@dev
+        uses: Lombiq/GitHub-Actions/.github/actions/publish-nuget@issue/OSOE-1149
         with:
           source: ${{ inputs.source }}
           verbosity: ${{ inputs.verbosity }}
           enable-corepack: ${{ inputs.enable-corepack }}
           dotnet-pack-ignore-warning: ${{ inputs.dotnet-pack-ignore-warning }}
           dotnet-pack-include-symbols: ${{ inputs.dotnet-pack-include-symbols }}
           publish-version: ${{ inputs.publish-version }}
+          require-major-version-for-compatibility-suppressions: ${{ inputs.require-major-version-for-compatibility-suppressions }}
           nuget-artifact-retention-days: ${{ inputs.nuget-artifact-retention-days }}
           add-source-link-package: ${{ inputs.add-source-link-package }}
           dry-run: ${{ inputs.dry-run }}

.github/workflows/validate-nuget-publish.yml

@@ -79,11 +79,19 @@ on:
         description: |
           When set to 'true', failed package validation against the baseline will mark the pull request with a title
           suffix, a breaking-changes label, and a guidance comment.
+      require-major-version-for-compatibility-suppressions:
+        type: string
+        default: 'true'
+        description: >
+          If set to "true", publishing validation fails when any CompatibilitySuppressions.xml file exists in the
+          repository and the validation version's major version is not greater than the latest stable tag's major version.
+          Versions in the format `vM.N.O-[alpha|beta|preview|rc]` with an optional `".X.<issue-code>`" suffix are
+          exempt. Set to "false" for intentional compatibility suppressions that don't require a SemVer major release.
 
 jobs:
   validate-nuget-publish:
     name: Validate NuGet Publish
-    uses: Lombiq/GitHub-Actions/.github/workflows/publish-nuget.yml@dev
+    uses: Lombiq/GitHub-Actions/.github/workflows/publish-nuget.yml@issue/OSOE-1149
     with:
       cancel-workflow-on-failure: ${{ inputs.cancel-workflow-on-failure }}
       verbosity: ${{ inputs.verbosity }}
@@ -98,6 +106,7 @@ jobs:
       dotnet-pack-ignore-warning: ${{ inputs.dotnet-pack-ignore-warning }}%3BNU5104
       dotnet-pack-include-symbols: ${{ inputs.dotnet-pack-include-symbols }}
       publish-version: USE_NEXT_PATCH_VERSION
+      require-major-version-for-compatibility-suppressions: ${{ inputs.require-major-version-for-compatibility-suppressions }}
       nuget-artifact-retention-days: ${{ inputs.nuget-artifact-retention-days }}
       add-source-link-package: ${{ inputs.add-source-link-package }}
       dry-run: true