release.yml

name: Release

# Publishing is driven by a tag, so the version that ships is the version that was tagged.
# v0.10.0 publishes 0.10.0. workflow_dispatch is there for a re-run without moving the tag.
#
# This package depends on BlockSoftware.QueryKit, so that version must already be live on
# nuget.org before this runs — the restore below has no local feed to fall back on.
on:
  push:
    tags: [ "v*" ]
  workflow_dispatch:
    inputs:
      version:
        description: "Package version to publish (e.g. 0.10.0)"
        required: true

jobs:
  publish:
    runs-on: ubuntu-latest

    permissions:
      id-token: write   # required for the OIDC token nuget.org exchanges for a short-lived key
      contents: write  # required to create the GitHub release

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            8.0.x
            10.0.x

      - name: Resolve version
        id: version
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          else
            echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
          fi

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Release -p:Version=${{ steps.version.outputs.value }}

      - name: Test
        run: dotnet test --no-build --configuration Release --verbosity normal

      - name: Pack
        run: dotnet pack QueryKit.Repositories/QueryKit.Repositories.csproj --no-build --configuration Release -p:Version=${{ steps.version.outputs.value }} -o artifacts

      # The temporary key is valid for an hour, so it is requested immediately before the push.
      - name: NuGet login (OIDC to short-lived API key)
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push
        run: >
          dotnet nuget push artifacts/*.nupkg
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate

      # Kept in the workflow run regardless of how it was triggered, so a dispatch re-run
      # still leaves the exact bytes that were built behind.
      - name: Upload artifacts to the run
        uses: actions/upload-artifact@v4
        with:
          name: packages
          path: artifacts/*

      # After the push, not before: a release that points at a version nuget.org rejected
      # would be a link to nothing. gh is pre-installed on the runner, so this adds no
      # third-party action to a workflow that holds a publishing credential.
      - name: Create the GitHub release
        if: github.event_name == 'push'
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          gh release create "${{ github.ref_name }}"
          artifacts/*.nupkg artifacts/*.snupkg
          --title "${{ github.ref_name }}"
          --generate-notes