publish.yml

name: Publish Package
run-name: "Publish Package: ${{ inputs.project }}"

on:
  workflow_dispatch:
    inputs:
      project:
        description: 'Project to publish (equals .csproj base name)'
        required: true
        type: choice
        options:
          - OutWit.Common
          - OutWit.Common.Aspects
          - OutWit.Common.CommandLine
          - OutWit.Common.Logging
          - OutWit.Common.Logging.Abstractions
          - OutWit.Common.Rest
          - OutWit.Common.Reflection
          - OutWit.Common.Proxy
          - OutWit.Common.Proxy.Generator
          - OutWit.Common.Json
          - OutWit.Common.MemoryPack
          - OutWit.Common.MessagePack
          - OutWit.Common.ProtoBuf
          - OutWit.Common.MVVM
          - OutWit.Common.MVVM.WPF
          - OutWit.Common.MVVM.WPF.Generator
          - OutWit.Common.MVVM.Avalonia
          - OutWit.Common.MVVM.Avalonia.Generator
          - OutWit.Common.MVVM.Blazor
          - OutWit.Common.MVVM.Navigation
          - OutWit.Common.MVVM.Navigation.Avalonia
          - OutWit.Common.MVVM.Navigation.Avalonia.DialogHost
          - OutWit.Common.MVVM.Navigation.WPF
          - OutWit.Common.MVVM.Navigation.Modules
          - OutWit.Common.NUnit
          - OutWit.Common.Platform
          - OutWit.Common.Licensing
          - OutWit.Common.Licensing.MVVM
          - OutWit.Common.Licensing.Generator
          - OutWit.Common.Plugins
          - OutWit.Common.Plugins.Abstractions
          - OutWit.Common.Settings
          - OutWit.Common.Settings.Json
          - OutWit.Common.Settings.Csv
          - OutWit.Common.Settings.Database
          - OutWit.Common.Configuration
          - OutWit.Common.DependencyInjection
          - OutWit.Common.DependencyInjection.Generator
          - OutWit.Common.Email
          - OutWit.Common.Fat
          - OutWit.Common.Forms
          - OutWit.Common.Forms.MessagePack
          - OutWit.Common.Messenger
          - OutWit.Common.Logging.Query
          - OutWit.Common.Logging.NewRelic
          - OutWit.Common.Logging.Loki
      pushToNuGet:
        description: 'Push to nuget.org'
        type: boolean
        required: true
        default: true
      pushToGitHubPackages:
        description: 'Push to GitHub Packages'
        type: boolean
        required: true
        default: true

permissions:
  contents: read
  packages: write
  # Lets GitHub mint the OIDC token that nuget.org exchanges for a short-lived
  # key. Without it the exchange fails quietly rather than loudly, which is the
  # one failure worth naming here.
  id-token: write

jobs:
  publish:
    runs-on: windows-latest
    env:
      PROJECT: ${{ github.event.inputs.project }}

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET SDKs (6/7/8/9/10)
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            6.0.x
            7.0.x
            8.0.x
            9.0.x
            10.0.x

      - name: Cache NuGet
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.sln*', '**/*.csproj') }}
          restore-keys: |
            nuget-${{ runner.os }}-

      - name: Resolve project paths
        id: paths
        shell: pwsh
        run: |
          $name = "${{ env.PROJECT }}"
          $lib = Get-ChildItem -Recurse -Filter "$name.csproj" | Select-Object -Expand FullName -First 1
          if (-not $lib) { Write-Error "Library project '$name.csproj' not found"; exit 1 }
          "libCsproj=$lib" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          Write-Host "Resolved: $lib"
          
          # Check if this project embeds a generator and needs it built first
          # Projects that embed generators: OutWit.Common.Proxy, OutWit.Common.MVVM.WPF, OutWit.Common.MVVM.Avalonia, OutWit.Common.DependencyInjection
          $generatorProject = ""
          switch ($name) {
            "OutWit.Common.Proxy" {
              $generatorProject = Get-ChildItem -Recurse -Filter "OutWit.Common.Proxy.Generator.csproj" | Select-Object -Expand FullName -First 1
            }
            "OutWit.Common.MVVM.WPF" {
              $generatorProject = Get-ChildItem -Recurse -Filter "OutWit.Common.MVVM.WPF.Generator.csproj" | Select-Object -Expand FullName -First 1
            }
            "OutWit.Common.MVVM.Avalonia" {
              $generatorProject = Get-ChildItem -Recurse -Filter "OutWit.Common.MVVM.Avalonia.Generator.csproj" | Select-Object -Expand FullName -First 1
            }
            "OutWit.Common.DependencyInjection" {
              $generatorProject = Get-ChildItem -Recurse -Filter "OutWit.Common.DependencyInjection.Generator.csproj" | Select-Object -Expand FullName -First 1
            }
          }
          
          if ($generatorProject) {
            "generatorCsproj=$generatorProject" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
            "hasGenerator=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
            Write-Host "Associated generator: $generatorProject"
          } else {
            "hasGenerator=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
            Write-Host "No associated generator"
          }

      - name: Build generator (if needed)
        if: steps.paths.outputs.hasGenerator == 'true'
        run: dotnet build "${{ steps.paths.outputs.generatorCsproj }}" -c Release

      - name: Build (all target frameworks)
        run: dotnet build "${{ steps.paths.outputs.libCsproj }}" -c Release -p:ContinuousIntegrationBuild=true

      - name: Pack (no build)
        run: dotnet pack "${{ steps.paths.outputs.libCsproj }}" -c Release --no-build

      - name: Collect packages
        id: collect
        shell: pwsh
        run: |
          if (!(Test-Path "NuGet")) { New-Item -ItemType Directory -Force -Path "NuGet" | Out-Null }
          Get-ChildItem -Recurse -Include *.nupkg,*.snupkg -Path . |
            Where-Object { $_.FullName -match "\\bin\\Release\\" } |
            Copy-Item -Destination "NuGet" -Force
          
          $hasNupkg = (Get-ChildItem -Path "NuGet" -Filter "*.nupkg" | Measure-Object).Count -gt 0
          $hasSnupkg = (Get-ChildItem -Path "NuGet" -Filter "*.snupkg" | Measure-Object).Count -gt 0
          
          "hasNupkg=$hasNupkg" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          "hasSnupkg=$hasSnupkg" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          
          Write-Host "Collected packages:"
          Get-ChildItem NuGet | Select-Object Name
          Write-Host "Has .nupkg: $hasNupkg"
          Write-Host "Has .snupkg: $hasSnupkg"

      - name: Add GitHub Packages source
        if: github.event.inputs.pushToGitHubPackages == 'true'
        run: >
          dotnet nuget add source
          --username ${{ github.actor }}
          --password ${{ secrets.GITHUB_TOKEN }}
          --store-password-in-clear-text
          --name github
          "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json"

      # Trusted publishing: no stored API key. GitHub proves which repository and
      # which workflow is asking, nuget.org checks that against its policy and
      # returns a key valid for an hour. Nothing long-lived exists to leak, and
      # nothing has to be rotated on a calendar.
      - name: Authenticate to nuget.org (trusted publishing)
        id: login
        if: github.event.inputs.pushToNuGet == 'true' && (steps.collect.outputs.hasNupkg == 'True' || steps.collect.outputs.hasSnupkg == 'True')
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to nuget.org (.nupkg)
        if: github.event.inputs.pushToNuGet == 'true' && steps.collect.outputs.hasNupkg == 'True'
        run: >
          dotnet nuget push "NuGet\*.nupkg"
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate

      - name: Push symbols to nuget.org (.snupkg)
        if: github.event.inputs.pushToNuGet == 'true' && steps.collect.outputs.hasSnupkg == 'True'
        run: >
          dotnet nuget push "NuGet\*.snupkg"
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate

      - name: Push to GitHub Packages (.nupkg)
        if: github.event.inputs.pushToGitHubPackages == 'true' && steps.collect.outputs.hasNupkg == 'True'
        run: >
          dotnet nuget push "NuGet\*.nupkg"
          --api-key ${{ secrets.GITHUB_TOKEN }}
          --source github
          --skip-duplicate
          
      - name: Upload NuGet artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.PROJECT }}-nuget
          path: NuGet/*
          retention-days: 7