release.yml

name: Release

# Only fires on a vX.Y.Z tag push - matches version.json's publicReleaseRefSpec, so
# Nerdbank.GitVersioning treats that tag as the actual release version rather than a
# git-height-suffixed prerelease. Pushing this tag is the only thing that starts this workflow;
# nothing in CI (ci.yml) can trigger it.
on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write

jobs:
  build-test-pack:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.value }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true # belt-and-braces so a tagged commit's tags are always visible to NBGV

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "8.0.x"

      - name: Restore
        run: dotnet restore

      - name: Set version
        uses: dotnet/nbgv@master
        id: nbgv

      - name: Build
        run: dotnet build --configuration Release --no-restore

      # Same safety gate as CI: a release tag does not skip the test suite.
      - name: Test
        run: dotnet test --configuration Release --no-build

      - name: Pack
        run: dotnet pack src/Monnify/Monnify.csproj --configuration Release --no-build --output ./artifacts

      - name: Read package version
        id: version
        run: echo "value=$(ls ./artifacts/*.nupkg | head -n1 | sed -E 's/.*Monnify\.([0-9].*)\.nupkg/\1/')" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@v7
        with:
          name: nupkg
          path: ./artifacts/*.nupkg

  # Requires manual approval before this job runs: configure a GitHub Environment named
  # "nuget-release" (Settings > Environments) with required reviewers. Publishing uses NuGet
  # Trusted Publishing (OIDC) - no NUGET_API_KEY secret needed. The matching trusted publishing
  # policy on nuget.org must have Repository Owner=Monnify, Repository=monnify-dotnet-lib,
  # Workflow File=release.yml, Environment=nuget-release, so a token is only trusted if it came
  # from a run of this exact workflow that passed through this exact (approval-gated) environment.
  publish:
    needs: build-test-pack
    runs-on: ubuntu-latest
    environment: nuget-release
    permissions:
      id-token: write # required to request the GitHub OIDC token for NuGet Trusted Publishing
      contents: write # required by softprops/action-gh-release to create the GitHub Release
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: nupkg
          path: ./artifacts

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: "8.0.x"

      # Exchanges the GitHub OIDC token for a short-lived (~1hr) NuGet API key - nothing
      # long-lived is stored as a secret. NUGET_USER is just the nuget.org profile username
      # (not the account email), kept as a secret only so it's not hardcoded here.
      - name: NuGet login (OIDC -> temp API key)
        uses: NuGet/login@v1
        id: nuget_login
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to NuGet.org
        run: dotnet nuget push "./artifacts/*.nupkg" --api-key "${{ steps.nuget_login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate

      # release-please creates this release as a draft (see release-please.yml) when its
      # Release PR merges, so the tag exists without anything publicly visible yet. This step
      # finds that same release by tag and un-drafts it - only after a successful, approved
      # NuGet push - rather than creating a second one.
      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          name: v${{ needs.build-test-pack.outputs.version }}
          files: ./artifacts/*.nupkg
          generate_release_notes: true
          draft: false