build.yml

name: build

on:
  push:
    branches: [ main ]
    tags: [ v* ]
    paths-ignore:
      - '**/*.gitattributes'
      - '**/*.gitignore'
      - '**/*.md'
  pull_request:
    branches:
      - main
      - dotnet-vnext
      - dotnet-nightly
  workflow_dispatch:

env:
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_NOLOGO: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_SYSTEM_CONSOLE_ALLOW_ANSI_COLOR_REDIRECTION: 1
  NUGET_XMLDOC_MODE: skip
  TERM: xterm

permissions:
  contents: read

jobs:
  build:
    name: ${{ matrix.os }}
    runs-on: ${{ matrix.os }}

    outputs:
      dotnet-sdk-version: ${{ steps.setup-dotnet.outputs.dotnet-version }}
      dotnet-validate-version: ${{ steps.get-dotnet-validate-version.outputs.dotnet-validate-version }}
      package-names: ${{ steps.build.outputs.package-names }}
      package-version: ${{ steps.build.outputs.package-version }}

    permissions:
      attestations: write
      contents: write
      id-token: write

    strategy:
      fail-fast: false
      matrix:
        os: [ macos-latest, ubuntu-latest, windows-latest ]
        include:
          - os: macos-latest
            os-name: macos
          - os: ubuntu-latest
            os-name: linux
          - os: windows-latest
            os-name: windows

    steps:

    - name: Checkout code
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4.0.0
      id: setup-dotnet

    - name: Setup NuGet cache
      uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
      with:
        path: ~/.nuget/packages
        key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props') }}
        restore-keys: ${{ runner.os }}-nuget-

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
      if: |
        github.event.repository.fork == false &&
        !contains('["costellobot[bot]", "dependabot[bot]", "github-actions[bot]"]', github.actor)
      with:
        role-to-assume: arn:aws:iam::492538393790:role/github-actions-test
        role-session-name: ${{ github.event.repository.name }}-${{ github.run_id }}-build
        aws-region: eu-west-2

    - name: Build, Test and Package
      id: build
      shell: pwsh
      run: ./build.ps1

    - name: Upload coverage to Codecov
      uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
      with:
        file: ./artifacts/coverage/coverage.net8.0.cobertura.xml
        flags: ${{ matrix.os-name }}
        token: ${{ secrets.CODECOV_TOKEN }}

    - name: Generate SBOM
      uses: anchore/sbom-action@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0
      if: runner.os != 'Windows' # HACK Disabled due to https://github.com/anchore/sbom-action/issues/472
      with:
        artifact-name: build-${{ matrix.os-name }}.spdx.json
        output-file: ./artifacts/build.spdx.json
        path: ./artifacts/bin
        upload-release-assets: ${{ runner.os == 'Windows' }}

    - name: Attest artifacts
      uses: actions/attest-build-provenance@bdd51370e0416ac948727f861e03c2f05d32d78e # v1.3.2
      if: |
        runner.os == 'Windows' &&
        github.event.repository.fork == false &&
        (github.ref_name == github.event.repository.default_branch || startsWith(github.ref, 'refs/tags/v'))
      with:
        subject-path: |
          ./artifacts/bin/MartinCostello.Testing.AwsLambdaTestServer/release*/*.dll
          ./artifacts/package/release/*

    - name: Publish artifacts
      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
      with:
        name: artifacts-${{ matrix.os-name }}
        path: ./artifacts

    - name: Publish NuGet packages
      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
      with:
        name: packages-${{ matrix.os-name }}
        path: ./artifacts/package/release
        if-no-files-found: error

    - name: Get dotnet-validate version
      id: get-dotnet-validate-version
      shell: pwsh
      run: |
        $dotnetValidateVersion = (Get-Content "./.config/dotnet-tools.json" | Out-String | ConvertFrom-Json).tools.'dotnet-validate'.version
        "dotnet-validate-version=${dotnetValidateVersion}" >> $env:GITHUB_OUTPUT

  validate-packages:
    needs: build
    runs-on: ubuntu-latest
    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4.0.0
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Validate NuGet packages
      shell: pwsh
      env:
        DOTNET_VALIDATE_VERSION: ${{ needs.build.outputs.dotnet-validate-version }}
      run: |
        dotnet tool install --global dotnet-validate --version ${env:DOTNET_VALIDATE_VERSION}
        $packages = Get-ChildItem -Filter "*.nupkg" | ForEach-Object { $_.FullName }
        $invalidPackages = 0
        foreach ($package in $packages) {
          dotnet validate package local $package
          if ($LASTEXITCODE -ne 0) {
            $invalidPackages++
          }
        }
        if ($invalidPackages -gt 0) {
          Write-Output "::error::$invalidPackages NuGet package(s) failed validation."
          exit 1
        }

  publish-feedz-io:
    needs: [ build, validate-packages ]
    runs-on: ubuntu-latest
    if: |
      github.event.repository.fork == false &&
      (github.ref_name == github.event.repository.default_branch ||
       startsWith(github.ref, 'refs/tags/v'))
    environment:
      name: feedz.io
      url: https://feedz.io/org/${{ github.repository_owner }}/repository/lambda-test-server/packages/MartinCostello.Testing.AwsLambdaTestServer

    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4.0.0
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Push NuGet packages to feedz.io
      shell: bash
      env:
        API_KEY: ${{ secrets.FEEDZ_IO_TOKEN }}
        SOURCE: "https://f.feedz.io/${{ github.repository }}/nuget/index.json"
      run: dotnet nuget push "*.nupkg" --api-key "${API_KEY}" --skip-duplicate --source "${SOURCE}"

  publish-nuget:
    needs: [ build, validate-packages ]
    runs-on: ubuntu-latest
    if: |
      github.event.repository.fork == false &&
      startsWith(github.ref, 'refs/tags/v')

    environment:
      name: NuGet.org
      url: https://www.nuget.org/packages/MartinCostello.Testing.AwsLambdaTestServer

    steps:

    - name: Download packages
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: packages-windows

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4.0.0
      with:
        dotnet-version: ${{ needs.build.outputs.dotnet-sdk-version }}

    - name: Push NuGet packages to NuGet.org
      shell: bash
      env:
        API_KEY: ${{ secrets.NUGET_TOKEN }}
        SOURCE: https://api.nuget.org/v3/index.json
      run: dotnet nuget push "*.nupkg" --api-key "${API_KEY}" --skip-duplicate --source "${SOURCE}"

    - name: Publish nuget_packages_published
      uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
      with:
        event-type: nuget_packages_published
        repository: ${{ github.repository_owner }}/github-automation
        token: ${{ secrets.COSTELLOBOT_TOKEN }}
        client-payload: |-
          {
            "repository": "${{ github.repository }}",
            "packages": "${{ needs.build.outputs.package-names }}",
            "version": "${{ needs.build.outputs.package-version }}"
          }