build.yml

name: build

on:
  push:
    branches: [ dev*, rel/* ]
    tags: [ '*' ]
  pull_request:
    branches: [ dev*, rel/* ]
  workflow_dispatch:

env:
  DOTNET_MULTILEVEL_LOOKUP: 0
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
  DOTNET_SYSTEM_CONSOLE_ALLOW_ANSI_COLOR_REDIRECTION: 1
  NUGET_XMLDOC_MODE: skip
  TERM: xterm

permissions:
  contents: read

jobs:
  build:
    name: ${{ matrix.os }}
    runs-on: ${{ matrix.os }}

    outputs:
      dotnet-sdk-version: ${{ steps.setup-dotnet.outputs.dotnet-version }}

    permissions:
      attestations: write
      contents: read
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        os: [ macos-latest, ubuntu-latest, windows-latest ]
        include:
          - os: macos-latest
            os_name: macos
          - os: ubuntu-latest
            os_name: linux
          - os: windows-latest
            os_name: windows

    steps:
    - name: Checkout code
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
      id: setup-dotnet

    - name: Setup NuGet
      uses: nuget/setup-nuget@a21f25cd3998bf370fde17e3f1b4c12c175172f9 # v2.0.0
      with:
        nuget-version: '5.11.0'

    # Arcade only allows the revision to contain up to two characters, and GitHub Actions does not roll-over
    # build numbers every day like Azure DevOps does. To balance these two requirements, set the official
    # build ID to be the same format as the built-in default from Arcade, except with the revision number
    # being the number of the quarter hour of the current time of day (24 * 4 = 96, which is less than 100).
    # So a build between 00:00 and 00:14 would have a revision of 1, and a build between 23:45 and 23:59:59
    # would have a revision of 97.
    - name: Set Build ID
      if: ${{ startsWith(github.ref, 'refs/pull/') == false }}
      shell: pwsh
      run: |
        $Now = (Get-Date).ToUniversalTime()
        $Hours = $Now.Hour * 4
        $QuarterHours = [Math]::Floor($Now.Minute / 15.0)
        $Revision = $Hours + $QuarterHours + 1
        $BuildId = $Now.ToString("yyyyMMdd") + "." + $Revision
        Write-Output "_AspNetContribBuildNumber=${BuildId}" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

    - name: Build, Test and Package
      if: ${{ runner.os == 'Windows' }}
      run: eng\common\CIBuild.cmd -configuration Release -prepareMachine

    - name: Build, Test and Package
      shell: pwsh
      if: ${{ runner.os != 'Windows' }}
      run: ./eng/common/cibuild.sh -configuration Release -prepareMachine

    - name: Attest artifacts
      uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
      if: |
        runner.os == 'Windows' &&
        github.event.repository.fork == false &&
        (github.ref_name == github.event.repository.default_branch ||
         startsWith(github.ref, 'refs/heads/dev') ||
         startsWith(github.ref, 'refs/heads/rel/') ||
         startsWith(github.ref, 'refs/tags/'))
      with:
        subject-path: |
          ./artifacts/bin/AspNet.Security.*/Release/**/AspNet.Security.*.dll
          ./artifacts/packages/Release/Shipping/*

    - name: Publish logs
      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
      if: ${{ always() }}
      with:
        name: logs-${{ matrix.os_name }}
        path: ./artifacts/log/Release

    - name: Publish NuGet packages
      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
      with:
        name: packages-${{ matrix.os_name }}
        path: ./artifacts/packages/Release/Shipping

    - name: Publish test results
      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
      if: ${{ always() }}
      with:
        name: testresults-${{ matrix.os_name }}
        path: ./artifacts/TestResults/Release

  validate-packages:
    needs: build
    runs-on: ubuntu-latest
    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Validate NuGet packages
      shell: pwsh
      run: |
        dotnet tool install --global dotnet-validate --version 0.0.1-preview.304
        $packages = Get-ChildItem -Filter "*.nupkg" | ForEach-Object { $_.FullName }
        $invalidPackages = 0
        foreach ($package in $packages) {
          dotnet validate package local $package
          if ($LASTEXITCODE -ne 0) {
            $invalidPackages++
          }
        }
        if ($invalidPackages -gt 0) {
          Write-Output "::error::$invalidPackages NuGet package(s) failed validation."
          exit 1
        }

  publish-myget:
    needs: [ build, validate-packages ]
    runs-on: ubuntu-latest
    if: |
      github.event.repository.fork == false &&
      (github.ref_name == github.event.repository.default_branch ||
       startsWith(github.ref, 'refs/heads/dev') ||
       startsWith(github.ref, 'refs/heads/rel/') ||
       startsWith(github.ref, 'refs/tags/'))
    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Push NuGet packages to aspnet-contrib MyGet
      env:
        MYGET_API_KEY: ${{ secrets.MYGET_API_KEY }}
      run: nuget push "*.nupkg" -ApiKey "${MYGET_API_KEY}" -SkipDuplicate -Source https://www.myget.org/F/aspnet-contrib/api/v3/index.json

  publish-nuget:
    needs: [ build, validate-packages ]
    runs-on: ubuntu-latest
    if: |
      github.event.repository.fork == false &&
      startsWith(github.ref, 'refs/tags/')
    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Push NuGet packages to NuGet.org
      env:
        NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
      run: nuget push "*.nupkg" -ApiKey "${NUGET_API_KEY}" -SkipDuplicate -Source https://api.nuget.org/v3/index.json