ci: release from the production branch, version from the project file

Two branches: dev for everyday work, production for releases. - ci.yml builds and packs on dev and on pull requests; it never publishes. - release.yml runs on a push (usually a merge) into production: reads <Version> from the csproj, refuses to proceed if that tag already exists, publishes to nuget.org, and only then creates the tag and the Gitea release — so a tag always means a published package. - Drop --skip-duplicate: a duplicate push must fail loudly instead of reporting success while shipping nothing.
2026-07-20 16:12:21 +05:00
parent 2cd024f782
commit 7e80226bf2
3 changed files with 133 additions and 50 deletions
@@ -0,0 +1,96 @@
+name: Release
+
+# Merging (or pushing) into production releases whatever version the files
+# declare: <Version> in src/CertifiEd.Client/CertifiEd.Client.csproj is the
+# single source of truth. The workflow tags it, publishes the package to
+# nuget.org and creates the Gitea release.
+#
+# To ship: bump <Version> on dev, merge dev -> production.
+on:
+  push:
+    branches: [production]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Read version from the project file
+        id: version
+        run: |
+          set -euo pipefail
+          VERSION=$(sed -n 's:.*<Version>\(.*\)</Version>.*:\1:p' src/CertifiEd.Client/CertifiEd.Client.csproj | head -1)
+          if [ -z "$VERSION" ]; then
+            echo "::error::<Version> not found in src/CertifiEd.Client/CertifiEd.Client.csproj"
+            exit 1
+          fi
+          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Releasing version $VERSION"
+
+      # A published NuGet version can never be replaced, so refuse to re-run an
+      # already released version instead of silently doing nothing.
+      - name: Refuse to release an existing version
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="v${{ steps.version.outputs.value }}"
+          CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token $TOKEN" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/$TAG")
+          if [ "$CODE" = "200" ]; then
+            echo "::error::$TAG is already released. Bump <Version> in the csproj on dev, then merge again."
+            exit 1
+          fi
+
+      - name: Build
+        run: dotnet build --configuration Release
+
+      - name: Pack
+        run: >
+          dotnet pack src/CertifiEd.Client/CertifiEd.Client.csproj
+          --configuration Release --no-build --output artifacts
+
+      # No --skip-duplicate: a duplicate must fail loudly, not look successful.
+      - name: Publish to nuget.org
+        env:
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${NUGET_API_KEY:-}" ]; then
+            echo "::error::NUGET_API_KEY secret is not set"
+            exit 1
+          fi
+          dotnet nuget push artifacts/*.nupkg \
+            --source https://api.nuget.org/v3/index.json \
+            --api-key "$NUGET_API_KEY"
+
+      # Tag and release only after the package is actually on nuget.org, so the
+      # tag always corresponds to something published.
+      - name: Tag and create the release
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.version.outputs.value }}"
+          TAG="v$VERSION"
+          BODY="CertifiEd.Client $VERSION\n\nnuget: https://www.nuget.org/packages/CertifiEd.Client/$VERSION"
+          curl -sf -X POST \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"$GITHUB_SHA\",\"name\":\"$TAG\",\"body\":\"$BODY\"}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" > /dev/null
+          echo "Released $TAG"
+
+      - name: Upload package artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: nupkg
+          path: artifacts/*