main.yaml

name: Build, Test and Release

on:
  merge_group:
  pull_request:
    branches:
      - main
  push:
    branches:
      - feat/dotnet-standard2.0
    tags:
      - 'v*'

concurrency:
  # Prevent duplicate publishes for the same ref (tag/branch) running concurrently
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  # Suppress .NET first-time experience and telemetry
  # Source: https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-environment-variables
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true

jobs:
  test:
    runs-on: ${{ matrix.os }}
    
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest ]
        framework: [ net6.0, net8.0, net9.0 ]
        include:
          # .NET4.8 requires Windows
          - os: windows-latest
            framework: net48
          # .NET Core 3.1 is EOL, and is having libssl issues on Linux
          # But we still want to test it - no support is promised
          # It should still use .NET Standard 2.0
          - os: windows-latest
            framework: netcoreapp3.1
          # Test current LTS against Mac and Windows too
          - os: windows-latest
            framework: net8.0
          - os: macos-latest
            framework: net8.0

    name: Test ${{ matrix.framework }} on ${{ matrix.os }}
    
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup .NET versions
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: |
            3.1.x
            6.0.x
            8.0.x
            9.0.x

      - name: Cache NuGet packages
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore OpenFga.Sdk.sln --verbosity minimal

      - name: Build SDK and test project
        run: dotnet build --no-restore --configuration Release --verbosity minimal

      - name: Run tests for specific framework
        run: dotnet test src/OpenFga.Sdk.Test/OpenFga.Sdk.Test.csproj --no-build --configuration Release --framework ${{ matrix.framework }} --verbosity normal --logger trx --results-directory TestResults/ --collect:"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=opencover

      - name: Upload test results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: test-results-${{ matrix.os }}-${{ matrix.framework }}
          path: TestResults/
          retention-days: 7

      - name: Upload coverage to Codecov
        # Only upload coverage from one matrix job to avoid conflicts
        if: matrix.os == 'ubuntu-latest' && matrix.framework == 'net8.0'
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        continue-on-error: true
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: openfga/dotnet-sdk

  build-verification:
    runs-on: ubuntu-latest
    name: Build Verification

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup .NET versions
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: |
            3.1.x
            6.0.x
            8.0.x
            9.0.x

      - name: Restore dependencies
        run: dotnet restore OpenFga.Sdk.sln --verbosity minimal

      - name: Build SDK for all target frameworks
        run: dotnet build src/OpenFga.Sdk/OpenFga.Sdk.csproj --no-restore --configuration Release --verbosity normal

      - name: Verify all framework outputs exist
        run: |
          echo "Checking build outputs..."
          ls -la src/OpenFga.Sdk/bin/Release/

          # Verify each framework was built successfully
          frameworks=("netstandard2.0" "net48" "net8.0" "net9.0")
          for framework in "${frameworks[@]}"; do
            if [ -d "src/OpenFga.Sdk/bin/Release/${framework}" ]; then
              echo "✅ ${framework} build output found"
              ls -la "src/OpenFga.Sdk/bin/Release/${framework}/"
            else
              echo "❌ ${framework} build output missing"
              exit 1
            fi
          done

      - name: Upload SDK artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sdk-build-outputs
          path: src/OpenFga.Sdk/bin/Release/
          retention-days: 7

  pack:
    runs-on: ubuntu-latest
    name: Pack NuGet
    needs: [test, build-verification]
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: |
            3.1.x
            6.0.x
            8.0.x
            9.0.x

      - name: Restore dependencies
        run: dotnet restore OpenFga.Sdk.sln --verbosity minimal

      - name: Build
        run: dotnet build src/OpenFga.Sdk/OpenFga.Sdk.csproj --no-restore --configuration Release -p:ContinuousIntegrationBuild=true --verbosity minimal

      - name: Pack
        # Produce both the primary NuGet package (.nupkg) and the symbol package (.snupkg)
        run: |
          dotnet pack src/OpenFga.Sdk/OpenFga.Sdk.csproj \
            --no-build \
            --configuration Release \
            -p:ContinuousIntegrationBuild=true \
            -p:IncludeSymbols=true \
            -p:SymbolPackageFormat=snupkg \
            -p:DebugType=portable \
            -o artifact-pack

      - name: List produced packages
        run: ls -la artifact-pack

      - name: Upload NuGet package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: nuget-package
          path: |
            artifact-pack/*.nupkg
            artifact-pack/*.snupkg
          retention-days: 7

  verify-version:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
    needs: [pack]

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2

      - name: Verify versions match
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          MANIFEST_VERSION=$(jq -r '.["."]' .release-please-manifest.json)
          CSPROJ_VERSION=$(grep 'x-release-please-version' src/OpenFga.Sdk/OpenFga.Sdk.csproj | grep -oP '>\K[^<]+')

          echo "Tag: $TAG_VERSION | Manifest: $MANIFEST_VERSION | .csproj: $CSPROJ_VERSION"

          if [[ "$TAG_VERSION" != "$MANIFEST_VERSION" ]]; then
            echo "ERROR: Tag version does not match manifest version"
            exit 1
          fi
          if [[ "$CSPROJ_VERSION" != "$MANIFEST_VERSION" ]]; then
            echo "ERROR: .csproj version does not match manifest version"
            exit 1
          fi
          echo "All versions verified: $TAG_VERSION"

  publish:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
    needs: [pack, verify-version]
    permissions:
      id-token: write # For OIDC authentication with NuGet.org
      packages: write # For publishing to the GitHub Nuget Registry
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: |
            3.1.x
            6.0.x
            8.0.x
            9.0.x
          source-url: https://api.nuget.org/v3/index.json
        env:
          NUGET_AUTH_TOKEN: ${{secrets.NUGET_AUTH_TOKEN}}

      - name: Download package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4.1.8
        with:
          name: nuget-package
          path: ./dist

      - name: NuGet login (OIDC)
        uses: NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544 # v1.1.0
        id: login
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Publish to NuGet
        run: |
          echo "Publishing primary package to NuGet (.nupkg)...";
          dotnet nuget push dist/OpenFga.Sdk.*.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate --source https://api.nuget.org/v3/index.json
          echo "Publishing symbol package to NuGet (.snupkg)...";
          dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --skip-duplicate --source https://api.nuget.org/v3/index.json || echo "No symbol package found or already published."

      - name: Publish to GitHub Package Registry
        continue-on-error: true
        run: |
          echo "Publishing primary package to GitHub Package Registry (.nupkg)...";
          dotnet nuget push dist/OpenFga.Sdk.*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --source https://nuget.pkg.github.com/openfga/index.json
          echo "Publishing symbol package to GitHub Package Registry (.snupkg)...";
          dotnet nuget push dist/OpenFga.Sdk.*.snupkg --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate --source https://nuget.pkg.github.com/openfga/index.json || echo "No symbol package found or already published."

  undraft-release:
    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-test')
    needs: [publish]
    permissions:
      contents: write
    uses: openfga/sdk-generator/.github/workflows/undraft-release.yml@main