build-template.yml

name: Build Templates

on:
  push:
    branches: [ main ]
    paths: [ 'templates/**', '.github/workflows/build-template.yml', '.github/workflows/SignedTemplateFileList.txt' ]
  pull_request:
    branches: [ main ]
    paths: [ 'templates/**', '.github/workflows/build-template.yml', '.github/workflows/SignedTemplateFileList.txt' ]
  release:
    types: [ published ]
  workflow_dispatch:

env:
  DOTNET_VERSION: '10.0.x'
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
  DOTNET_NOLOGO: true
  DOTNET_CONFIGURATION: 'Release'
  NuGetDirectory: ${{ github.workspace }}/nuget
  SolutionFile: 'Datasync Solution.sln'
  BASE_VERSION: '10.0.0'

permissions:
  pull-requests: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      - name: Get build version
        env:
          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          Import-Module .\tools\GetBuildVersion.psm1
          # github.ref / $env:GITHUB_REF can be empty on 'release' events (see #495), so use the
          # release's tag name directly instead of relying on ref resolution for that event.
          $refString = if ($env:GITHUB_EVENT_NAME -eq 'release') { "refs/tags/$($env:RELEASE_TAG_NAME)" } else { $env:GITHUB_REF }
          Write-Host "GitHub Reference = $refString"
          $version = GetBuildVersion -BaseVersion $env:BASE_VERSION -VersionString $refString -BuildNumber $env:GITHUB_RUN_NUMBER
          echo "BUILD_VERSION=$version" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf-8 -Append
          Write-Host "BUILD_VERSION=$version"
        shell: pwsh

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Generate csproj
        working-directory: templates/Template.DatasyncServer
        run: |
          Write-Host "BUILD_VERSION (env)=$($env:BUILD_VERSION)"
          (Get-Content -path "Template.DatasyncServer.csproj.template") -replace "{NUGET_VERSION}", $env:BUILD_VERSION | Set-Content -Path "./Template.DatasyncServer.csproj"
        shell: pwsh

      - name: Build template
        working-directory: templates
        run: >
          dotnet pack DatasyncTemplates.csproj 
          --configuration ${{ env.DOTNET_CONFIGURATION }} 
          --output ${{ env.NuGetDirectory }}
          -p:PackageVersion="$BUILD_VERSION"

      - name: Upload NuGet packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-unsigned
          if-no-files-found: error
          path: ${{ env.NuGetDirectory }}/*.nupkg
          retention-days: 7

      - name: Upload Package List
        uses: actions/upload-artifact@v7
        with:
          name: nuget-list
          if-no-files-found: error
          path: |
            ${{ github.workspace }}/.github/workflows/SignedTemplateFileList.txt

  sign:
    needs: [build]
    # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on
    # 'release' events (see #495), which previously caused this job to be silently skipped.
    if: >-
      ${{ github.event_name == 'release' ||
          (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
          (github.event_name == 'workflow_dispatch' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/'))) }}
    runs-on: windows-latest
    permissions:
      id-token: write

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Install signing tool
        run: dotnet tool install --tool-path ./tools sign --version 0.9.1-beta.23356.1

      - name: Download NuGet package list
        uses: actions/download-artifact@v8
        with:
          name: nuget-list
          path: ${{ github.workspace }}

      - name: Download unsigned NuGet packages
        uses: actions/download-artifact@v8
        with:
          name: nuget-unsigned
          path: ${{ github.workspace }}/packages

      - name: Sign NuGet packages
        run: >
          ./tools/sign code azure-key-vault
          **/*.nupkg
          --base-directory "${{ github.workspace }}/packages"
          --file-list "${{ github.workspace }}/SignedTemplateFileList.txt"
          --timestamp-url "http://timestamp.digicert.com"
          --publisher-name ".NET Foundation"
          --description "Community Datasync Toolkit"
          --description-url "https://github.com/CommunityToolkit/Datasync"
          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
          --azure-key-vault-client-id ${{ secrets.SIGN_CLIENT_ID }}
          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}"
          --azure-key-vault-tenant-id ${{ secrets.SIGN_TENANT_ID }}
          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}"
          --verbosity Information        

      - name: Upload signed NuGet packages
        uses: actions/upload-artifact@v7
        with:
          name: nuget-signed
          if-no-files-found: error
          path: ${{ github.workspace }}/packages/**/*.nupkg

      - name: Add AzDO NuGet feed
        run: >
          dotnet nuget add source 
          https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-MainLatest/nuget/v3/index.json 
          --name MainLatest
          --username dummy
          --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}

      - name: Push signed packages to AzDO
        run: >
          dotnet nuget push 
          "${{ github.workspace }}/packages/**/*.nupkg" 
          --api-key dummy 
          --source MainLatest 
          --skip-duplicate

  release:
    # Gate on the triggering event rather than github.ref: github.ref/GITHUB_REF can be empty on
    # 'release' events (see #495), which previously caused this job to be silently skipped.
    if: >-
      ${{ github.event_name == 'release' ||
          (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/')) }}
    needs: [ sign ]
    environment: nuget-release-gate
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
  
      - name: Download unsigned NuGet packages
        uses: actions/download-artifact@v8
        with:
          name: nuget-signed
          path: ${{ github.workspace }}/packages

      - name: NuGet login (OIDC)
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push signed packages to NuGet.org
        run: >
          dotnet nuget push
          ${{ github.workspace }}/packages/**/*.nupkg
          --source https://api.nuget.org/v3/index.json
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --skip-duplicate