ci: route publish to NuGet.org for tags and GitHub Packages for previews; change version to 1.0.0

Author: Kapusch

.github/workflows/publish.yml

@@ -13,6 +13,10 @@ permissions:
 jobs:
   pack_and_publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -22,18 +26,48 @@ jobs:
         id: version
         shell: bash
         run: |
-          if [[ "${{ github.ref }}" =~ ^refs/tags/v ]]; then
-            REF="${{ github.ref }}"
+          REF="${{ github.ref }}"
+          EVENT="${{ github.event_name }}"
+          CSPROJ="src/Kapusch.FacebookApisForAndroidComponents/Kapusch.FacebookApisForAndroidComponents.csproj"
+          BASE_VERSION=$(grep -oE '<Version>[^<]+' "$CSPROJ" | head -n 1 | sed 's/<Version>//' || echo "0.1.0")
+
+          if [[ "$REF" =~ ^refs/tags/v ]]; then
             VERSION="${REF#refs/tags/v}"
+            PUBLISH_TARGET="nuget"
+
+            git fetch origin +refs/heads/*:refs/remotes/origin/*
+            TAGGED_SHA="${{ github.sha }}"
+            CONTAINING_BRANCHES=$(git for-each-ref --format='%(refname:short)' refs/remotes/origin --contains "$TAGGED_SHA")
+
+            ON_MASTER="false"
+            ON_RELEASE="false"
+            while IFS= read -r branch; do
+              [[ "$branch" == "origin/master" ]] && ON_MASTER="true"
+              [[ "$branch" == origin/release/* ]] && ON_RELEASE="true"
+            done <<< "$CONTAINING_BRANCHES"
+
+            if [[ "$VERSION" == *-* ]]; then
+              if [[ "$ON_RELEASE" != "true" ]]; then
+                echo "ERROR: Pre-release tag v$VERSION must point to a commit contained in origin/release/*"
+                exit 1
+              fi
+            else
+              if [[ "$ON_MASTER" != "true" ]]; then
+                echo "ERROR: Stable tag v$VERSION must point to a commit contained in origin/master"
+                exit 1
+              fi
+            fi
           else
-            CSPROJ="src/Kapusch.FacebookApisForAndroidComponents/Kapusch.FacebookApisForAndroidComponents.csproj"
-            BASE_VERSION=$(grep -oE '<Version>[^<]+' "$CSPROJ" | head -n 1 | sed 's/<Version>//' || echo "0.1.0")
             COMMIT_SHORT=$(git rev-parse --short HEAD)
             RUN_NUMBER="${{ github.run_number }}"
-            VERSION="${BASE_VERSION}-prerelease.${RUN_NUMBER}.${COMMIT_SHORT}"
+            VERSION="${BASE_VERSION}-preview.${RUN_NUMBER}.${COMMIT_SHORT}"
+            PUBLISH_TARGET="github"
           fi
+
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "publish_target=${PUBLISH_TARGET}" >> "$GITHUB_OUTPUT"
           echo "Package version: ${VERSION}"
+          echo "Publish target: ${PUBLISH_TARGET}"
 
       - uses: actions/setup-dotnet@v4
         with:
@@ -72,7 +106,23 @@ jobs:
             -o artifacts/nuget \
             /p:PackageVersion="${{ steps.version.outputs.version }}"
 
+      - name: Push to NuGet.org
+        if: steps.version.outputs.publish_target == 'nuget'
+        uses: NuGet/login@v1
+        id: nuget_login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Push to NuGet.org
+        if: steps.version.outputs.publish_target == 'nuget'
+        run: |
+          dotnet nuget push artifacts/nuget/*.nupkg \
+            --api-key "${{ steps.nuget_login.outputs.NUGET_API_KEY }}" \
+            --source "https://api.nuget.org/v3/index.json" \
+            --skip-duplicate
+
       - name: Push to GitHub Packages
+        if: steps.version.outputs.publish_target == 'github'
         env:
           NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

README.md

@@ -41,10 +41,30 @@ Pack the NuGet:
 
 ## Consumption
 
-- Install the package from GitHub Packages (pre-release).
+- Install the package from NuGet.org for public release tags.
+- Install the package from GitHub Packages for internal preview builds.
 - Follow `Docs/Integration.md` for required AndroidManifest entries / meta-data.
 
 ## CI
 
 - PR CI is build-only.
-- Publishing is handled by a workflow that pushes a pre-release to GitHub Packages.
+- Publishing is handled by `.github/workflows/publish.yml` with channel routing:
+	- tag `vX.Y.Z` on `master` -> NuGet.org (stable)
+	- tag `vX.Y.Z-rc.N` on `release/*` -> NuGet.org (pre-release)
+	- non-tag runs (`workflow_dispatch`) -> GitHub Packages (`X.Y.Z-preview.<run>.<sha>`)
+- NuGet.org publishing uses NuGet Trusted Publishing (OIDC via `NuGet/login@v1`), no long-lived NuGet API key.
+
+### Required GitHub secret
+
+- `NUGET_USER`: your nuget.org profile username (not email), used by `NuGet/login@v1`.
+
+## Release examples
+
+- Pre-release candidate from a release branch:
+	- `git checkout release/1.0.0`
+	- `git tag v1.0.0-rc.1`
+	- `git push origin v1.0.0-rc.1`
+- Stable release from master:
+	- `git checkout master`
+	- `git tag v1.0.0`
+	- `git push origin v1.0.0`

src/Kapusch.FacebookApisForAndroidComponents/Kapusch.FacebookApisForAndroidComponents.csproj

@@ -15,7 +15,7 @@
     <NoWarn>$(NoWarn);NU5128</NoWarn>
     <AssemblyName>Kapusch.Facebook.Android</AssemblyName>
     <RootNamespace>Kapusch.Facebook.Android</RootNamespace>
-    <Version>0.1.0</Version>
+    <Version>1.0.0</Version>
     <PackageReadmeFile>nuget-readme.md</PackageReadmeFile>
     <InteropAndroidWrapperAar
       Condition="'$(InteropAndroidWrapperAar)' == '' and Exists('Native/Android/build/aar/kfb-facebookinterop-release.aar')"