Skip to content

Commit e78c138

Browse files
blowdartblowdart
committed
Create a pre-release build that will push to Github Artifacts
1 parent 0b7288e commit e78c138

File tree

2 files changed

+180
-0
lines changed

2 files changed

+180
-0
lines changed

‎.github/workflows/prerelease-build.yml‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
name: Pre-release Build, Test, Sign, Publish
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
perform_sign:
6+
description: 'Sign'
7+
type: boolean
8+
required: true
9+
default: true
10+
perform_publish:
11+
description: 'GitHub Packages publish'
12+
type: boolean
13+
required: true
14+
default: true
15+
16+
env:
17+
DOTNET_NOLOGO: true
18+
DOTNET_GENERATE_ASPNET_CERTIFICATE: false
19+
DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
20+
DOTNET_CLI_TELEMETRY_OPTOUT: true
21+
NUPKG_DIRECTORY: ${{ github.workspace}}/nupkgs
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
build:
28+
permissions:
29+
contents: read
30+
31+
name: Build release
32+
runs-on: ubuntu-latest
33+
steps:
34+
- name: Harden Runner
35+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
36+
with:
37+
egress-policy: audit
38+
39+
- name: 'Checkout repository'
40+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
41+
with:
42+
fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
43+
persist-credentials: false
44+
45+
- name: 'Setup .NET SDK'
46+
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
47+
with:
48+
dotnet-version: |
49+
8.0.x
50+
9.0.x
51+
52+
- name: 'Build'
53+
run: dotnet build --configuration Release --property:PublicRelease=false
54+
55+
- name: 'Test'
56+
run: dotnet test --configuration Release --no-restore --no-build --property:PublicRelease=false
57+
58+
- name: 'Pack release'
59+
run: dotnet pack --configuration Release --no-restore --no-build --output ${NUPKG_DIRECTORY} --property:PublicRelease=false
60+
61+
- name: 'List artifact directory'
62+
shell: pwsh
63+
run: >
64+
Get-ChildItem -Path ${env:NUPKG_DIRECTORY} -Recurse -Force
65+
66+
- name: 'Extract SBOMs'
67+
shell: pwsh
68+
run: >
69+
Get-ChildItem -Path ${env:NUPKG_DIRECTORY} -Filter *.nupkg -Force | ForEach-Object {
70+
Expand-Archive $_.FullName "$($_.DirectoryName)/$($_.Basename)" -Force
71+
Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json" -Destination "${env:NUPKG_DIRECTORY}/$($_.Basename).spdx.json"
72+
Copy-Item "$($_.DirectoryName)/$($_.Basename)/_manifest/spdx_2.2/manifest.spdx.json.sha256" -Destination "${env:NUPKG_DIRECTORY}/$($_.Basename).spdx.json.sha256"
73+
Remove-Item "$($_.DirectoryName)/$($_.Basename)" -Force -Recurse }
74+
75+
- name: 'List artifact directory'
76+
shell: pwsh
77+
run: >
78+
Get-ChildItem -Path ${env:NUPKG_DIRECTORY} -Recurse -Force
79+
80+
- name: Upload unsigned nupkgs to artifacts
81+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
82+
with:
83+
name: build-artifacts
84+
path: ${{ env.NUPKG_DIRECTORY }}/*
85+
retention-days: 7
86+
87+
sign:
88+
name: Sign
89+
needs: build
90+
runs-on: windows-latest
91+
if: ${{ inputs.perform_sign }}
92+
environment: nightly
93+
permissions:
94+
contents: read
95+
id-token: write
96+
steps:
97+
- name: 'Setup .NET SDK'
98+
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
99+
100+
- name: 'Install Sign CLI'
101+
run: dotnet tool install --tool-path ./sign --prerelease sign
102+
103+
- name: 'Gather nupkgs from build output'
104+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
105+
with:
106+
name: build-artifacts
107+
path : ${{ env.NUPKG_DIRECTORY }}
108+
109+
- name: List assets to be signed
110+
shell: pwsh
111+
run: >
112+
Get-ChildItem -Path ${env:NUPKG_DIRECTORY} -Include *.nupkg -Recurse -Force
113+
114+
- name: Authenticate to Azure
115+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # 2.3.0
116+
with:
117+
allow-no-subscriptions : true
118+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
119+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
120+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
121+
122+
- name: Sign
123+
shell: pwsh
124+
run: >
125+
./sign/sign code trusted-signing *.nupkg --base-directory ${env:NUPKG_DIRECTORY} -tse "${{ secrets.AZURE_TRUSTEDSIGNING_ENDPOINT }}" -tsa "${{ secrets.AZURE_TRUSTEDSIGNING_ACCOUNT }}" -tscp "${{ secrets.AZURE_TRUSTEDSIGNING_CERTIFICATEPROFILE }}"
126+
127+
- name: Upload signed nupkgs to artifacts
128+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
129+
with:
130+
name: signed-artifacts
131+
path: ${{env.NUPKG_DIRECTORY}}/*
132+
retention-days: 7
133+
134+
publish:
135+
name: Publish to nuget
136+
needs: sign
137+
runs-on: ubuntu-latest
138+
if: ${{ inputs.perform_publish }}
139+
environment: nightly
140+
permissions:
141+
contents: read
142+
packages: write
143+
id-token: write
144+
steps:
145+
- name: 'Harden Runner'
146+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
147+
with:
148+
egress-policy: audit
149+
150+
- name: 'Setup .NET SDK'
151+
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
152+
153+
- name: 'Gather nupkgs from signing artifacts'
154+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
155+
with:
156+
name: signed-artifacts
157+
path : ${{ env.NUPKG_DIRECTORY }}
158+
159+
- name: List assets to be published
160+
shell: pwsh
161+
run: >
162+
Get-ChildItem -Path ${env:NUPKG_DIRECTORY} -Filter *.nupkg -Recurse -Force
163+
164+
- name: Setup GitHub Packages as NuGet Source
165+
shell: pwsh
166+
run: >
167+
dotnet new nugetconfig
168+
dotnet nuget remove source nuget
169+
dotnet nuget add source https://nuget.pkg.github.com/blowdart/index.json --name github
170+
171+
# Use --skip-duplicate to prevent errors if a package with the same version already exists.
172+
# This allows a retory of a failed workflow, already published packages will be skipped without error.
173+
- name: Publish NuGet packages
174+
shell: pwsh
175+
run: >
176+
foreach($file in (Get-ChildItem "${env:NUPKG_DIRECTORY}" -Recurse -Filter *.nupkg)) {
177+
dotnet nuget push $file --api-key "${{ secrets.PUBLISH_PACKAGES_PAT }}" --source "github"
178+
}

‎idunno.Bluesky.sln‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
2222
LICENSE = LICENSE
2323
minisign.pub = minisign.pub
2424
nuget.config = nuget.config
25+
nuget.config.github = nuget.config.github
2526
purge.ps1 = purge.ps1
2627
readme.md = readme.md
2728
SECURITY.md = SECURITY.md
@@ -77,6 +78,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{
7778
.github\workflows\dependency-review.yml = .github\workflows\dependency-review.yml
7879
.github\workflows\generate-publish-docs.yml = .github\workflows\generate-publish-docs.yml
7980
.github\workflows\openssf-scorecard.yml = .github\workflows\openssf-scorecard.yml
81+
.github\workflows\prerelease-build.yml = .github\workflows\prerelease-build.yml
8082
.github\workflows\release-build.yml = .github\workflows\release-build.yml
8183
EndProjectSection
8284
EndProject

0 commit comments

Comments
 (0)