release.yml

name: 🎁 Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      ship_run_id:
        description: ID of the GitHub workflow run to ship
        required: true
      skip_npm:
        description: Skip publishing NPM packages
        type: boolean
        default: false
      skip_nuget:
        description: Skip publishing NuGet packages
        type: boolean
        default: false
      skip_cargo:
        description: Skip publishing Cargo packages
        type: boolean
        default: false

run-name: ${{ github.ref_name }}

jobs:
  release:
    runs-on: windows-2025
    environment: Publishing
    env:
      AZURE_CORE_OUTPUT: none
    permissions:
      actions: read # Required to download artifacts
      contents: write # Upload artifacts to Release
      id-token: write # Required for Azure and NuGet OIDC authentication
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      with:
        fetch-depth: 1

    - name: 🔎 Search for build of ${{ github.ref }}
      shell: pwsh
      id: findrunid
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        $ErrorActionPreference = 'Stop'
        $PSNativeCommandUseErrorActionPreference = $true

        if ('${{ inputs.ship_run_id }}') {
          $runid = '${{ inputs.ship_run_id }}'
        } else {
          $restApiRoot = '/repos/${{ github.repository }}'

          # Resolve the tag reference to a commit sha
          $resolvedRef = gh api `
            -H "Accept: application/vnd.github+json" `
            -H "X-GitHub-Api-Version: 2022-11-28" `
            $restApiRoot/git/ref/tags/${{ github.ref_name }} `
            | ConvertFrom-Json
          $commitSha = $resolvedRef.object.sha

          Write-Host "Resolved ${{ github.ref_name }} to $commitSha"

          $releases = @(gh run list -R ${{ github.repository }} -c $commitSha -w .github/workflows/build.yml -s success --json databaseId,startedAt,event,headBranch `
            | ConvertFrom-Json | Sort-Object startedAt -Descending)

          $preferredReleases = $releases | Where-Object {
            $_.event -eq 'push' -and ($_.headBranch -eq 'main' -or $_.headBranch -match '^v\d+(?:\.\d+)?$')
          }

          if ($releases.length -eq 0) {
            Write-Error "No successful builds found for ${{ github.ref }}."
          } else {
            if ($preferredReleases.length -gt 0) {
              $selectedReleases = $preferredReleases
              $multipleRunsWarning = "More than one successful run found for ${{ github.ref }}. Preferring the most recent push build from a public-release branch."
            } else {
              $selectedReleases = $releases
              $multipleRunsWarning = "More than one successful run found for ${{ github.ref }} and none were from a public-release branch. Artifacts from the most recent successful run will ship."
            }

            if ($releases.length -gt 1) {
              Write-Warning $multipleRunsWarning
            }

            $runid = $selectedReleases[0].databaseId
          }
        }

        Write-Host "Using artifacts from run-id: $runid"

        Echo "runid=$runid" >> $env:GITHUB_OUTPUT

    - name: 🔻 Download deployables artifacts
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: deployables-Linux
        path: ${{ runner.temp }}/deployables
        run-id: ${{ steps.findrunid.outputs.runid }}
        github-token: ${{ github.token }}

    - name: ⚙ Install .NET SDK
      shell: pwsh
      run: |
        ./tools/Install-DotNetSdk.ps1 -SdkOnly
        if ($LASTEXITCODE -ne 0) {
          throw "SDK installation failed."
        }

        dotnet tool restore
        if ($LASTEXITCODE -ne 0) {
          throw "dotnet tool restore failed."
        }

    - name: 🔐 Authenticate to Azure
      uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

    - name: ✍️ Sign NuGet packages
      shell: pwsh
      run: >
        dotnet tool run sign -- code azure-key-vault
        '*.nupkg'
        --base-directory '${{ runner.temp }}/deployables/NuGet'
        --file-list '${{ github.workspace }}/.github/signfiles.txt'
        --recurse-containers
        --azure-key-vault-url '${{ vars.AZURE_KEY_VAULT_URL }}'
        --azure-key-vault-certificate '${{ vars.AZURE_KEY_VAULT_CERTIFICATE }}'
        --azure-credential-type azure-cli

    - name: 🪪 Authorize NuGet package push
      uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
      id: nuget-login
      with:
        user: ${{ secrets.NUGET_USER }}

    - name: 🟢 Setup Node.js
      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
      with:
        node-version: 24
        registry-url: https://registry.npmjs.org
        package-manager-cache: false  # never use caching in release builds

    - name: 🦀 Install Rust 1.85.0
      if: ${{ !inputs.skip_cargo }}
      uses: dtolnay/rust-toolchain@1.85.0

    # The crate must first be manually published and configured for Trusted
    # Publishing at crates.io before this OIDC exchange can succeed.
    - name: 🪪 Authorize crates.io publishing
      if: ${{ !inputs.skip_cargo }}
      id: crates-io-auth
      uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5

    - name: 🚀 Push Cargo package
      if: ${{ !inputs.skip_cargo }}
      shell: pwsh
      env:
        CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
      run: |
        $crate = (Get-ChildItem ./deployables -Filter 'nerdbank-streams-*.crate' -Recurse)[0].FullName
        $packageDirectory = Join-Path $PWD 'cargo-package'
        tar -xzf $crate -C $packageDirectory
        $manifest = (Get-ChildItem $packageDirectory -Filter Cargo.toml -Recurse)[0].FullName
        cargo publish --manifest-path $manifest --no-verify --token $env:CARGO_REGISTRY_TOKEN
      working-directory: ${{ runner.temp }}

    - name: 🚀 Push NPM packages
      if: ${{ !inputs.skip_npm }}
      shell: pwsh
      run: |
        $tgz = (Get-ChildItem ./deployables/npm/*.tgz)[0].FullName
        $packageMetadata = tar -xOf $tgz package/package.json | ConvertFrom-Json
        $publishArgs = @($tgz)

        if ($packageMetadata.version -match '-(?<prerelease>[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)') {
          $publishTag = $Matches.prerelease.Split('.')[0]
          Write-Host "Detected prerelease version $($packageMetadata.version). Publishing with dist-tag '$publishTag'."
          $publishArgs += "--tag=$publishTag"
        }

        npm set //registry.npmjs.org/:_authToken=${{ secrets.NPM_API_KEY }}
        npm publish @publishArgs
      working-directory: ${{ runner.temp }}

    - name: 🚀 Push NuGet packages
      if: ${{ !inputs.skip_nuget }}
      run: dotnet nuget push ${{ runner.temp }}\deployables\NuGet\*.nupkg --source https://api.nuget.org/v3/index.json -k '${{ steps.nuget-login.outputs.NUGET_API_KEY }}'

    - name: 💽 Upload artifacts to release
      shell: pwsh
      if: ${{ github.event_name == 'release' && github.event.release.assets_url != '' }}
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        $ErrorActionPreference = 'Stop'
        $PSNativeCommandUseErrorActionPreference = $true

        Get-ChildItem '${{ runner.temp }}/deployables' -File -Recurse |% {
          Write-Host "Uploading $($_.Name) to release..."
          gh release -R ${{ github.repository }} upload "${{ github.ref_name }}" $_.FullName
        }