dotnet-main.yml

name: .NET main

on:
  push:
    branches: ["main"]
  workflow_dispatch:

env:
  DEFAULT_DOTNET_VERSION: "8.0.x"

jobs:
  build:
    strategy:
      matrix:
        os: [
            windows-latest,
            ubuntu-latest,
            #, macos-latest
          ]
      fail-fast: false
    runs-on: "${{ matrix.os }}"
    env:
      DOTNET_CONFIGURATION: Release

    steps:
      - uses: actions/checkout@v4
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: |
            ${{ env.DEFAULT_DOTNET_VERSION }}
            9.0.x
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install Uvicorn
        run: |
          python -m pip install --upgrade pip
          pip install uvicorn
      - uses: actions/setup-go@v5
        name: Set up Go
        with:
          go-version: "^1.22.1"
          cache-dependency-path: |
            ./**/go.sum
      - uses: actions/setup-java@v4
        name: Set up Java
        with:
          distribution: "microsoft"
          java-version: "21"
      - uses: actions/setup-node@v4
        name: Set up Node.js
        with:
          node-version: "latest"

      - uses: pnpm/action-setup@v4
        name: Setup pnpm
        with:
          version: 9
          run_install: false

      - uses: denoland/setup-deno@v2
        name: Setup Deno
        with:
          deno-version: v2.x

      - uses: oven-sh/setup-bun@v2
        name: Setup Bun
        with:
          bun-version: latest

      - uses: actions/cache@v4
        name: Cache NuGet packages
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-
      - uses: actions/cache@v4
        name: Cache Java Docker images
        with:
          path: /var/lib/docker/image
          key: ${{ runner.os }}-docker-${{ hashFiles('examples/java/CommunityToolkit.Aspire.Hosting.Java.Spring.Maven/Dockerfile') }}
          restore-keys: |
            ${{ runner.os }}-docker-

      - name: Get NPM package root
        id: npm-root
        run: "echo path=$(npm root -g) >> $GITHUB_OUTPUT"
        shell: bash

      - uses: actions/cache@v4
        name: Cache global npm packages
        with:
          path: ${{ steps.npm-root.outputs.path }}
          key: ${{ runner.os }}-npm-${{ hashFiles('.github/workflows/dotnet-main.yml') }}
          restore-keys: |
            ${{ runner.os }}-npm-

      - uses: Swatinem/rust-cache@v2
        name: Cache Rust packages
        with:
          workspaces: "examples/rust/actix_api -> target"

      - name: Setup .NET dev certs
        if: ${{ matrix.os == 'ubuntu-latest' }}
        run: |
          dotnet tool update -g linux-dev-certs
          dotnet linux-dev-certs install
      - name: Setup Node projects
        run: |
          npm install -g @azure/static-web-apps-cli
          cd examples/swa/CommunityToolkit.Aspire.StaticWebApps.WebApp
          npm ci

      - name: Restore dependencies
        run: dotnet restore
      - name: Build
        run: dotnet build --no-restore --configuration ${{ env.DOTNET_CONFIGURATION }}
      - name: Test
        run: dotnet test --no-build --configuration ${{ env.DOTNET_CONFIGURATION }} --collect "XPlat Code Coverage" --results-directory test-results --logger trx /p:TrxLogFileNameSuffix=${{ matrix.os }}

      - name: Publish NuGet package
        run: dotnet pack --no-build -c ${{ env.DOTNET_CONFIGURATION }} -o ./nuget -p:VersionSuffix='beta.${{ github.run_number }}'

      - name: Publish NuGet packages as artifacts
        uses: actions/upload-artifact@v4
        if: ${{ matrix.os == 'ubuntu-latest' }}
        with:
          name: nuget-packages
          path: ./nuget

      - name: Upload Package List
        uses: actions/upload-artifact@v4
        if: ${{ matrix.os == 'ubuntu-latest' }}
        with:
          name: nuget-list
          if-no-files-found: error
          path: |
            ${{ github.workspace }}/.github/workflows/SignClientFileList.txt

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results-${{ matrix.os }}
          path: |
            ${{ github.workspace }}/test-results/**

      - name: List NuGet packages in step summary
        if: ${{ matrix.os == 'ubuntu-latest' }}
        run: ls -1 ${{ github.workspace }}/nuget/*.nupkg >> $GITHUB_STEP_SUMMARY

  test-reporting:
    permissions:
      contents: read
      actions: read
      checks: write
    runs-on: ubuntu-latest
    needs: build
    if: ${{ always() }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true

      - name: Test Report
        uses: dorny/test-reporter@v1
        if: success() || failure()
        with:
          name: ".NET Tests"
          path: "*.trx"
          reporter: dotnet-trx

  sign:
    needs: build
    runs-on: windows-latest
    permissions:
      id-token: write # Required for requesting the JWT

    steps:
      - name: Install .NET SDK v${{ env.DEFAULT_DOTNET_VERSION }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DEFAULT_DOTNET_VERSION }}

      - name: Download Package List
        uses: actions/download-artifact@v4
        with:
          name: nuget-packages
          path: ${{ github.workspace }}/packages

      - name: Download NuGet package list
        uses: actions/download-artifact@v4
        with:
          name: nuget-list
          path: ${{ github.workspace }}

      - name: Install Signing Tool
        run: dotnet tool install --tool-path ./tools sign --version 0.9.1-beta.23356.1

      - name: Sign Packages
        run: >
          ./tools/sign code azure-key-vault
          **/*.nupkg
          --base-directory "${{ github.workspace }}/packages"
          --file-list "${{ github.workspace }}/SignClientFileList.txt"
          --timestamp-url "http://timestamp.digicert.com"
          --publisher-name ".NET Foundation"
          --description ".NET Aspire Community Toolkit"
          --description-url "https://github.com/CommunityToolkit/Aspire"
          --azure-key-vault-url "${{ secrets.SIGN_KEY_VAULT_URL }}"
          --azure-key-vault-client-id ${{ secrets.SIGN_CLIENT_ID }}
          --azure-key-vault-client-secret "${{ secrets.SIGN_CLIENT_SECRET }}"
          --azure-key-vault-tenant-id ${{ secrets.SIGN_TENANT_ID }}
          --azure-key-vault-certificate "${{ secrets.SIGN_CERTIFICATE }}"
          --verbosity Information

      - name: Upload Signed Packages as Artifacts (for release)
        uses: actions/upload-artifact@v4
        with:
          name: signed-nuget-packages
          if-no-files-found: error
          path: |
            ${{ github.workspace }}/packages/**/*.nupkg

  publish-nuget:
    needs: sign
    runs-on: ubuntu-latest
    environment:
      name: nuget-beta
    steps:
      - name: Download package
        uses: actions/download-artifact@v4
        with:
          name: signed-nuget-packages

      - name: Publish to NuGet
        run: dotnet nuget push ./*.nupkg --source "https://api.nuget.org/v3/index.json" --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }}

  publish-azure-artifacts:
    needs: sign
    runs-on: windows-latest
    environment:
      name: azure-artifacts
    steps:
      - name: Download package
        uses: actions/download-artifact@v4
        with:
          name: signed-nuget-packages

      - name: Add AzDO NuGet feed
        run: >
          dotnet nuget add source 
          https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-MainLatest/nuget/v3/index.json
          --name MainLatest
          --username dummy
          --password ${{ secrets.DEVOPS_PACKAGE_PUSH_TOKEN }}

      - name: Push signed packages to AzDO
        run: >
          dotnet nuget push 
          "${{ github.workspace }}/**/*.nupkg" 
          --api-key dummy 
          --source MainLatest 
          --skip-duplicate

  publish-coverage:
    if: github.actor != 'dependabot[bot]'
    needs: build
    uses: ./.github/workflows/code-coverage.yml
    secrets: inherit