dotnet-main.yml

name: .NET main

on:
  push:
    branches: ["main"]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DEFAULT_DOTNET_VERSION: "10.0.x"

permissions:
  contents: read
  pull-requests: read

jobs:
  build:
    strategy:
      matrix:
        os: [windows-latest, ubuntu-latest]
      fail-fast: false
    runs-on: "${{ matrix.os }}"
    env:
      DOTNET_CONFIGURATION: Release
      DAPR_VERSION: "1.15.0"

    steps:
      - uses: actions/checkout@v7
      - name: Setup Runtimes, Caching, and Tools
        uses: ./.github/actions/setup-runtimes-caching
        with:
          name: "Full"
          docker-username: ${{ secrets.DOCKER_USERNAME }}
          docker-password: ${{ secrets.DOCKER_PASSWORD }}
          docker-registry: ${{ secrets.CUSTOM_CONTAINER_REGISTRY }}

      - name: Restore dependencies
        run: dotnet restore
      - name: Build
        run: dotnet build --no-restore --configuration ${{ env.DOTNET_CONFIGURATION }}

  run-tests:
    uses: ./.github/workflows/tests.yaml
    secrets: inherit

  package:
    uses: ./.github/workflows/package.yml
    with:
      version_suffix: "beta.${{ github.run_number }}"
    needs: run-tests
    if: ${{ github.actor != 'dependabot[bot]' }}

  sign:
    needs: package
    runs-on: windows-latest
    permissions:
      id-token: write # Required for requesting the JWT

    steps:
      - name: Install .NET SDK v${{ env.DEFAULT_DOTNET_VERSION }}
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: ${{ env.DEFAULT_DOTNET_VERSION }}

      - name: Download Package List
        uses: actions/download-artifact@v8
        with:
          name: nuget-packages
          path: ${{ github.workspace }}/packages

      - name: Download NuGet package list
        uses: actions/download-artifact@v8
        with:
          name: nuget-list
          path: ${{ github.workspace }}

      - name: Install Signing Tool
        run: dotnet tool install --tool-path ./tools sign --version 0.9.1-beta.23356.1

      - name: Sign Packages
        run: >
          ./tools/sign code azure-key-vault
          **/*.nupkg
          --base-directory "${{ github.workspace }}/packages"
          --file-list "${{ github.workspace }}/SignClientFileList.txt"
          --timestamp-url "http://timestamp.digicert.com"
          --publisher-name ".NET Foundation"
          --description "Aspire Community Toolkit"
          --description-url "https://github.com/CommunityToolkit/Aspire"
          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
          --azure-key-vault-client-id ${{ secrets.SIGN_CLIENT_ID }}
          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}"
          --azure-key-vault-tenant-id ${{ secrets.SIGN_TENANT_ID }}
          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}"
          --verbosity Information

      - name: Upload Signed Packages as Artifacts (for release)
        uses: actions/upload-artifact@v7
        with:
          name: signed-nuget-packages
          if-no-files-found: error
          path: |
            ${{ github.workspace }}/packages/**/*.nupkg

  publish-nuget:
    needs: [sign, detect-pr-label]
    runs-on: ubuntu-latest
    environment:
      name: nuget-beta
    permissions:
      id-token: write
      contents: read
    # Only run publish when the merged PR does NOT contain the skip label.
    # The label name is configurable via the `SKIP_PUBLISH_LABEL` env in the detector job below.
    if: needs.detect-pr-label.outputs.skip_publish != 'true'
    steps:
      - name: Download package
        uses: actions/download-artifact@v8
        with:
          name: signed-nuget-packages

      - name: NuGet login (OIDC)
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Publish to NuGet
        run: dotnet nuget push ./*.nupkg --source "https://api.nuget.org/v3/index.json" --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --skip-duplicate

  publish-azure-artifacts:
    needs: [sign, detect-pr-label]
    runs-on: windows-latest
    environment:
      name: azure-artifacts
    # Skip pushing to Azure Artifacts when the merged PR requested skipping the publish.
    if: needs.detect-pr-label.outputs.skip_publish != 'true'
    steps:
      - name: Download package
        uses: actions/download-artifact@v8
        with:
          name: signed-nuget-packages

      - name: Add AzDO NuGet feed
        run: >
          dotnet nuget add source 
          https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-MainLatest/nuget/v3/index.json
          --name MainLatest
          --username dummy
          --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}

      - name: Push signed packages to AzDO
        run: >
          dotnet nuget push 
          "${{ github.workspace }}/**/*.nupkg" 
          --api-key dummy 
          --source MainLatest 
          --skip-duplicate

  publish-coverage:
    if: github.actor != 'dependabot[bot]'
    needs: run-tests
    uses: ./.github/workflows/code-coverage.yml
    with:
      fail_on_low_coverage: true
    secrets: inherit

  detect-pr-label:
    # This job detects whether the commit that triggered this push
    # is associated with a merged pull request that contains a label
    # indicating we should skip publishing packages.
    runs-on: ubuntu-latest
    outputs:
      skip_publish: ${{ steps.check.outputs.skip }}
    env:
      # Change this label name to whatever you use to skip publishing.
      SKIP_PUBLISH_LABEL: skip-nuget-publish
    steps:
      - name: Check for Skip Publish Label
        id: check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          LABEL="${SKIP_PUBLISH_LABEL}"
          # Get the first PR associated with this commit (if any)
          number=$(gh api -H "Accept: application/vnd.github+json" \
            "/repos/${{ github.repository }}/commits/${{ github.sha }}/pulls" --jq '.[0].number' 2>/dev/null || echo "")
          if [ -z "$number" ] || [ "$number" = "null" ]; then
            # No PR found for this commit -> do not skip by default
            echo "skip=false" >> $GITHUB_OUTPUT
            exit 0
          fi

          # List label names for the PR and check for an exact match
          has_label=$(gh api "/repos/${{ github.repository }}/issues/$number/labels" --jq '.[].name' 2>/dev/null | grep -Fx -- "$LABEL" || true)
          if [ -n "$has_label" ]; then
            echo "skip=true" >> $GITHUB_OUTPUT
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi