publish.yml

name: Publish
concurrency:
  group: ${{ github.workflow }}-${{ inputs.ref || github.event.pull_request.head.ref || github.ref }}
  cancel-in-progress: true
permissions: write-all
defaults:
  run:
    shell: bash
on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
        description: git ref to checkout and to link annotations to
        default: ""
  workflow_dispatch:
    inputs:
      confirmation:
        description: "Are you sure you want to publish packages to nuget.org?"
        required: true
        default: "no"
        type: choice
        options:
          - "no"
          - "yes"
  push:
    branches:
      - release/v*
env:
  DOCKER_BUILDKIT: 1
  DOTNET_SYSTEM_CONSOLE_ALLOW_ANSI_COLOR_REDIRECTION: "true"
  DOTNET_CLI_UI_LANGUAGE: en-US
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
  DOTNET_NOLOGO: 1
  DOTNET_SVCUTIL_TELEMETRY_OPTOUT: 1
  DOTNET_CLI_TELEMETRY_OPTOUT: 1
  DOTNET_ROLL_FORWARD: Major
  DOTNET_ROLL_FORWARD_TO_PRERELEASE: 1
  DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: "false"
  POWERSHELL_TELEMETRY_OPTOUT: 1
  POWERSHELL_UPDATECHECK_OPTOUT: 1
  NUGET_CERT_REVOCATION_MODE: offline
  MSBUILDDISABLENODEREUSE: 1
jobs:
  publish:
    if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.confirmation == 'yes') || github.event_name == 'issue_comment' }}
    name: Publish
    runs-on: ubuntu-latest
    steps:
      - name: git checkout / on 'workflow_call'
        if: ${{ inputs.ref != '' }}
        uses: actions/checkout@v3
        with:
          clean: false
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: git checkout / on non-'workflow_call'
        if: ${{ inputs.ref == '' }}
        uses: actions/checkout@v3
        with:
          clean: false
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Forward env variables & checkout fixes
        id: gh
        run: |
          echo "MSBUILDDISABLENODEREUSE=1" >> .env
          env | grep -E '^(GITHUB_|CI)' | grep -E GITHUB_SHA= --invert-match | grep -E GITHUB_REF= --invert-match >> $GITHUB_ENV
          env | grep -E '^(GITHUB_|CI)' | grep -E GITHUB_SHA= --invert-match | grep -E GITHUB_REF= --invert-match >> .env
          sha=$(git rev-parse HEAD)
          echo "GITHUB_SHA=$sha" >> $GITHUB_ENV
          echo "GITHUB_SHA=$sha" >> .env
          branch=$(git rev-parse --abbrev-ref HEAD)
          echo "GITHUB_REF=refs/heads/$branch" >> $GITHUB_ENV
          echo "GITHUB_REF=refs/heads/$branch" >> .env
          echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> .env
          echo -e "\033[38;5;99;5;16msha: $sha\033[0m"
          echo -e "\033[38;5;99;5;16mbranch: $branch\033[0m"
          echo -e "\033[38;5;99;5;16minputs.ref: ${{ inputs.ref }}\033[0m"
          echo "sha=$sha" >> $GITHUB_OUTPUT
          echo "branch=$branch" >> $GITHUB_OUTPUT
          echo "::add-matcher::./.github/csc.json"

      # we can use [`IGNORE_GITHUB_REF: true`](https://github.com/dotnet/nbgv/issues/50) with default dotnet/nbgv@master
      # after 3.6 nbgv release and the gh runner will have it
      - name: Generate version
        id: nbgv
        uses: actions/github-script@v6
        with:
          script: |
            const path = require('path');
            const os = require('os');
            process.env.GITHUB_REF='refs/heads/${{ steps.gh.outputs.branch }}';
            process.env.GITHUB_SHA='${{ steps.gh.outputs.sha }}';
            try {
              // install nbgv isn' required
              // the image includes nbgv [actions/runner-images](https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2204-Readme.md#net-tools)

              // collect a JSON string of all the version properties.
              let versionJson = '';
              await exec.exec('nbgv', ['get-version', '-f', 'json'], { listeners: { stdout: (data) => { versionJson += data.toString() } } });
              core.setOutput('versionJson', versionJson);

              // break up the JSON into individual outputs.
              const versionProperties = JSON.parse(versionJson);
              for (let name in versionProperties.CloudBuildAllVars) {
                // Trim off the leading NBGV_
                core.setOutput(name.substring(5), versionProperties.CloudBuildAllVars[name]);
              }

              await exec.exec('nbgv', ['cloud', '-a']);
            }
            catch (error) {
              core.setFailed(error.message);
            }

      - name: Verify the public branch name matches version.json
        if: ${{ github.event_name == 'push' && steps.nbgv.outputs.PublicRelease == 'True' && endsWith(github.ref, steps.nbgv.outputs.MajorMinorVersion) != true && steps.gh.outputs.branch != 'master' }}
        run: |
          echo "::error::The branch name ${{ steps.gh.outputs.branch }} does not match version.json: ${{ steps.nbgv.outputs.MajorMinorVersion }}"
          exit 1

      - name: Verify that non-public branch has a prerelease suffix in version.json
        if: ${{ steps.nbgv.outputs.PublicRelease == 'False' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        run: |
          echo "::error::The non-public branch ${{ steps.gh.outputs.branch }} must have a prerelease suffix in version.json: ${{ steps.nbgv.outputs.MajorMinorVersion }}"
          exit 1

      - name: Verify that master branch has a prerelease suffix in version.json
        if: ${{ steps.gh.outputs.branch == 'master' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        run: |
          echo "::error::The master branch ${{ steps.gh.outputs.branch }} must have a prerelease suffix in version.json: ${{ steps.nbgv.outputs.MajorMinorVersion }}"
          exit 1

      - name: NuGet cache restore
        uses: actions/cache@v3
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: dotnet build
        id: build
        uses: vchirikov/.github/shell-and-report-action@master
        with:
          commands: |-
            dotnet build --nologo -c Debug -p:GenerateFullPaths=true /clp:NoSummary | sed -E 's/^(.*?)(error [A-Z0-9]{3,}:)(.*)$/- \1\2\3/g'
          report-start: |-
            :gear: Run publish... `༼ つ ◕_◕ ༽つ`
          report-failure: |-
            ❌ Build failed  `(╯°□°)╯︵ ┻━┻`

            <details> <summary> dotnet build output </summary>

            ```diff
            {0}
            ```

            </details>

      - name: dotnet test
        shell: bash --noprofile --norc {0}
        id: tests
        run: |-
          exec 4>&1
          out=$(set -o pipefail; dotnet test --nologo --no-build --filter 'FullyQualifiedName~UnitTests' --blame-hang --blame-hang-timeout 60s --logger:"github;name=unit-tests;GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }};GITHUB_SHA=${{ steps.gh.outputs.sha }}" | sed -E 's/^([[:space:]]+Failed [a-z_A-Z0-9]{3,})(.*)$/- \1\2/g' | sed -E 's/^([[:space:]]+Passed [a-z_A-Z0-9]{3,})(.*)$/+ \1\2/g' 2>&1 | tee >(cat - >&4) ; exit ${PIPESTATUS[0]})
          exit_code=$?
          delimiter="__gh_1oFF__" ; eol=$'\n' ;
          key='out'; val=$(echo "$out" | tail -c 1MB)
          echo "${key}<<${delimiter}${eol}${val}${eol}${delimiter}" >> $GITHUB_OUTPUT
          key='summary' ; val=$(cat $GITHUB_STEP_SUMMARY | tail -c 1MB)
          echo "${key}<<${delimiter}${eol}${val}${eol}${delimiter}" >> $GITHUB_OUTPUT
          exec 4>&- || true
          exit $exit_code

      - name: Report tests success
        if: ${{ steps.tests.outcome == 'success' }}
        uses: mshick/add-pr-comment@07f690343c25a94e24a8acb70d03c86b701ae322
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          allow-repeats: true
          message: |
            ✅ Running unit tests on `${{ steps.nbgv.outputs.SemVer2 }}` version was successful!

            ${{ steps.tests.outputs.summary }}

            `(•_•)          ( •_•)>⌐■-■          (⌐■_■)`

      - name: Report tests failed
        if: ${{ failure() && steps.tests.outcome == 'failure' }}
        uses: mshick/add-pr-comment@07f690343c25a94e24a8acb70d03c86b701ae322
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          allow-repeats: true
          message: |
            ❌ Tests failed. `(╯°□°)╯︵ ┻━┻`

            ${{ steps.tests.outputs.summary }}

            <details> <summary> Tests output </summary>

            ```diff
            ${{ steps.tests.outputs.out }}
            ```

            </details>

      - name: dotnet pack & publish
        id: publish
        uses: vchirikov/.github/shell-and-report-action@master
        with:
          commands: |-
            dotnet pack --no-restore --nologo -c Release -p:GenerateFullPaths=true /clp:NoSummary | sed -E 's/^(.*?)(error [A-Z0-9]{3,}:)(.*)$/- \1\2\3/g'
            dotnet nuget push artifacts/nupkg/*.nupkg --api-key ${{ secrets.NUGET_TOKEN }}  --source https://api.nuget.org/v3/index.json --force-english-output --timeout 20 --skip-duplicate | sed -E 's/^(.*?)(error)(.*)$/- \1\2\3/g'
          report-success: |-
            🎉 Version `${{ steps.nbgv.outputs.SemVer2 }}` was successful published! `(〃￣︶￣)人(￣︶￣〃)`
          report-failure: |-
            📦 Publishing failed. `(╯°□°)╯︵ ┻━┻`

            <details> <summary> Output </summary>

            ```diff
            {0}
            ```

            </details>

      - name: Create tag
        if: ${{ steps.nbgv.outputs.PublicRelease == 'True' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        uses: actions/github-script@v6
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: "refs/tags/${{ steps.nbgv.outputs.SemVer2 }}",
              sha: "${{ steps.gh.outputs.sha }}"
            })

      - name: Setup git-chglog
        if: ${{ steps.nbgv.outputs.PublicRelease == 'True' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        working-directory: /tmp
        run: |
          wget https://github.com/git-chglog/git-chglog/releases/download/v${VERSION}/git-chglog_${VERSION}_linux_amd64.tar.gz
          tar -xvf git-chglog_${VERSION}_linux_amd64.tar.gz
          sudo mv git-chglog /usr/local/bin/
        env:
          VERSION: "0.15.1"

      - name: Generate changelog
        if: ${{ steps.nbgv.outputs.PublicRelease == 'True' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        id: changelog
        uses: vchirikov/.github/shell-action@master
        with:
          commands: |-
            echo "Creating change log for tag: ${{ steps.nbgv.outputs.SemVer2 }}"
            git tag ${{ steps.nbgv.outputs.SemVer2 }}
            git-chglog --config .github/git-chglog/config.yml ${{ steps.nbgv.outputs.SemVer2 }}

      - name: Create Release
        if: ${{ steps.nbgv.outputs.PublicRelease == 'True' && steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen == '' }}
        uses: actions/create-release@v1.1.4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          prerelease: ${{ steps.nbgv.outputs.PrereleaseVersionNoLeadingHyphen != '' }}
          tag_name: ${{ steps.nbgv.outputs.SemVer2 }}
          release_name: ${{ steps.nbgv.outputs.SemVer2 }}
          body: ${{ steps.changelog.outputs.out }}

      - name: Create merge branch
        if: ${{ steps.gh.outputs.branch != 'master' && steps.nbgv.outputs.PublicRelease == 'True' }}
        shell: bash --noprofile --norc {0}
        continue-on-error: true
        id: merge
        env:
          GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
        run: |-
          git config --global init.defaultBranch master
          git config --global push.autoSetupRemote true
          git config --global push.default current
          git config --global merge.ff true
          git config --global merge.conflictstyle zdiff3
          git config --global --add safe.directory $GITHUB_WORKSPACE
          git config --global user.name "verysimplenick"
          git config --global user.email "922660+verysimplenick@users.noreply.github.com"
          git remote set-url origin https://${{ secrets.BOT_GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git
          git fetch origin master
          git reset --hard && git clean -xdf
          sha="${{ steps.gh.outputs.sha }}" ; sha_compact="${sha:0:8}" ; date=$(date '+%Y-%m-%d')
          merge_branch="merge/$date/${{ steps.gh.outputs.branch }}/$sha_compact"
          echo -e "\033[38;5;99;5;16mmerge_branch: $merge_branch\033[0m"
          git switch master && git switch -c "$merge_branch"
          branch_url="https://github.com/${GITHUB_REPOSITORY}/tree/$merge_branch"
          delimiter="__gh_1oFF__" ; eol=$'\n' ;
          key='branch_url'; val="$branch_url"
          echo "${key}<<${delimiter}${eol}${val}${eol}${delimiter}" >> $GITHUB_OUTPUT
          exec 4>&1
          git_merge=$(set -o pipefail; git merge --commit --stat --no-progress --no-edit origin/${{ steps.gh.outputs.branch }} 2>&1 | tee >(cat - >&4) ; exit ${PIPESTATUS[0]}) || ( git merge --quit && git add . && git commit -m "Merge ${{ steps.gh.outputs.branch }} with conflicts. [skip ci]" )
          git push origin "$merge_branch"
          pr_url=$(set -o pipefail; gh pr create --fill --reviewer "${{ github.actor }}" | grep '^https://github.com/' 2>&1 | tee >(cat - >&4) ; exit ${PIPESTATUS[0]})
          gh pr edit "$pr_url" --title "[$date] Auto-merge '${{ steps.gh.outputs.branch }}' / $sha_compact"
          key='pr_url'; val="$pr_url"
          echo "${key}<<${delimiter}${eol}${val}${eol}${delimiter}" >> $GITHUB_OUTPUT
          key='git_merge'; val=$(echo "$git_merge" | tail -c 1MB)
          echo "${key}<<${delimiter}${eol}${val}${eol}${delimiter}" >> $GITHUB_OUTPUT
          exec 4>&- || true

      - name: Approve PR
        if: ${{ steps.gh.outputs.branch != 'master' && steps.nbgv.outputs.PublicRelease == 'True' && steps.merge.outcome == 'success' && steps.merge.outputs.pr_url }}
        continue-on-error: true
        id: approve
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          pr_url: ${{ steps.merge.outputs.pr_url }}
        run: |-
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git
          (gh pr review --approve "$pr_url" && gh pr merge --auto --merge "$pr_url") || true

      - name: Report auto-merge
        if: ${{ steps.gh.outputs.branch != 'master' && steps.nbgv.outputs.PublicRelease == 'True' && steps.merge.outputs.branch_url }}
        uses: mshick/add-pr-comment@07f690343c25a94e24a8acb70d03c86b701ae322
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          allow-repeats: true
          message: |
            🔖 [Auto-merge PR](${{ steps.merge.outputs.pr_url || steps.merge.outputs.branch_url }})

            <details> <summary> git merge output </summary>

            ```diff
            ${{ steps.merge.outputs.git_merge }}
            ```
            </details>

      - name: Report cancellation
        if: ${{ cancelled() }}
        uses: mshick/add-pr-comment@07f690343c25a94e24a8acb70d03c86b701ae322
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          allow-repeats: true
          message: |
            ⚠️ Cancelled. `(ง •_•)ง`

      - name: Report failure
        if: ${{ failure() && steps.tests.outcome != 'failure' && steps.build.outcome != 'failure' }}
        uses: mshick/add-pr-comment@07f690343c25a94e24a8acb70d03c86b701ae322
        with:
          allow-repeats: true
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          message: |
            ❌ Failed. `( ˘︹˘ )`