release.yml

name: Release

# Fires on any v*.*.* tag push (and prerelease suffixes -alpha/-beta/-rc).
# Version comes from Directory.Build.props. Publishes via NuGet Trusted
# Publishing (OIDC — no long-lived API key). Setup steps in docs/RELEASING.md.
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Pack and validate only — skip nuget push"
        type: boolean
        default: true

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write   # for creating the GitHub Release
      id-token: write   # required for Trusted Publishing OIDC exchange
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json

      - name: Restore
        run: dotnet restore shelldocs.slnx

      - name: Build
        run: dotnet build shelldocs.slnx --configuration Release --no-restore

      - name: Test
        run: dotnet test shelldocs.slnx --configuration Release --no-build --verbosity normal

      - name: Pack
        run: dotnet pack shelldocs.slnx --configuration Release --no-build --output nupkgs

      - name: List produced packages
        run: ls -la nupkgs/

      # ─── Pre-push safety: refuse if the version is already on nuget.org ───
      # NuGet locks version numbers permanently after first publish. Without
      # this check, `--skip-duplicate` in the push step would silently no-op
      # the upload of a fresh binary when the version already exists — burned
      # us once (see CHANGELOG 0.1.0-alpha → 0.1.1-alpha). Fails loud so the
      # human bumps Directory.Build.props before re-tagging.
      - name: Verify version is not already published
        if: github.event_name == 'push' || inputs.dry_run == false
        run: |
          version=$(grep -oE '<Version>[^<]+' Directory.Build.props | head -1 | sed 's/<Version>//')
          echo "Directory.Build.props version: $version"
          if [ -z "$version" ]; then
            echo "ERROR: could not read Version from Directory.Build.props"
            exit 1
          fi
          for pkg in ShellDocs.CLI ShellDocs.Components ShellDocs.Core ShellDocs.Markdown ShellDocs.Templates ShellDocs.Tokens; do
            lower=$(echo "$pkg" | tr '[:upper:]' '[:lower:]')
            existing=$(curl -sf "https://api.nuget.org/v3-flatcontainer/${lower}/index.json" 2>/dev/null | grep -oE '"[^"]*"' | tr -d '"' || echo "")
            if echo "$existing" | grep -Fxq "$version"; then
              echo "ERROR: $pkg $version is already published on nuget.org."
              echo "NuGet does not allow overwriting a published version."
              echo "Bump <Version> in Directory.Build.props and re-tag."
              exit 1
            fi
          done
          echo "OK — $version is not yet on nuget.org for any of the 6 packages. Proceeding."

      # Runs immediately before push — the temp API key is valid only 1 hour.
      # `user` is the nuget.org profile name (NOT email, NOT the GH org name),
      # kept as a secret so it never lives in the workflow file.
      - name: Login to NuGet via Trusted Publishing
        if: github.event_name == 'push' || inputs.dry_run == false
        id: nuget-login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to NuGet
        if: github.event_name == 'push' || inputs.dry_run == false
        env:
          NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
        run: |
          for pkg in nupkgs/*.nupkg; do
            echo "Publishing $pkg"
            dotnet nuget push "$pkg" \
              --api-key "$NUGET_API_KEY" \
              --source https://api.nuget.org/v3/index.json \
              --skip-duplicate
          done

      - name: Create GitHub Release
        if: github.event_name == 'push'
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: nupkgs/*.nupkg