ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['[0-9]*.[0-9]*.[0-9]*']
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 11.0.x

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build --configuration Release --no-restore

    - name: Test
      run: dotnet test --configuration Release --no-build --verbosity normal

    - name: Pack
      run: dotnet pack --configuration Release --no-build --output ./artifacts

    - name: Upload artifacts
      uses: actions/upload-artifact@v7
      with:
        name: packages
        path: ./artifacts/*.nupkg

  # Test coverage, uploaded to Codacy (OPS-157454).
  # pdl-public, never a GitHub-hosted runner and never pdl-prod-cluster: this repository is public,
  # so a fork pull request is untrusted code, and pdl-public is the hardened scale set that may run
  # it (no dind, no privileged container, no hostPath, nothing shared between jobs).
  coverage:
    runs-on: [pdl-public]

    env:
      DOTNET_NOLOGO: 1
      DOTNET_CLI_TELEMETRY_OPTOUT: 1
      # The actions-runner image does not offer the Node version several of these actions request
      # by default; without this they fail before their first step runs.
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

    steps:
    - uses: actions/checkout@v7
      with:
        fetch-depth: 0 # avoid shallow clone so nbgv can do its work.

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      # The runner user cannot write /usr/share/dotnet, so install the SDK somewhere it can.
      env:
        DOTNET_INSTALL_DIR: ${{ runner.temp }}/dotnet
      with:
        dotnet-version: 11.0.x

    - name: Build tests
      run: dotnet build PanoramicData.Encryption.Test/PanoramicData.Encryption.Test.csproj --configuration Debug

    # The test project is a Microsoft.Testing.Platform application, so coverage is collected by
    # running the test executable directly (Microsoft.Testing.Extensions.CodeCoverage) rather than
    # through `dotnet test`. On Linux the executable has no .exe extension.
    #
    # Every test in this repository runs offline with no credentials, so no filter is applied.
    - name: Run tests with coverage
      run: >-
        ./PanoramicData.Encryption.Test/bin/Debug/net11.0/PanoramicData.Encryption.Test
        --coverage
        --coverage-settings "$GITHUB_WORKSPACE/coverage.config"
        --coverage-output-format cobertura
        --coverage-output coverage.cobertura.xml

    # continue-on-error: a Codacy outage must not turn a passing test run red. The trade-off is that
    # an expired or missing project token fails silently, so check the log for
    # "Coverage received successfully" when in doubt.
    - name: Upload coverage to Codacy
      continue-on-error: true
      uses: codacy/codacy-coverage-reporter-action@v1
      with:
        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
        coverage-reports: PanoramicData.Encryption.Test/bin/Debug/net11.0/TestResults/coverage.cobertura.xml

    - name: Upload coverage artifact
      if: always()
      continue-on-error: true
      uses: actions/upload-artifact@v7
      with:
        name: coverage
        path: PanoramicData.Encryption.Test/bin/Debug/net11.0/TestResults/coverage.cobertura.xml
        retention-days: 7

  publish:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v8
      with:
        name: packages
        path: ./artifacts

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 11.0.x

    - name: Login to NuGet
      id: login
      uses: NuGet/login@v1
      with:
        user: david_n_m_bond

    - name: Push to NuGet
      run: dotnet nuget push ./artifacts/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json