release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+'

permissions:
  contents: read

env:
  DOTNET_NOLOGO: 1
  DOTNET_CLI_TELEMETRY_OPTOUT: 1

# Publishing uses NuGet trusted publishing (OIDC) instead of a stored API key, so
# this workflow requires an exactly matching policy on nuget.org. The external
# setup, which lives outside the repository and cannot be inferred from here, is:
#   Repository owner : dotnetcore        (https://github.com/dotnetcore/Collections)
#   Repository       : Collections
#   Workflow file    : release.yml       (file name only, no .github/workflows/ prefix)
#   Environment      : leave empty unless an `environment:` is added to this job
#   Secret           : NUGET_USERNAME = the nuget.org profile name, not the e-mail
# The policy owner must own all 11 DotNetCore.Collections.* packages.

jobs:
  publish-nuget:
    name: Pack and publish to nuget.org
    runs-on: windows-latest
    # id-token: write lets GitHub mint the OIDC token that NuGet trusted publishing
    # exchanges for a short-lived API key. contents: read must be restated because
    # job-level permissions replace the workflow-level block.
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # SourceLink needs full history for the deterministic build

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x

      - name: Pack all packages
        shell: pwsh
        run: |
          $projects = @(
            'Multi',
            'Paginable',
            'Paginable.Chloe',
            'Paginable.DosOrm',
            'Paginable.EntityFramework',
            'Paginable.EntityFrameworkCore',
            'Paginable.FreeSql',
            'Paginable.FreeSql.DbContext',
            'Paginable.NHibernate',
            'Paginable.SqlKata',
            'Paginable.SqlSugar'
          )

          New-Item -ItemType Directory -Force -Path nuget_pub | Out-Null

          foreach ($p in $projects) {
            # DocumentationFile is isolated per TFM by build/common.props, so the
            # per-TFM inner builds no longer race on a single project-root file
            # (no CS0016) and no -m:1 serialisation is needed.
            dotnet pack "src/DotNetCore.Collections.$p" -c Release -o nuget_pub
            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          }

      # Must run right before the push: the temporary key lives for ~1 hour, and each
      # OIDC token can only be exchanged for a single key.
      - name: NuGet login (OIDC -> temporary API key)
        id: login
        uses: NuGet/login@v1
        with:
          # nuget.org profile name, not the email address.
          user: ${{ secrets.NUGET_USERNAME }}

      - name: Push packages to nuget.org
        shell: pwsh
        env:
          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
        run: |
          if ([string]::IsNullOrWhiteSpace($env:NUGET_API_KEY)) {
            Write-Error 'The NuGet login step did not return a temporary API key.'
            exit 1
          }

          foreach ($pattern in @('*.nupkg', '*.snupkg')) {
            Get-ChildItem nuget_pub -Filter $pattern | ForEach-Object {
              Write-Host "Pushing $($_.Name)"
              dotnet nuget push $_.FullName `
                --api-key $env:NUGET_API_KEY `
                --source https://api.nuget.org/v3/index.json `
                --skip-duplicate
              if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
            }
          }