release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: filecontext-release
  cancel-in-progress: false

env:
  DOTNET_VERSION: '10.0.x'

jobs:
  build:
    name: Validate and pack
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup .NET
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Read package version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          VERSION="$(dotnet msbuild src/ManagedCode.FileContext/ManagedCode.FileContext.csproj -nologo -getProperty:PackageVersion | tr -d '\r')"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "::error::Invalid release version: $VERSION"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Restore
        run: dotnet restore ManagedCode.FileContext.slnx

      - name: Verify formatting
        run: dotnet format ManagedCode.FileContext.slnx --verify-no-changes --no-restore

      - name: Build
        run: dotnet build ManagedCode.FileContext.slnx --configuration Release --no-restore

      - name: Test with coverage
        run: dotnet test tests/ManagedCode.FileContext.Tests/ManagedCode.FileContext.Tests.csproj --configuration Release --no-build /p:CollectCoverage=true

      - name: Pack
        run: dotnet pack src/ManagedCode.FileContext/ManagedCode.FileContext.csproj --configuration Release --no-build --output artifacts -p:IncludeSymbols=false

      - name: Upload validated package
        uses: actions/upload-artifact@v7
        with:
          name: release-package
          path: artifacts/ManagedCode.FileContext.${{ steps.version.outputs.version }}.nupkg
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish NuGet and GitHub release
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      VERSION: ${{ needs.build.outputs.version }}
      RELEASE_TAG: v${{ needs.build.outputs.version }}
      GH_TOKEN: ${{ github.token }}

    steps:
      - name: Checkout validated commit
        uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0

      - name: Check existing release
        id: release
        shell: bash
        run: |
          set -euo pipefail
          gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/releases" > "$RUNNER_TEMP/releases.json"
          if jq -e --arg tag "$RELEASE_TAG" 'any(.[][]; .tag_name == $tag and .draft == false)' "$RUNNER_TEMP/releases.json" > /dev/null; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "$RELEASE_TAG is already released; skipping publication." >> "$GITHUB_STEP_SUMMARY"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Validate existing tag
        if: steps.release.outputs.exists == 'false'
        shell: bash
        run: |
          set -euo pipefail
          if git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" > /dev/null; then
            TAG_COMMIT="$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")"
            if [ "$TAG_COMMIT" != "$GITHUB_SHA" ]; then
              echo "::error::$RELEASE_TAG points to $TAG_COMMIT, not the validated commit $GITHUB_SHA."
              exit 1
            fi
          fi

      - name: Download validated package
        if: steps.release.outputs.exists == 'false'
        uses: actions/download-artifact@v8
        with:
          name: release-package
          path: artifacts

      - name: Setup .NET
        if: steps.release.outputs.exists == 'false'
        uses: actions/setup-dotnet@v6
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Publish to NuGet
        if: steps.release.outputs.exists == 'false'
        shell: bash
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: |
          set -euo pipefail
          if [ -z "$NUGET_API_KEY" ]; then
            echo "::error::NUGET_API_KEY is not configured."
            exit 1
          fi
          dotnet nuget push "artifacts/ManagedCode.FileContext.$VERSION.nupkg" \
            --api-key "$NUGET_API_KEY" \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate

      - name: Create version tag
        if: steps.release.outputs.exists == 'false'
        shell: bash
        run: |
          set -euo pipefail
          if ! git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" > /dev/null; then
            git config user.name 'github-actions[bot]'
            git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
            git tag -a "$RELEASE_TAG" "$GITHUB_SHA" -m "Release $VERSION"
            git push origin "refs/tags/$RELEASE_TAG"
          fi

      - name: Create GitHub release
        if: steps.release.outputs.exists == 'false'
        shell: bash
        run: |
          set -euo pipefail
          FLAGS=()
          if [[ "$VERSION" == *-* ]]; then
            FLAGS+=(--prerelease)
          fi
          gh release create "$RELEASE_TAG" "artifacts/ManagedCode.FileContext.$VERSION.nupkg" \
            --title "$RELEASE_TAG" \
            --generate-notes \
            --verify-tag \
            "${FLAGS[@]}"