build.yml

name: Build

on:
  push:
    branches:
      - develop
  workflow_dispatch:
    inputs:
      Deploy:
        description: Deploy
        required: false
        type: boolean
        default: false
  #pull_request:
    # Note: don't run on PR for security reasons
  
permissions:
  contents: read
  id-token: write

jobs:
  build:
    runs-on: windows-latest # Required for some (WPF) projects
    env:
      Category: 'Public'
      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
      AzureCodeSignCertificateName: ''
      AzureCodeSignClientId: ''
      AzureCodeSignClientSecret: ''
      AzureCodeSignTenantId: ''
      AzureCodeSignVaultName: ''
      Deploy: ${{ inputs.Deploy }}
      NuGetPackageSources: ''
      NuGetPackageSourcesNames: ''
      NuGetPackageSourcesTokens: ''
      NuGetPackageSourcesUsernames: ''
      NuGetRepositoryUrl: ''
      NuGetRepositoryApiKey: ''
      NuGetUser: ''
      SonarOrganization: ''
      SonarUrl: ''
      SonarToken: ''
  
    steps:
      - name: Enable Git long paths (global)
        run: git config --global core.longpaths true

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        id: checkout
        with:
          fetch-depth: 0
          
      - name: Setup .NET Core
        id: setup-dotnet
        uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0
        with:
          dotnet-version: '10.0.x'
          cache: true
          cache-dependency-path: '**/packages.lock.json'

      - name: Determine version
        id: gitversion
        shell: pwsh
        run: |
          dotnet tool restore

          $gitVersion = dotnet tool run dotnet-gitversion /output json | ConvertFrom-Json

          $gitVersion | ConvertTo-Json -Depth 10 | Write-Output

          Add-Content -Path $env:GITHUB_OUTPUT -Value "fullSemVer=$($gitVersion.FullSemVer)"
          Add-Content -Path $env:GITHUB_OUTPUT -Value "majorMinorPatch=$($gitVersion.MajorMinorPatch)"
          Add-Content -Path $env:GITHUB_OUTPUT -Value "nuGetVersion=$($gitVersion.NuGetVersionV2)"
          Add-Content -Path $env:GITHUB_OUTPUT -Value "commitsSinceVersionSource=$($gitVersion.CommitsSinceVersionSource)"
    
          [string[]] $tags = @(
            if ($env:Deploy -eq 'true') { 'deploy' } else { 'ci' }
          )

          $hubActions = [ordered]@{
            Version = $gitVersion.FullSemVer
            Tags    = $tags
          }
          $hubActions | ConvertTo-Json | Set-Content -Path hubactions.json

      - name: Upload HubActions metadata
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: hubactions.json
          path: hubactions.json
          if-no-files-found: error

      - name: Azure login (for Key Vault access)
        id: azure-login
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Determine required Key Vault secrets
        id: determine-keyvault-secrets
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        shell: pwsh
        run: |
          $secretVariables = @(
            @{ VariableName = 'NuGetPackageSources'; MaskValue = $false; IsOptional = $true }
            @{ VariableName = 'NuGetPackageSourcesNames'; MaskValue = $false; IsOptional = $true }
            @{ VariableName = 'NuGetPackageSourcesTokens'; MaskValue = $true; IsOptional = $true }
            @{ VariableName = 'NuGetPackageSourcesUsernames'; MaskValue = $false; IsOptional = $true }
            @{ VariableName = 'SonarOrganization'; MaskValue = $false; IsOptional = $true }
            @{ VariableName = 'SonarUrl'; MaskValue = $false; IsOptional = $true }
            @{ VariableName = 'SonarToken'; MaskValue = $true; IsOptional = $true }
          )

          if ($env:Deploy -eq 'true') {
            $secretVariables += @(
              @{ VariableName = 'AzureCodeSignCertificateName'; MaskValue = $true }
              @{ VariableName = 'AzureCodeSignTenantId'; MaskValue = $true }
              @{ VariableName = 'AzureCodeSignClientId'; MaskValue = $true }
              @{ VariableName = 'AzureCodeSignClientSecret'; MaskValue = $true }
              @{ VariableName = 'NuGetRepositoryUrl'; MaskValue = $false; IsOptional = $true }
              @{ VariableName = 'NuGetRepositoryApiKey'; MaskValue = $true; IsOptional = $true }
              @{ VariableName = 'NuGetUser'; MaskValue = $true; IsOptional = $true }
            )
          }

          $secretsJson = ConvertTo-Json -InputObject $secretVariables -Compress -Depth 5 -AsArray
          Add-Content -Path $env:GITHUB_OUTPUT -Value "secrets=$secretsJson"

      - name: Retrieve secrets from Key Vault
        id: key-vault-secrets
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        shell: pwsh
        env:
          AZURE_KEYVAULT_NAME: ${{ vars.AZURE_KEYVAULT_NAME || secrets.AZURE_KEYVAULT_NAME }}
          REPOSITORY_OWNER: ${{ github.repository_owner }}
          SECRET_VARIABLES_JSON: ${{ steps.determine-keyvault-secrets.outputs.secrets }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:AZURE_KEYVAULT_NAME)) {
            throw "AZURE_KEYVAULT_NAME is not configured"
          }

          if ([string]::IsNullOrWhiteSpace($env:REPOSITORY_OWNER)) {
            throw "REPOSITORY_OWNER is not available"
          }

          Write-Output "::add-mask::$env:AZURE_KEYVAULT_NAME"

          $vaultName = $env:AZURE_KEYVAULT_NAME
          $repositoryOwner = $env:REPOSITORY_OWNER
          $secretVariables = $env:SECRET_VARIABLES_JSON | ConvertFrom-Json

          # List secrets once, then resolve/retrieve them in parallel instead of up to 3 sequential az calls per variable.
          $vaultSecretNames = az keyvault secret list --vault-name $vaultName --query "[].name" -o tsv 2>&1
          if ($LASTEXITCODE -ne 0) {
            throw "Unable to list secrets in Key Vault '$vaultName'. $($vaultSecretNames -join ' ')"
          }
          $vaultSecretNameSet = [System.Collections.Generic.HashSet[string]]::new([string[]]$vaultSecretNames, [System.StringComparer]::OrdinalIgnoreCase)

          function Resolve-SecretName {
            param(
              [Parameter(Mandatory = $true)]
              [string] $VariableName,
              [bool] $IsOptional = $false
            )

            $secretName = $VariableName -replace '_', '--'
            $candidateNames = @(
              "$repositoryOwner-$env:Category-$secretName"
              "$repositoryOwner-$secretName"
              "$secretName"
            )

            foreach ($candidateName in $candidateNames) {
              if ($vaultSecretNameSet.Contains($candidateName)) {
                return $candidateName
              }
            }

            if ($IsOptional) {
              return $null
            }

            throw "Unable to find a Key Vault secret for '$VariableName' in '$vaultName'. Tried: $($candidateNames -join ', ')"
          }

          $resolvedSecrets = foreach ($secretVariable in $secretVariables) {
            $isOptional = $false
            if ($null -ne $secretVariable.IsOptional) {
              $isOptional = [bool]$secretVariable.IsOptional
            }

            $secretName = Resolve-SecretName -VariableName $secretVariable.VariableName -IsOptional $isOptional
            if ($null -ne $secretName) {
              [pscustomobject]@{
                EnvName    = if ($secretVariable.EnvironmentVariableName) { $secretVariable.EnvironmentVariableName } else { $secretVariable.VariableName }
                MaskValue  = $secretVariable.MaskValue
                SecretName = $secretName
              }
            }
          }

          $secretResults = $resolvedSecrets | ForEach-Object -Parallel {
            $entry = $_
            $vaultName = $using:vaultName

            try {
              $secretValue = az keyvault secret show --only-show-errors --vault-name $vaultName --name $entry.SecretName --query value -o tsv 2>&1

              if ($LASTEXITCODE -ne 0) {
                throw "Unable to retrieve Key Vault secret '$($entry.SecretName)' from '$vaultName'. $($secretValue -join ' ')"
              }

              [pscustomobject]@{
                EnvName      = $entry.EnvName
                MaskValue    = $entry.MaskValue
                SecretValue  = [string]$secretValue
                ErrorMessage = $null
              }
            }
            catch {
              [pscustomobject]@{
                EnvName      = $entry.EnvName
                MaskValue    = $entry.MaskValue
                SecretValue  = $null
                ErrorMessage = $_.Exception.Message
              }
            }
          } -ThrottleLimit 8

          $failedSecrets = @($secretResults | Where-Object { $_.ErrorMessage })
          if ($failedSecrets.Count -gt 0) {
            throw ($failedSecrets.ErrorMessage -join "`n")
          }

          foreach ($secretResult in $secretResults) {
            if ($secretResult.MaskValue -and -not [string]::IsNullOrEmpty($secretResult.SecretValue)) {
              Write-Output "::add-mask::$($secretResult.SecretValue)"
            }

            Add-Content -Path $env:GITHUB_ENV -Value "$($secretResult.EnvName)=$($secretResult.SecretValue)"
          }

          Add-Content -Path $env:GITHUB_ENV -Value "AzureCodeSignVaultName=$env:AZURE_KEYVAULT_NAME"

      - name: Calculate NuGet variables
        id: calculate-nuget-variables
        shell: pwsh
        run: |
          $nuGetPackageSourceDefinitions = @(
            @{ Url = 'https://api.nuget.org/v3/index.json'; Name = 'nuget.org'; Token = ''; Username = '' }
          )

          $nuGetPackageSources = $nuGetPackageSourceDefinitions.Url -join ';'
          $nuGetPackageSourcesNames = $nuGetPackageSourceDefinitions.Name -join ';'
          $nuGetPackageSourcesTokens = $nuGetPackageSourceDefinitions.Token -join ';'
          $nuGetPackageSourcesUsernames = $nuGetPackageSourceDefinitions.Username -join ';'

          Add-Content -Path $env:GITHUB_ENV -Value "NuGetPackageSources=$nuGetPackageSources"
          Add-Content -Path $env:GITHUB_ENV -Value "NuGetPackageSourcesNames=$nuGetPackageSourcesNames"
          Add-Content -Path $env:GITHUB_ENV -Value "NuGetPackageSourcesTokens=$nuGetPackageSourcesTokens"
          Add-Content -Path $env:GITHUB_ENV -Value "NuGetPackageSourcesUsernames=$nuGetPackageSourcesUsernames"

    
      # Get a short-lived NuGet API key
      - name: NuGet login (OIDC → temp API key)
        id: nuget-login
        if: ${{ github.event_name == 'workflow_dispatch' && env.Deploy == 'true' }}
        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
        with:
          user: ${{ env.NuGetUser }}

      # Build, test & deploy
      - name: ${{ github.event_name == 'workflow_dispatch' && env.Deploy == 'true' && format('Build and deploy {0} via Cake', steps.gitversion.outputs.fullSemVer) || format('Build and test {0} via Cake', steps.gitversion.outputs.fullSemVer) }}
        id: cake-build
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        shell: pwsh
        env:
          # Generic
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          IsCiBuild: ${{ env.Deploy != 'true' }}

          # Specific
          NuGetRepositoryApiKey: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
          SonarProject: ${{ github.repository_owner }}_${{ github.event.repository.name }}
        run: |
          $deploy = $env:Deploy -eq 'true'
          $target = if ($deploy) { 'BuildAndDeploy' } else { 'BuildAndTest' }

          dotnet tool restore
          dotnet tool run dotnet-cake --target="$target"