build.yml

name: Build

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
  workflow_dispatch:

# Read only by default. The publish job asks for the OIDC token it needs itself.
permissions:
  contents: read

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_NOLOGO: true

jobs:
  build:
    runs-on: windows-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up .NET
        uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      # Keyed on everything that decides the package graph. restore-keys lets a changed graph start
      # from the previous cache rather than empty.
      - name: Cache NuGet packages
        uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('global.json', '**/Directory.Packages.props', '**/Directory.Build.props', '**/*.csproj', '**/*.fsproj') }}
          restore-keys: nuget-${{ runner.os }}-

      # The tag is the version: tag 1.2.3 (or v1.2.3) builds 1.2.3. Other builds use the
      # Version in Directory.Build.props.
      - name: Resolve the version from the tag
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
        run: echo "VERSION_ARGUMENT=-p:Version=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Build
        run: dotnet build src --configuration Release ${{ env.VERSION_ARGUMENT }}

      - name: Test
        run: dotnet test --solution src/Verify.TestableIO.System.IO.Abstractions.slnx --configuration Release --no-build --no-restore

      - name: Upload received on failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: received
          path: '**/*.received.*'
          if-no-files-found: ignore
          retention-days: 14

      - name: Upload packages
        if: success()
        uses: actions/upload-artifact@v7
        with:
          name: nupkgs
          path: nugets/**/*.nupkg
          if-no-files-found: warn
          retention-days: 30

  # Trusted publishing: no stored API key. nuget.org validates GitHub's OIDC token against the
  # policy naming this repository and this workflow file, and returns a key good for an hour.
  publish:
    needs: build
    environment: nuget
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download packages
        uses: actions/download-artifact@v8
        with:
          name: nupkgs
          path: packages

      - name: NuGet login
        id: login
        uses: NuGet/login@v1
        with:
          user: SimonCropp

      - name: Push to nuget.org
        run: >
          dotnet nuget push "packages/**/*.nupkg"
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate