Faris Laptop
7e80226bf2
Two branches: dev for everyday work, production for releases. - ci.yml builds and packs on dev and on pull requests; it never publishes. - release.yml runs on a push (usually a merge) into production: reads <Version> from the csproj, refuses to proceed if that tag already exists, publishes to nuget.org, and only then creates the tag and the Gitea release — so a tag always means a published package. - Drop --skip-duplicate: a duplicate push must fail loudly instead of reporting success while shipping nothing.
97 lines
3.5 KiB
YAML
97 lines
3.5 KiB
YAML
name: Release
|
|
|
|
# Merging (or pushing) into production releases whatever version the files
|
|
# declare: <Version> in src/CertifiEd.Client/CertifiEd.Client.csproj is the
|
|
# single source of truth. The workflow tags it, publishes the package to
|
|
# nuget.org and creates the Gitea release.
|
|
#
|
|
# To ship: bump <Version> on dev, merge dev -> production.
|
|
on:
|
|
push:
|
|
branches: [production]
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: "10.0.x"
|
|
|
|
- name: Read version from the project file
|
|
id: version
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION=$(sed -n 's:.*<Version>\(.*\)</Version>.*:\1:p' src/CertifiEd.Client/CertifiEd.Client.csproj | head -1)
|
|
if [ -z "$VERSION" ]; then
|
|
echo "::error::<Version> not found in src/CertifiEd.Client/CertifiEd.Client.csproj"
|
|
exit 1
|
|
fi
|
|
echo "value=$VERSION" >> "$GITHUB_OUTPUT"
|
|
echo "Releasing version $VERSION"
|
|
|
|
# A published NuGet version can never be replaced, so refuse to re-run an
|
|
# already released version instead of silently doing nothing.
|
|
- name: Refuse to release an existing version
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
TAG="v${{ steps.version.outputs.value }}"
|
|
CODE=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
-H "Authorization: token $TOKEN" \
|
|
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/$TAG")
|
|
if [ "$CODE" = "200" ]; then
|
|
echo "::error::$TAG is already released. Bump <Version> in the csproj on dev, then merge again."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Build
|
|
run: dotnet build --configuration Release
|
|
|
|
- name: Pack
|
|
run: >
|
|
dotnet pack src/CertifiEd.Client/CertifiEd.Client.csproj
|
|
--configuration Release --no-build --output artifacts
|
|
|
|
# No --skip-duplicate: a duplicate must fail loudly, not look successful.
|
|
- name: Publish to nuget.org
|
|
env:
|
|
NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${NUGET_API_KEY:-}" ]; then
|
|
echo "::error::NUGET_API_KEY secret is not set"
|
|
exit 1
|
|
fi
|
|
dotnet nuget push artifacts/*.nupkg \
|
|
--source https://api.nuget.org/v3/index.json \
|
|
--api-key "$NUGET_API_KEY"
|
|
|
|
# Tag and release only after the package is actually on nuget.org, so the
|
|
# tag always corresponds to something published.
|
|
- name: Tag and create the release
|
|
env:
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
VERSION="${{ steps.version.outputs.value }}"
|
|
TAG="v$VERSION"
|
|
BODY="CertifiEd.Client $VERSION\n\nnuget: https://www.nuget.org/packages/CertifiEd.Client/$VERSION"
|
|
curl -sf -X POST \
|
|
-H "Authorization: token $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"$GITHUB_SHA\",\"name\":\"$TAG\",\"body\":\"$BODY\"}" \
|
|
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" > /dev/null
|
|
echo "Released $TAG"
|
|
|
|
- name: Upload package artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: nupkg
|
|
path: artifacts/*
|