Build.yml

name: Build

on:
  workflow_dispatch:
    inputs:
      skip-duplicates:
          description: 'Whether to fail or skip duplicates when uploading to a package repository'
          required: false
          default: 'true'
  pull_request:
    branches:
      - 'master'
      - 'release-*'
  push:
    branches: 
      - 'master'
      - 'beta'
      - 'release-*'

permissions:
  contents: read
  packages: write
  actions: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    env:
      GIT_REF: ${{ github.ref }}
      GIT_SHA: ${{ github.sha }}
      Configuration: Release
      SolutionFile: dotnet\DotNetStandardClasses.slnx
    
    runs-on: windows-latest

    outputs:
      NUGET_VERSION: ${{ steps.buildVariables.outputs.NUGET_PACKAGE_VERSION }}
      LAST_COMMITTER: ${{ steps.buildVariables.outputs.LAST_COMMITTER }}
      COMMIT_MESSAGE: ${{ steps.buildVariables.outputs.COMMIT_MESSAGE }}
      SHOULD_DEPLOY: ${{ steps.buildVariables.outputs.SHOULD_DEPLOY }}

    steps:
    - name: Checkout
      uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Install .NET 8
      uses: actions/setup-dotnet@v5
      with:
        dotnet-version: '8.0.100'

    - name: Install .NET 10
      uses: actions/setup-dotnet@v5
      with:
        dotnet-version: '10.0.x'

    - name: Calculate environment variables
      id: buildVariables
      run: |
        $IsMaster = $false

        switch -regex ($Env:GIT_REF) {
          'master' { 
            $IsPrerelease   = $true
            $IsMaster       = $true
            $SHOULD_DEPLOY  = 'true'
           }

          'beta' { 
            $IsPrerelease   = $true
            $SHOULD_DEPLOY  = 'true'
           }

          'release-*' {
            $IsPrerelease   = $false
            $SHOULD_DEPLOY  = 'true'
          }

          default {
            $IsPrerelease   = $false
            $SHOULD_DEPLOY  = 'false'
          }
        }

        $COMMIT_NUMBER = @($(git rev-list --count origin/master..), $(git rev-list --count HEAD))[$IsPrerelease]
        $COMMIT_MESSAGE = $(git log -1 --pretty=%B)
        $LAST_COMMITTER = $(git log -1 --pretty=format:%an)

        $GetFileVersionOutput = dotnet msbuild dotnet/Directory.Build.props /t:GetFileVersionForPackage /p:COMMIT_NUMBER=$COMMIT_NUMBER
        "$GetFileVersionOutput" -match "(?<=FileVersion:)(.*)" > $null
        $GetFileVersionOutput = $Matches[0]
        
        $NUGET_PACKAGE_VERSION = $GetFileVersionOutput
        
        if ($IsPrerelease -eq $true) {
          $VersionTag =  @("beta", "preview")[$IsMaster]
          $Timestamp = (Get-Date -AsUTC).ToString("yyyyMMddHHmmss")
          $NUGET_PACKAGE_VERSION = $NUGET_PACKAGE_VERSION + "-" + $VersionTag + "." + $Timestamp
        }
        
        Write-Output "Packge version to be used: $NUGET_PACKAGE_VERSION"

        echo "NUGET_PACKAGE_VERSION=$NUGET_PACKAGE_VERSION" >> $env:GITHUB_ENV
        echo "COMMIT_NUMBER=$COMMIT_NUMBER" >> $env:GITHUB_ENV
        echo "IsPrerelease=$IsPrerelease" >> $env:GITHUB_ENV

        echo "NUGET_PACKAGE_VERSION=$NUGET_PACKAGE_VERSION" >> $env:GITHUB_OUTPUT
        echo "SHOULD_DEPLOY=$SHOULD_DEPLOY" >> $env:GITHUB_OUTPUT
        echo "LAST_COMMITTER=$LAST_COMMITTER" >> $env:GITHUB_OUTPUT
        echo "COMMIT_MESSAGE=$COMMIT_MESSAGE" >> $env:GITHUB_OUTPUT

    - name: Write SNK
      if: github.repository_owner == vars.PUBLIC_MIRROR_SOURCE_ORG && steps.buildVariables.outputs.SHOULD_DEPLOY == 'true'
      env:
        SNK_BASE64:  ${{ secrets.ARTECH_SNK_BASE64 }}
      run: |
        $artech_snk_path = Join-Path (Get-Item .).FullName "Artech.snk"
        $bytes = [Convert]::FromBase64String($Env:SNK_BASE64)
        [IO.File]::WriteAllBytes($artech_snk_path, $bytes)

        echo "ARTECH_SNK_FILE=$artech_snk_path" >> $env:GITHUB_ENV

    - name: Restore packages
      run: dotnet restore $Env:SolutionFile

    - name: Build
      run: dotnet build $Env:SolutionFile --no-restore --configuration $Env:Configuration
       
    - name: Test
      run: dotnet test $Env:SolutionFile --no-restore --no-build --configuration $Env:Configuration

    - name: Pack
      run: dotnet pack $Env:SolutionFile --no-restore --no-build --configuration $Env:Configuration /p:Version=$Env:NUGET_PACKAGE_VERSION

    - name: Validate package names
      run: |
        Write-Output "Validating package names for NuGet.org publication..."
        Write-Output "All packages must start with 'GeneXus.' prefix as this namespace is reserved for GeneXus on NuGet.org"
        Write-Output ""
        
        $invalidPackages = @()
        Get-ChildItem ".\dotnet\*.nupkg" -Recurse | ForEach-Object {
          $packageName = [System.IO.Path]::GetFileNameWithoutExtension($_.Name)
          # Remove version suffix to get the actual package name
          $actualPackageName = $packageName -replace '\.\d+\.\d+\.\d+.*$', ''
          
          if (-not $actualPackageName.StartsWith("GeneXus.")) {
            $invalidPackages += $_.Name
            Write-Warning "Package '$($_.Name)' does not start with 'GeneXus.'"
          } else {
            Write-Output "✓ Package '$($_.Name)' correctly starts with 'GeneXus.'"
          }
        }
        
        if ($invalidPackages.Count -gt 0) {
          Write-Output ""
          Write-Error "Validation failed: The following packages do not start with 'GeneXus.': $($invalidPackages -join ', ')"
          Write-Error "This validation is required for publishing to NuGet.org where the 'GeneXus' prefix is reserved."
          exit 1
        }
        
        Write-Output ""
        Write-Output "✅ All packages correctly start with 'GeneXus.' prefix - ready for NuGet.org publication"

    - name: Sign packages
      if: github.repository_owner == vars.PUBLIC_MIRROR_SOURCE_ORG && steps.buildVariables.outputs.SHOULD_DEPLOY == 'true'
      env:
        VAULT_URL:          ${{ vars.AZURE_CODE_SIGNING_VAULT_URL }}
        CERT_NAME:          ${{ vars.AZURE_CODE_SIGNING_CERT_NAME }}
        TIMESTAMPER_URL:    ${{ vars.AZURE_CODE_SIGNING_TIMESTAMP_SERVER }}
        AZURE_TENANT:       ${{ vars.AZURE_CODE_SIGNING_TENANT }}
        AZURE_APP_ID:       ${{ vars.AZURE_CODE_SIGNING_APP_ID }}
        AZURE_APP_PASSWORD: ${{ secrets.AZURE_CODE_SIGNING_APP_PASSWORD }}
      run: |
        # Restore the local tool manifest (.config/dotnet-tools.json) which pins NuGetKeyVaultSignTool.
        dotnet tool restore

        # Acquire an Azure Key Vault access token via client_credentials grant.
        $body = @{
          grant_type    = 'client_credentials'
          client_id     = $Env:AZURE_APP_ID
          client_secret = $Env:AZURE_APP_PASSWORD
          scope         = 'https://vault.azure.net/.default'
        }
        $token = (Invoke-RestMethod -Method Post `
            -Uri "https://login.microsoftonline.com/$Env:AZURE_TENANT/oauth2/v2.0/token" `
            -Body $body).access_token
        Write-Host "::add-mask::$token"

        # Sign every produced .nupkg against the certificate stored in the vault.
        Get-ChildItem ".\dotnet\*.nupkg" -Recurse | ForEach-Object {
          dotnet tool run NuGetKeyVaultSignTool sign $_.FullName `
            -kvu $Env:VAULT_URL `
            -kvc $Env:CERT_NAME `
            -kva $token `
            -tr  $Env:TIMESTAMPER_URL `
            -td  sha256 `
            -fd  sha256
          if ($LASTEXITCODE -ne 0) { throw "NuGetKeyVaultSignTool failed for $($_.Name)" }
        }

    - name: Configure Azure Artifacts feed
      if: github.repository_owner == vars.PUBLIC_MIRROR_SOURCE_ORG && steps.buildVariables.outputs.SHOULD_DEPLOY == 'true'
      env:
        AzureArtifactsPrereleaseFeedURL: https://pkgs.dev.azure.com/genexuslabs/13fb82d9-57a8-49ef-95bb-0ec8324e470c/_packaging/dotnet-prereleases/nuget/v3/index.json
        AzureArtifactsReleaseFeedURL: https://pkgs.dev.azure.com/genexuslabs/13fb82d9-57a8-49ef-95bb-0ec8324e470c/_packaging/dotnet-releases/nuget/v3/index.json
      run: |
        $IsPrerelease = [System.Convert]::ToBoolean($Env:IsPrerelease)
        $AZURE_ARTIFACTS_URL = @("$Env:AzureArtifactsReleaseFeedURL", "$Env:AzureArtifactsPrereleaseFeedURL")[$IsPrerelease]

        dotnet nuget add source $AZURE_ARTIFACTS_URL --name AzureArtifacts --username genexuslabs --password ${{ secrets.AZURE_ARTIFACTS_TOKEN }}

        echo "AZURE_ARTIFACTS_URL=$AZURE_ARTIFACTS_URL" >> $env:GITHUB_ENV

    - name: Push packages
      if: github.repository_owner == vars.PUBLIC_MIRROR_SOURCE_ORG && steps.buildVariables.outputs.SHOULD_DEPLOY == 'true'
      env:
        NuGetFeedURL: https://api.nuget.org/v3/index.json
      run: |
        $IsPrerelease = [System.Convert]::ToBoolean($Env:IsPrerelease)

        $totalPackages  = 0
        $pushedToAzure  = 0
        $pushedToNuget  = 0

        Get-ChildItem ".\dotnet\*.nupkg" -Recurse | ForEach-Object {
          $PushToNugetArgs  = @("nuget", "push", $_.FullName, "--source", $Env:NuGetFeedURL, "--api-key", "${{ secrets.NUGET_ORG_API_KEY }}")
          $PushToAzureArgs  = @("nuget", "push", $_.FullName, "--source", $Env:AZURE_ARTIFACTS_URL, "--api-key", "DUMMY-KEY")

          if ([string]::IsNullOrEmpty("${{ github.event.inputs.skip-duplicates }}") ) {
            $skipDuplicates = $true
          } else {
            $skipDuplicates = [System.Convert]::ToBoolean("${{ github.event.inputs.skip-duplicates }}")
          }

          if ($skipDuplicates) {
            $PushToNugetArgs  += "--skip-duplicate"
            $PushToAzureArgs  += "--skip-duplicate"
          }

          dotnet $PushToAzureArgs  || exit 1
          $pushedToAzure += 1

          if (!$IsPrerelease) {
            dotnet $PushToNugetArgs || exit 1
            $pushedToNuget += 1
          }

          $totalPackages += 1
        }

        Write-Output "Number of packages found: $totalPackages"

        Write-Output "Number of packages pushed to Azure Artifacts: $pushedToAzure"
        Write-Output "Number of packages pushed to Nuget.org: $pushedToNuget"

    - name: Update GeneXus Dependency
      if: github.repository_owner == vars.PUBLIC_MIRROR_SOURCE_ORG && steps.buildVariables.outputs.SHOULD_DEPLOY == 'true'
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        gh workflow run update-genexus-dependency.yml `
          --repo ${{ github.repository }} `
          --ref ${{ github.ref_name }} `
          --field VERSION=${{ steps.buildVariables.outputs.NUGET_PACKAGE_VERSION }}