Skip to content

Commit 3da4a2a

Browse files
bart-vmwarebart-vmware
committed
Create package.yml, fix build for stable release
1 parent c154c4f commit 3da4a2a

File tree

5 files changed

+291
-102
lines changed

5 files changed

+291
-102
lines changed

‎.github/workflows/Steeltoe.All.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ jobs:
3030
name: Build and Test
3131
timeout-minutes: 30
3232
strategy:
33+
fail-fast: false
3334
matrix:
3435
os: [ubuntu-latest, windows-latest, macos-latest]
3536
include:

‎.github/workflows/package.yml‎

Lines changed: 288 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,300 @@ on:
88
- '[0-9]+.x'
99
- 'release/*'
1010
pull_request:
11+
release:
12+
types:
13+
- published
1114

1215
concurrency:
1316
group: ${{ github.workflow }}-${{ github.ref }}
1417
cancel-in-progress: true
1518

19+
permissions:
20+
contents: read
21+
22+
env:
23+
DOTNET_CLI_TELEMETRY_OPTOUT: 1
24+
DOTNET_NOLOGO: true
25+
SOLUTION_FILE: 'src/Steeltoe.All.sln'
26+
VERSION_FILE: 'shared-package.props'
27+
# TODO: Consider defining these inside the applicable jobs.
28+
AZURE_ARTIFACTS_FEED_URL: https://pkgs.dev.azure.com/dotnet/Steeltoe/_packaging/dev/nuget/v3/index.json
29+
VSS_NUGET_URI_PREFIXES: https://pkgs.dev.azure.com/dotnet/
30+
1631
jobs:
17-
empty:
18-
name: Empty job
32+
build:
33+
name: Build
34+
timeout-minutes: 15
1935
runs-on: ubuntu-latest
2036

2137
steps:
22-
- name: Empty step
23-
run: echo "Packaging using GitHub Actions is not yet implemented."
38+
- name: Setup .NET
39+
uses: actions/setup-dotnet@v4
40+
with:
41+
dotnet-version: |
42+
8.0.*
43+
9.0.*
44+
45+
- name: Git checkout
46+
uses: actions/checkout@v4
47+
48+
- name: Restore packages
49+
run: dotnet restore ${{ env.SOLUTION_FILE }} --verbosity minimal
50+
51+
- name: Calculate package version (for release)
52+
if: ${{ github.event_name == 'release' }}
53+
env:
54+
TAG_NAME: ${{ github.ref_name }}
55+
shell: pwsh
56+
run: |
57+
# Get the version suffix from the git tag. For example: '1.2.3-preview1-final' => 'preview1-final'
58+
$tagSegments = '${{ env.TAG_NAME }}' -split '-'
59+
$versionPrefix = $tagSegments[0]
60+
$versionSuffix = $tagSegments.Length -eq 1 ? '' : $tagSegments[1..$($tagSegments.Length - 1)] -join '-'
61+
62+
[xml]$xml = Get-Content $env:VERSION_FILE
63+
$configuredVersionPrefix = $xml.Project.PropertyGroup.VersionPrefix | Select-Object -First 1
64+
65+
if ($configuredVersionPrefix -ne $versionPrefix) {
66+
Write-Error "Version prefix from git release tag '$versionPrefix' does not match version prefix '$configuredVersionPrefix' stored in $env:VERSION_FILE."
67+
# To recover from this:
68+
# - Delete the GitHub release
69+
# - Run: git push --delete origin the-invalid-tag-name
70+
# - Adjust VersionPrefix in file, commit and push
71+
# - Recreate the GitHub release
72+
}
73+
74+
Write-Output "Using version suffix: $versionSuffix"
75+
Write-Output "PACKAGE_VERSION_SUFFIX=$versionSuffix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
76+
77+
- name: Calculate package version (for branch)
78+
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
79+
env:
80+
BRANCH_NAME: ${{ github.ref_name }}
81+
shell: pwsh
82+
run: |
83+
# Get the version suffix from the branch name and auto-incrementing build number. For example: 'main' and '123' => 'main-00123'
84+
$revision = "{0:D5}" -f ${{ github.run_number }}
85+
$branchName = '${{ env.BRANCH_NAME }}'
86+
$safeBranchName = $branchName -Replace '[^a-zA-Z0-9_]', '-'
87+
$versionSuffix = "$safeBranchName-$revision"
88+
89+
Write-Output "Using version suffix: $versionSuffix"
90+
Write-Output "PACKAGE_VERSION_SUFFIX=$versionSuffix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
91+
92+
- name: Calculate package version (for pr)
93+
if: ${{ github.event_name == 'pull_request' }}
94+
shell: pwsh
95+
run: |
96+
# Get the version suffix from the PR number and auto-incrementing build number. For example: '18' and '123' => 'pr18-00123'
97+
$revision = "{0:D5}" -f ${{ github.run_number }}
98+
$versionSuffix = "pr${{ github.event.number }}-$revision"
99+
100+
Write-Output "Using version suffix: $versionSuffix"
101+
Write-Output "PACKAGE_VERSION_SUFFIX=$versionSuffix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
102+
103+
- name: Verify package version
104+
if: ${{ env.PACKAGE_VERSION_SUFFIX == '' && github.event_name != 'release' }}
105+
run: |
106+
echo "Package version suffix is empty. This should never happen."
107+
exit 1
108+
109+
- name: Build solution
110+
run: dotnet build ${{ env.SOLUTION_FILE }} --no-restore --configuration Release --verbosity minimal /p:VersionSuffix=${{ env.PACKAGE_VERSION_SUFFIX }}
111+
112+
- name: Collect packages
113+
run: dotnet pack ${{ env.SOLUTION_FILE }} --no-build --configuration Release --output ${{ github.workspace }}/packages /p:VersionSuffix=${{ env.PACKAGE_VERSION_SUFFIX }}
114+
115+
- name: Upload unsigned packages
116+
uses: actions/upload-artifact@v4
117+
with:
118+
if-no-files-found: error
119+
name: unsigned-packages
120+
path: ${{ github.workspace }}/packages/**/*.nupkg
121+
122+
sign:
123+
name: Sign
124+
if: ${{ github.event_name != 'pull_request' }}
125+
timeout-minutes: 15
126+
needs: build
127+
runs-on: windows-latest
128+
environment: signing
129+
# TODO: Can we move the additional permissions into the step that needs it (assuming there's only one)?
130+
permissions:
131+
id-token: write
132+
133+
steps:
134+
- name: Download unsigned packages
135+
uses: actions/download-artifact@v4
136+
with:
137+
name: unsigned-packages
138+
path: packages
139+
140+
- name: Setup .NET
141+
uses: actions/setup-dotnet@v4
142+
with:
143+
dotnet-version: 8.0.*
144+
145+
- name: Install code signing tool
146+
run: dotnet tool install --global sign --prerelease
147+
148+
- name: Azure login
149+
uses: azure/login@v2
150+
with:
151+
client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
152+
tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
153+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
154+
155+
- name: Sign packages
156+
run: |
157+
sign code azure-key-vault '**/*.nupkg'
158+
--base-directory '${{ github.workspace }}/packages'
159+
--azure-key-vault-managed-identity true
160+
--azure-credential-type 'azure-cli'
161+
--azure-key-vault-url '${{ secrets.AZURE_KEY_VAULT_URL }}'
162+
--azure-key-vault-certificate '${{ secrets.AZURE_KEY_VAULT_CERTIFICATE_ID }}'
163+
--publisher-name 'Steeltoe'
164+
--description 'Steeltoe'
165+
--description-url 'https://steeltoe.io/'
166+
167+
- name: Upload signed packages
168+
uses: actions/upload-artifact@v4
169+
with:
170+
if-no-files-found: error
171+
name: signed-packages
172+
path: ${{ github.workspace }}/packages/**/*.nupkg
173+
174+
# TODO: What happens when a package version exists in both feeds?
175+
dev-feed-deploy:
176+
name: Deploy packages to development feed
177+
timeout-minutes: 15
178+
needs: sign
179+
if: ${{ github.event_name != 'pull_request' }}
180+
environment: azdo
181+
runs-on: ubuntu-latest
182+
# TODO: Can we move the additional permissions into the step that needs it (assuming there's only one)?
183+
permissions:
184+
id-token: write
185+
186+
steps:
187+
- uses: actions/checkout@v4
188+
# TODO: Why do we need a token here?
189+
with:
190+
token: ${{ secrets.GITHUB_TOKEN }}
191+
192+
- name: Azure login
193+
uses: azure/login@v2
194+
with:
195+
# TODO: Are we happy with the names of these secrets, or should we rename to distinguish between signing/keyvault/foundation/azdo? Because "Azure" is pretty vague.
196+
# TODO: Verify we have no redundant variables and secrets in GitHub org/repo/environment settings.
197+
client-id: ${{ secrets.AZURE_KEY_VAULT_CLIENT_ID }}
198+
tenant-id: ${{ secrets.AZURE_KEY_VAULT_TENANT_ID }}
199+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
200+
201+
- name: Download signed packages
202+
uses: actions/download-artifact@v4
203+
with:
204+
name: signed-packages
205+
path: packages
206+
207+
- name: Setup .NET
208+
uses: actions/setup-dotnet@v4
209+
with:
210+
dotnet-version: 8.0.x
211+
# TODO: Can this be replaced with: dotnet nuget add source ...
212+
source-url: ${{ env.AZURE_ARTIFACTS_FEED_URL }}
213+
env:
214+
NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
215+
216+
- name: Install credential provider for Azure Artifacts
217+
run: sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"
218+
219+
- name: Extract access token
220+
# TODO: What does this GUID mean? Should it be a repo or org-level secret, variable, or an inline constant to clarify its meaning?
221+
run: |
222+
accessToken=$(az account get-access-token --query accessToken --resource 499b84ac-1321-427f-aa17-267ca6975798 -o tsv)
223+
echo "::add-mask::$accessToken"
224+
echo "ACCESS_TOKEN=$accessToken" >> $GITHUB_ENV
225+
226+
- name: Configure authentication provider to use Azure DevOps token
227+
run: echo "VSS_NUGET_ACCESSTOKEN=$ACCESS_TOKEN" >> $GITHUB_ENV
228+
229+
- name: Push packages to Azure Artifacts
230+
# TODO: What's the meaning of azdo-placeholder?
231+
run: dotnet nuget push '${{ github.workspace }}/packages/*.nupkg' --api-key 'azdo-placeholder' --source '${{ env.AZURE_ARTIFACTS_FEED_URL }}'
232+
233+
nuget-org-deploy:
234+
name: Deploy packages to nuget.org
235+
timeout-minutes: 15
236+
needs: sign
237+
if: ${{ github.event_name == 'release' }}
238+
environment: nuget.org
239+
runs-on: ubuntu-latest
240+
steps:
241+
- name: Setup .NET
242+
uses: actions/setup-dotnet@v4
243+
with:
244+
dotnet-version: 8.0.x
245+
246+
- name: Download signed packages
247+
uses: actions/download-artifact@v4
248+
with:
249+
name: signed-packages
250+
path: packages
251+
252+
- name: Push packages to nuget.org
253+
run: dotnet nuget push '${{ github.workspace }}/packages/*.nupkg' --api-key '${{ secrets.STEELTOE_NUGET_API_KEY }}' --source 'nuget.org'
254+
255+
open_pr:
256+
name: Open pull request to bump Steeltoe version after release
257+
needs: nuget-org-deploy
258+
timeout-minutes: 15
259+
runs-on: ubuntu-latest
260+
# TODO: Can we move the additional permissions into the step that needs it (assuming there's only one)?
261+
permissions:
262+
contents: write
263+
pull-requests: write
264+
265+
steps:
266+
- name: Git checkout
267+
uses: actions/checkout@v4
268+
269+
- name: Calculate next package version
270+
shell: pwsh
271+
run: |
272+
[xml]$xml = Get-Content $env:VERSION_FILE
273+
$oldVersionPrefix = $xml.Project.PropertyGroup.VersionPrefix | Select-Object -First 1
274+
275+
$versionSegments = $oldVersionPrefix.split('.')
276+
([int]$versionSegments[-1])++
277+
$newVersionPrefix = $versionSegments -join('.')
278+
279+
Write-Output "OLD_PACKAGE_VERSION_PREFIX=$oldVersionPrefix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
280+
Write-Output "NEW_PACKAGE_VERSION_PREFIX=$newVersionPrefix" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
281+
282+
- name: Open pull request
283+
env:
284+
GIT_USERNAME: ${{ github.actor }}
285+
GH_TOKEN: ${{ github.token }}
286+
shell: pwsh
287+
run: |
288+
$oldVersionPrefix = '${{ env.OLD_PACKAGE_VERSION_PREFIX }}'
289+
$newVersionPrefix = '${{ env.NEW_PACKAGE_VERSION_PREFIX }}'
290+
$prBranchName = "bump-version-to-$newVersionPrefix-${{ github.run_number }}"
291+
$commitMessage = "Bump Steeltoe version from $oldVersionPrefix to $newVersionPrefix."
292+
293+
$pattern = '(?<left>^\s*\<VersionPrefix\>)[^>]+(?<right>\<\/VersionPrefix\>)\s*$'
294+
$fileContent = Get-Content $env:VERSION_FILE
295+
$fileContent = $fileContent -Replace $pattern,"`${left}$newVersionPrefix`${right}"
296+
Set-Content $fileContent -Path $env:VERSION_FILE
297+
298+
Write-Output "Creating pull request for commit: $commitMessage"
299+
git config --global user.name '${{ env.GIT_USERNAME }}'
300+
git config --global user.email '${{ env.GIT_USERNAME }}@noreply.github.com'
301+
git checkout -b $prBranchName
302+
git add -A
303+
git commit -m $commitMessage
304+
git push --set-upstream origin $prBranchName
305+
306+
Write-Output "Opening pull request to merge $prBranchName."
307+
gh pr create --head $prBranchName --title 'Bump Steeltoe version' --body $commitMessage

‎.github/workflows/verify-code-style.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ jobs:
5858
dotnet regitlint -s ${{ env.SOLUTION_FILE }} --print-command --skip-tool-check --max-runs=5 --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN -f commits -a $headCommitHash -b $baseCommitHash --fail-on-diff --print-diff
5959
6060
- name: CleanupCode (on branch)
61-
if: ${{ github.event_name == 'push' || github.event_name == 'release' }}
61+
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'release' }}
6262
shell: pwsh
6363
run: |
6464
Write-Output "Running code cleanup on all files."

0 commit comments

Comments
 (0)