Migrate NuGet publishing to trusted publishing (OIDC) #267
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build NuGet packages | |
| on: | |
| push: | |
| branches: [ develop, main ] | |
| tags: | |
| - v* | |
| pull_request: | |
| branches: [ develop, main ] | |
| jobs: | |
| build: | |
| permissions: | |
| packages: write | |
| id-token: write # enable GitHub OIDC token issuance for NuGet trusted publishing | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # We use `git describe` to find tags in commit history, so we need complete repo history | |
| fetch-depth: 0 | |
| - name: Calculate version number for PR build | |
| if: github.event_name == 'pull_request' | |
| shell: bash | |
| run: src/calculate-version.sh "${{ github.run_number }}" "${{ github.event.number }}" | |
| - name: Calculate version number for non-PR build | |
| if: github.event_name != 'pull_request' | |
| shell: bash | |
| run: src/calculate-version.sh "${{ github.run_number }}" | |
| - name: Install .NET | |
| uses: actions/setup-dotnet@v4 | |
| - name: Build & test | |
| run: dotnet test --configuration Release --report-github | |
| - name: Pack | |
| shell: bash | |
| run: | | |
| dotnet pack /p:PackageVersion="$PACKAGE_VERSION" /p:AssemblyVersion="$ASSEMBLY_VERSION" /p:FileVersion="$FILE_VERSION" | |
| - name: Upload packages to build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: nuget-packages | |
| path: src/artifacts/package/release/*nupkg | |
| - name: NuGet login | |
| id: nuget-login | |
| uses: NuGet/login@v1 | |
| with: | |
| user: ${{ secrets.NUGET_USER }} | |
| - name: Publish package to NuGet.org | |
| if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) | |
| shell: bash | |
| run: | | |
| shopt -s nullglob | |
| packages=(src/artifacts/package/release/*.nupkg) | |
| symbols=(src/artifacts/package/release/*.snupkg) | |
| if ((${#packages[@]} == 0)); then | |
| echo "No NuGet packages were produced." >&2 | |
| exit 1 | |
| fi | |
| if ((${#symbols[@]} == 0)); then | |
| echo "No symbol packages were produced." >&2 | |
| exit 1 | |
| fi | |
| for pkg in "${packages[@]}"; do | |
| case "$pkg" in | |
| *.symbols.nupkg|*.snupkg) continue ;; | |
| esac | |
| echo "Publishing $pkg" | |
| dotnet nuget push "$pkg" \ | |
| --skip-duplicate \ | |
| --api-key "$NUGET_API_KEY" \ | |
| --source https://api.nuget.org/v3/index.json | |
| done | |
| for sym in "${symbols[@]}"; do | |
| echo "Publishing symbols $sym" | |
| dotnet nuget push "$sym" \ | |
| --skip-duplicate \ | |
| --api-key "$NUGET_API_KEY" \ | |
| --source https://api.nuget.org/v3/index.json | |
| done | |
| env: | |
| NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }} |