build.yml

name: Build

on:
  push:
  pull_request:
  workflow_dispatch:

env:
  BuildConfiguration: Release

jobs:
  build:
    name: Build
    runs-on: windows-latest

    steps:
    - uses: actions/checkout@v7

    - name: Install .NET SDKs
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: |
          8.0.x
          10.0.x

    - name: Restore solution
      run: dotnet restore src/DataGridExtensions.sln

    - name: Build solution
      run: dotnet build src/DataGridExtensions.sln --configuration ${{ env.BuildConfiguration }} --no-restore

    - name: Publish artifact BuildPackages
      uses: actions/upload-artifact@v7
      with:
        name: BuildPackages
        path: src/DataGridExtensions/bin/${{ env.BuildConfiguration }}/*.nupkg
        if-no-files-found: error

  codesign:
    name: Code Signing
    needs: build
    if: github.event_name != 'pull_request'
    runs-on: windows-latest # Authenticode signing (dll/exe) must run on Windows
    permissions:
      contents: read

    env:
      SignTenantId: 16076fdc-fcc1-4a15-b1ca-32c9a255900e
      SignClientId: a9d17a09-7120-475d-bae5-1b65594e95f9
      SignKeyVaultUrl: https://sc-datagridext-60d06b7d6.vault.azure.net/
      SignKeyVaultCertificate: DataGridExtSC

    steps:
    - name: Install .NET SDK
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 10.0.x

    - name: Download build artifacts
      uses: actions/download-artifact@v8
      with:
        name: BuildPackages
        path: ${{ runner.temp }}/BuildPackages

    - name: Install SignTool tool
      run: dotnet tool update --tool-path . --prerelease sign

    - name: Create signing file list
      shell: pwsh
      run: |
        @('**/DataGridExtensions.*') | Set-Content -Path "$env:RUNNER_TEMP\filelist.txt"

    - name: Sign packages
      shell: pwsh
      env:
        SignClientSecret: ${{ secrets.SIGN_CLIENT_SECRET }}
      run: |
        .\sign code azure-key-vault `
        "**/*.*" `
        --base-directory "$env:RUNNER_TEMP\BuildPackages" `
        --file-list "$env:RUNNER_TEMP\filelist.txt" `
        --publisher-name "tom-englert" `
        --description "DataGrid Extensions" `
        --description-url "https://github.com/dotnet/DataGridExtensions" `
        --azure-key-vault-tenant-id "$env:SignTenantId" `
        --azure-key-vault-client-id "$env:SignClientId" `
        --azure-key-vault-client-secret "$env:SignClientSecret" `
        --azure-key-vault-certificate "$env:SignKeyVaultCertificate" `
        --azure-key-vault-url "$env:SignKeyVaultUrl"

    - name: Publish signed packages
      uses: actions/upload-artifact@v7
      with:
        name: SignedPackages
        path: ${{ runner.temp }}/BuildPackages
        if-no-files-found: error

  publish:
    name: Prepare release assets
    needs: codesign
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: windows-latest

    steps:
    - uses: actions/checkout@v7

    - name: Verify tag matches version
      shell: pwsh
      run: |
        $version = ([xml](Get-Content src\Directory.Build.props)).Project.PropertyGroup.Version | Where-Object { $_ } | Select-Object -First 1
        $tag = '${{ github.ref_name }}' -replace '^v', ''
        if (-not $version) { throw 'Version not found in Directory.Build.props' }
        if ($tag -ne $version) { throw "Tag '$tag' does not match version '$version' in Directory.Build.props" }

    - name: Extract release notes
      shell: pwsh
      run: |
        $tag = "$env:GITHUB_REF_NAME".TrimStart('v')
        $notes = @()
        $found = $false
        foreach ($line in Get-Content ReleaseNotes.md) {
          if ($line.Trim() -match '^(\d+(\.\d+)*):?$') {
            if ($found) { break }
            if ($Matches[1] -eq $tag) { $found = $true }
            continue
          }
          if ($found) { $notes += $line }
        }
        $text = ($notes -join "`n").Trim()
        if (-not $text) { throw "Release notes for version '$tag' not found or empty in ReleaseNotes.md" }
        New-Item -ItemType Directory -Force publish-assets | Out-Null
        $text | Set-Content publish-assets/release-notes.txt

    - name: Upload publish assets
      uses: actions/upload-artifact@v7
      with:
        name: PublishAssets
        path: publish-assets
        if-no-files-found: error

  publish_nuget:
    name: Publish to NuGet
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      id-token: write

    steps:
    - name: Download signed packages
      uses: actions/download-artifact@v8
      with:
        name: SignedPackages
        path: packages

    - name: NuGet login (OIDC)
      id: login
      uses: NuGet/login@v1
      with:
        user: tom-englert

    - name: Push to nuget.org
      run: dotnet nuget push "packages/**/*.nupkg" --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate

  release:
    name: Create GitHub Release
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - uses: actions/download-artifact@v8
      with:
        path: artifacts

    - name: Create release
      uses: softprops/action-gh-release@v3
      with:
        draft: false
        body_path: artifacts/PublishAssets/release-notes.txt
        files: artifacts/SignedPackages/*.nupkg