Skip to content

GitHub Actions CI build and release with Trusted Publishing - #20

Open
imranakram wants to merge 3 commits into
masterfrom
ci/github-actions
Open

imranakram wants to merge 3 commits into
masterfrom
ci/github-actions

Conversation

@imranakram

Copy link
Copy Markdown
Owner

Replaces the ADO pipeline with the same GitHub Actions setup as PluginRegistration, and removes the unused appveyor.yml.

CI Build (build.yml)

  • Runs on pushes to master, PRs to master, and manually.
  • Versions each run 1.yyyy.MM.rrr (rrr = this month's runs up to this one, so overlapping runs can't collide), same shape as the old ADT-CI-* builds. Stamps AssemblyInfo.cs and AutoDeployer.nuspec.
  • Builds the solution (with the XrmToolBox.Helpers submodule) and uploads the nupkg, an XrmToolBox zip and the plugin files.

Release (release.yml), manual with a CI Build run ID

  • Only accepts a successful CI Build run on master and publishes that exact package (no rebuild); refuses a version that is already tagged.
  • Pushes to nuget.org with Trusted Publishing (NuGet/login@v1, one-hour key) and -SkipDuplicate.
  • Creates the ADT-<version> tag on the built commit and a GitHub release. Notes = nuspec <releaseNotes> followed by GitHub's generated PR list since the previous ADT-* tag.

Before the first release

  • nuget.org Trusted Publishing policy: owner imranakram, repository imranakram/XrmToolBox.AutoDeployer, workflow release.yml
  • NUGET_USER repository secret = imranakram
  • Update <releaseNotes> in AutoDeployer.nuspec (still the notes of the February release)
  • After the first successful release: retire the ADO pipeline

CI Build versions every run 1.yyyy.MM.rrr (rrr = this month's runs up to this
one), stamps AssemblyInfo and the nuspec, builds and uploads the nupkg, an
XrmToolBox zip and the plugin files. Release publishes the package of a
successful master build to nuget.org with Trusted Publishing and creates the
ADT-<version> tag and GitHub release, replacing the ADO pipeline.
Copilot AI balanced review requested due to automatic review settings October 11, 2026 19:06

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Version collisions and incorrect previous-tag selection can disrupt publishing and generated release notes.

2 open findings
What changed in this PR

Replaces legacy AppVeyor automation with GitHub Actions for versioned CI builds and trusted NuGet publishing.

Changes:

  • Adds CI packaging and artifact uploads.
  • Adds manual NuGet and GitHub release workflow.
  • Removes unused AppVeyor configuration.
File Description
.github/​workflows/​build.yml Builds, versions, packages, and uploads artifacts.
.github/​workflows/​release.yml Publishes selected CI artifacts and creates releases.
appveyor.yml Removes legacy CI configuration.

🧠 Review effort: Balanced


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/build.yml Outdated
Comment thread .github/workflows/release.yml Outdated
…ase commit

created_at has one-second resolution, so runs created in the same second got the
same number; ties are now broken by run ID. The previous release tag is searched
from the parent commit, so an ADT-CI tag the ADO build put on the release commit
itself can't empty the generated notes.
Copilot AI balanced review requested due to automatic review settings October 11, 2026 19:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Package extraction currently fails, and Trusted Publishing needs protection against branch-based workflow modification.

2 open findings
2 resolved since last review

🧠 Review effort: Balanced

Comment thread .github/workflows/build.yml
Comment thread .github/workflows/release.yml
workflow_dispatch can run release.yml from any branch, and the Trusted Publishing
policy only checks the repository and workflow file name, so a modified copy on
an unmerged branch could obtain a NuGet key. The job now runs in the "release"
environment, which is restricted to master and bound to the nuget.org policy.
Copilot AI balanced review requested due to automatic review settings October 12, 2026 07:50

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

API failure handling can generate incorrect versions or bypass the existing-tag safeguard.

1 open finding
2 resolved since last review
Previously missed (1)

In code that hasn't changed since last review

Medium severity Preserve earlier-runs query failures

.github/​workflows/​build.yml:53

The failure status from the earlier-runs query is overwritten by the same-second query. If the first API call fails but the second succeeds, $earlier becomes 0 and the workflow emits an already-used or incorrect version instead of failing. Check each native call before issuing the next one.

🧠 Review effort: Balanced

Comment on lines +99 to +102
gh api "repos/$env:GITHUB_REPOSITORY/git/ref/tags/$tag" --silent 2>$null
if ($LASTEXITCODE -eq 0) { throw "Tag $tag already exists" }
# "Not found" is the expected answer; don't let gh's exit code end the step as failed
$global:LASTEXITCODE = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants