ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['[0-9]*.[0-9]*.[0-9]*']
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 11.0.x

    - name: Restore
      run: dotnet restore

    - name: Build
      run: dotnet build --configuration Release --no-restore

    - name: Test
      run: dotnet test --configuration Release --no-build

    - name: Pack
      run: dotnet pack --configuration Release --no-build --output ./artifacts

    - name: Upload artifacts
      uses: actions/upload-artifact@v7
      with:
        name: packages
        path: ./artifacts/*.nupkg

  # Collects line coverage and publishes it to Codacy. Runs on the self-hosted
  # pdl-public scale set rather than a GitHub-hosted runner.
  # pdl-public is the hardened scale set that may serve a public repository: a
  # fork pull request is untrusted code, so it has no dind, no privileged
  # container, no hostPath and nothing shared between jobs.
  coverage:
    runs-on: [pdl-public]

    env:
      DOTNET_NOLOGO: 1
      DOTNET_CLI_TELEMETRY_OPTOUT: 1
      # The actions-runner image does not offer the Node version several of these
      # actions request by default; without this they fail before their first step.
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0 # Nerdbank.GitVersioning needs the full history.

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      env:
        # The runner user cannot write /usr/share/dotnet, the default install location.
        DOTNET_INSTALL_DIR: ${{ runner.temp }}/dotnet
      with:
        dotnet-version: 11.0.x

    - name: Build tests
      run: dotnet build PanoramicData.NetFlowServer.Test/PanoramicData.NetFlowServer.Test.csproj --configuration Debug

    # The test project is a Microsoft.Testing.Platform application
    # (UseMicrosoftTestingPlatformRunner), so coverage is collected by running the
    # test executable directly with Microsoft.Testing.Extensions.CodeCoverage rather
    # than through `dotnet test`. On Linux the executable has no .exe extension.
    # coverage.config ports coverlet's generated-code exclusions so figures stay
    # comparable across the estate.
    # The settings path must be absolute: the test host resolves a relative path from
    # its own working directory and rejects it as "doesn't exist or is invalid".
    - name: Run tests with coverage
      run: >-
        ./PanoramicData.NetFlowServer.Test/bin/Debug/net11.0/PanoramicData.NetFlowServer.Test
        --coverage
        --coverage-settings "$GITHUB_WORKSPACE/coverage.config"
        --coverage-output-format cobertura
        --coverage-output coverage.cobertura.xml

    # continue-on-error: a Codacy outage must not turn a passing test run red. The
    # trade-off is that an expired or missing project token fails silently, so
    # check the step log for "Coverage received successfully".
    # The secrets context cannot be tested in a step `if`, so this step turns its
    # presence into an output. Fork pull requests have no secret and skip the upload.
    - name: Check for Codacy token
      id: codacy
      env:
        CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
      run: |
        if [ -n "$CODACY_PROJECT_TOKEN" ]; then
          echo "enabled=true" >> "$GITHUB_OUTPUT"
        else
          echo "enabled=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Upload coverage to Codacy
      if: steps.codacy.outputs.enabled == 'true'
      continue-on-error: true
      # Pinned to the commit of v1.3.0.
      uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699
      with:
        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
        coverage-reports: PanoramicData.NetFlowServer.Test/bin/Debug/net11.0/TestResults/coverage.cobertura.xml

    - name: Upload coverage artifact
      if: always()
      continue-on-error: true
      uses: actions/upload-artifact@v7
      with:
        name: coverage
        path: PanoramicData.NetFlowServer.Test/bin/Debug/net11.0/TestResults/coverage.cobertura.xml
        retention-days: 7

  publish:
    needs: build
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
    - name: Download artifacts
      uses: actions/download-artifact@v8
      with:
        name: packages
        path: ./artifacts

    - name: Setup .NET
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 11.0.x

    - name: Login to NuGet
      id: login
      uses: NuGet/login@v1
      with:
        user: david_n_m_bond

    - name: Push to NuGet
      run: dotnet nuget push ./artifacts/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json