build-library.yml

name: Build and Test Library

on:
  push:
    branches:
      - main
    paths:
      - 'src/**'
      - 'tests/**'
      - 'Datasync.Toolkit.sln'
      - 'Directory.Packages.props'
      - '.github/workflows/build-library.yml'
      - '.github/workflows/SignedPackageFileList.txt'
  pull_request:
    branches:
      - main
    paths:
      - 'src/**'
      - 'tests/**'
      - 'Datasync.Toolkit.sln'
      - 'Directory.Packages.props'
      - '.github/workflows/build-library.yml'
      - '.github/workflows/SignedPackageFileList.txt'
  release:
    types:
      - published
  workflow_dispatch:

env:
  DOTNET_VERSION: '10.0.x'
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
  DOTNET_NOLOGO: true
  DOTNET_CONFIGURATION: 'Release'
  NuGetDirectory: ${{ github.workspace }}/nuget
  SolutionFile: 'Datasync.Toolkit.sln'
  BASE_VERSION: '10.0.0'

permissions:
  pull-requests: write
  contents: read
  checks: write

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      - name: Get build version
        env:
          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          Import-Module .\tools\GetBuildVersion.psm1
          # github.ref / $env:GITHUB_REF can be empty on 'release' events (see #495), so use the
          # release's tag name directly instead of relying on ref resolution for that event.
          $refString = if ($env:GITHUB_EVENT_NAME -eq 'release') { "refs/tags/$($env:RELEASE_TAG_NAME)" } else { $env:GITHUB_REF }
          Write-Host "GitHub Reference = $refString"
          $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $refString -BuildNumber $env:GITHUB_RUN_NUMBER
          echo "BUILD_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf-8 -Append
          Write-Host "BUILD_VERSION=$version"
        shell: pwsh

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Restore dependencies
        run: dotnet restore

      - name: Build library
        run: >
          dotnet build 
          --configuration ${{ env.DOTNET_CONFIGURATION }} 
          -p:PackageVersion="$BUILD_VERSION"
          -p:Version="$BUILD_VERSION" 
          --no-restore

      - name: Run tests
        run: >
          dotnet test --nologo 
          --configuration ${{ env.DOTNET_CONFIGURATION }}
          -p:PackageVersion="$BUILD_VERSION"
          -p:Version="$BUILD_VERSION" 
          --no-build 
          --verbosity minimal
          --logger trx
          --collect:"XPlat Code Coverage"

      - name: Combine coverage reports
        uses: danielpalme/ReportGenerator-GitHub-Action@5.5.10
        with:
          reports: "**/coverage.cobertura.xml"
          assemblyfilters: "-*Test*"
          targetdir: "${{ github.workspace }}/TestResults" 
          reporttypes: "Cobertura;lcov;MarkdownSummaryGithub" 
          verbosity: "Info"
          title: "Code Coverage" 
          tag: "${{ github.run_number }}_${{ github.run_id }}" 
          customSettings: "" 
          toolpath: "reportgeneratortool"

      - name: Add code coverage summary to job
        if: always()
        run: cat "${{ github.workspace }}/TestResults/SummaryGithub.md" >> "$GITHUB_STEP_SUMMARY"

      - name: Upload code coverage reports
        uses: actions/upload-artifact@v7
        with:
          name: coverage
          path: ${{ github.workspace }}/TestResults
          retention-days: 7

      - name: Pack NuGet libraries
        run: >
          dotnet pack 
          --configuration ${{ env.DOTNET_CONFIGURATION }} 
          -p:PackageVersion="$BUILD_VERSION"
          -p:Version="$BUILD_VERSION" 
          --no-build 
          --output ${{ env.NuGetDirectory }}

      - name: Upload NuGet packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-unsigned
          if-no-files-found: error
          path: ${{ env.NuGetDirectory }}/*.nupkg
          retention-days: 7

      - name: Upload Package List
        uses: actions/upload-artifact@v7
        with:
          name: nuget-list
          if-no-files-found: error
          path: |
            ${{ github.workspace }}/.github/workflows/SignedPackageFileList.txt
          
  sign:
    needs: [build]
    # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on
    # 'release' events (see #495), which previously caused this job to be silently skipped.
    if: >-
      ${{ github.event_name == 'release' ||
          (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
          (github.event_name == 'workflow_dispatch' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))) }}
    runs-on: windows-latest
    permissions:
      id-token: write

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Install signing tool
        run: dotnet tool install --tool-path ./tools sign --version 0.9.1-beta.23356.1

      - name: Download NuGet package list
        uses: actions/download-artifact@v8
        with:
          name: nuget-list
          path: ${{ github.workspace }}

      - name: Download unsigned NuGet packages
        uses: actions/download-artifact@v8
        with:
          name: nuget-unsigned
          path: ${{ github.workspace }}/packages

      - name: Sign NuGet packages
        run: >
          ./tools/sign code azure-key-vault
          **/*.nupkg
          --base-directory "${{ github.workspace }}/packages"
          --file-list "${{ github.workspace }}/SignedPackageFileList.txt"
          --timestamp-url "http://timestamp.digicert.com"
          --publisher-name ".NET Foundation"
          --description "Community Datasync Toolkit"
          --description-url "https://github.com/CommunityToolkit/Datasync"
          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
          --azure-key-vault-client-id ${{ secrets.SIGN_CLIENT_ID }}
          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}"
          --azure-key-vault-tenant-id ${{ secrets.SIGN_TENANT_ID }}
          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}"
          --verbosity Information

      - name: Upload signed NuGet packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-signed
          if-no-files-found: error
          path: ${{ github.workspace }}/packages/**/*.nupkg

      - name: Add AzDO NuGet feed
        run: >
          dotnet nuget add source 
          https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-MainLatest/nuget/v3/index.json 
          --name MainLatest
          --username dummy
          --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}

      - name: Push signed packages to AzDO
        run: >
          dotnet nuget push 
          "${{ github.workspace }}/packages/**/*.nupkg" 
          --api-key dummy 
          --source MainLatest 
          --skip-duplicate

  release:
    # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on
    # 'release' events (see #495), which previously caused this job to be silently skipped.
    if: >-
      ${{ github.event_name == 'release' ||
          (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/')) }}
    needs: [ sign ]
    environment: nuget-release-gate
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
  
      - name: Download unsigned NuGet packages
        uses: actions/download-artifact@v8
        with:
          name: nuget-signed
          path: ${{ github.workspace }}/packages

      - name: NuGet login (OIDC)
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push signed packages to NuGet.org
        run: >
          dotnet nuget push
          ${{ github.workspace }}/packages/**/*.nupkg
          --source https://api.nuget.org/v3/index.json
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --skip-duplicate