release.yml

name: Release Build, Test, Sign, Publish
on:
  workflow_dispatch:
    inputs:
      perform_sign:
        description: 'Sign'
        type: boolean
        required: true
        default: true
      perform_publish:
        description: 'Release to nuget'
        type: boolean
        required: true
        default: true

env:
  DOTNET_NOLOGO: true
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  OUTPUT_DIRECTORY: ${{ github.workspace}}/nupkgs

permissions:
  contents: read

jobs:
  build:
    permissions:
      attestations: write
      contents: read
      id-token: write

    name: Build pre-release
    runs-on: ubuntu-latest
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
      with:
        egress-policy: audit

    - name: 'Checkout repository'
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      with:
        fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
        persist-credentials: false
 
    - name: 'Setup .NET SDK'
      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
      with:
        dotnet-version: | 
          6.0.x
          7.0.x
          8.0.x
          9.0.x
          10.0.x

    - name: 'Build'
      run: dotnet build --configuration Release --property:PublicRelease=false

    - name: 'Test'
      run: dotnet test --configuration Release --no-restore --no-build --property:PublicRelease=false

    - name: 'Pack release'
      run: dotnet pack --configuration Release --no-restore  --no-build --output ${OUTPUT_DIRECTORY} --property:PublicRelease=false

    - name: 'Extract SBOMs'
      shell: pwsh
      run: > 
        Get-ChildItem -Path ${env:OUTPUT_DIRECTORY} -Filter *.nupkg -Force | ForEach-Object { 
          Expand-Archive $_.FullName "$($_.DirectoryName)/$($_.Basename)" -Force 
          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json" -Destination "${env:OUTPUT_DIRECTORY}/$($_.Basename).spdx.json"
          Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json.sha256" -Destination "${env:OUTPUT_DIRECTORY}/$($_.Basename).spdx.json.sha256"
          Remove-Item "$($_.DirectoryName)/$($_.Basename)" -Force -Recurse }

    - name: Upload unsigned nupkgs to artifacts
      id: upload
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
      with:
        name: build-artifacts
        path: ${{ env.OUTPUT_DIRECTORY }}/*
        retention-days: 7

    - name: Attest build artifacts
      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
      with:
        subject-name: build-artifacts
        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

  sign:
    name: Sign
    needs: build
    runs-on: windows-latest
    if:  ${{ inputs.perform_sign }} 
    environment: prerelease
    permissions:
      attestations: write
      contents: read
      id-token: write

    steps:
    - name: 'Setup .NET SDK'
      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0

    - name: 'Install Sign CLI'
      run: dotnet tool install --tool-path ./sign --prerelease sign

    - name: 'Gather nupkgs from build output'
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: build-artifacts
        path : ${{ env.OUTPUT_DIRECTORY }}

    - name: Authenticate to Azure
      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # 2.3.0
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: Sign
      shell: pwsh
      run: >
        ./sign/sign code azure-key-vault *.nupkg 
        --base-directory ${env:OUTPUT_DIRECTORY} 
        --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}" 
        --azure-key-vault-certificate "${{ secrets.AZURE_KEY_VAULT_CERTIFICATE }}"

    - name: Attest signed artifacts
      uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
      with:
        subject-name: signed-artifacts
        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

  publish:
    name: Publish
    needs: sign
    runs-on: ubuntu-latest
    environment: publish
    if:  ${{ inputs.perform_publish }}
    permissions:
      id-token: write
    steps:
    - name: 'Harden Runner'
      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
      with:
        egress-policy: audit

    - name: 'Setup .NET SDK'
      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0

    - name: 'Gather nupkgs from signing artifacts'
      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
      with:
        name: signed-artifacts
        path : ${{ env.OUTPUT_DIRECTORY }}

    - name: Authenticate to nuget
      uses: NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544 # v1.0.0
      id: nugetlogin
      with:
        user: ${{secrets.NUGET_USERNAME}}

      # Use --skip-duplicate to prevent errors if a package with the same version already exists.
      # This allows a retory of a failed workflow, already published packages will be skipped without error.
    - name: Publish NuGet packages
      shell: pwsh
      run: >
        foreach($file in (Get-ChildItem "${env:NUPKG_DIRECTORY}" -Recurse -Filter *.nupkg)) {
          dotnet nuget push $file --api-key "${{ steps.nugetlogin.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate
        }