release.yml

name: Release

# Builds the full LadybugDB package family (managed binding + per-RID native packages + native
# meta-package) via the Cake Frosting pipeline in cake/, and publishes it to nuget.org through
# trusted publishing (OIDC).
#
# Native engine libraries are NOT built here; the pipeline downloads prebuilt `liblbug-*` release
# assets from the upstream engine repo (LadybugDB/ladybug). The engine release defaults to the first
# three numeric segments of the package version (the git tag, or version.txt for manual runs).
#
# Triggers:
#   - push a tag like `v0.1.0`     -> build, test, pack, and PUBLISH all packages to nuget.org
#   - manual `workflow_dispatch`   -> build, test, and pack only (artifact uploaded; no publish)
#
# One-time setup required before publishing (see MAINTAINING.md):
#   - nuget.org trusted publishing policy owned by the LadybugDB organization (the policy applies to
#     all packages owned by that organization)
#     (owner=LadybugDB, repo=ladybug-dotnet, workflow file=release.yml; environment left blank for now)
#   - repository secret NUGET_USER = your nuget.org profile name (not email)

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Package version to build (defaults to version.txt). Not published on manual runs.'
        required: false
        default: ''
      engine_version:
        description: "LadybugDB/ladybug release tag to pull prebuilt native libs from (defaults to the package version's first three numeric segments)."
        required: false
        default: ''

permissions:
  contents: read

jobs:
  # Stage prebuilt natives for every RID, gate on the linux-x64 suite against the real engine, then
  # pack and validate the whole package family.
  pack:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Determine version
        id: ver
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
            VERSION="${GITHUB_REF_NAME#v}"                  # the tag is the authoritative release version
          elif [[ -n "${{ inputs.version }}" ]]; then
            VERSION="${{ inputs.version }}"
          else
            VERSION="$(tr -d '[:space:]' < version.txt)"    # single source of truth at the binding root
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Resolved package version: $VERSION"

      - name: Resolve engine version
        id: engine
        shell: bash
        run: |
          set -euo pipefail
          VERSION="${{ steps.ver.outputs.version }}"
          ENGINE="${{ inputs.engine_version }}"
          BASE="${VERSION%%[-+]*}"
          IFS='.' read -r MAJOR MINOR PATCH _ <<< "$BASE"
          if [[ ! "${MAJOR:-}" =~ ^[0-9]+$ || ! "${MINOR:-}" =~ ^[0-9]+$ || ! "${PATCH:-}" =~ ^[0-9]+$ ]]; then
            echo "Package version '$VERSION' must start with three numeric engine segments." >&2
            exit 1
          fi
          ENGINE="${ENGINE:-v${MAJOR}.${MINOR}.${PATCH}}"
          echo "engine=$ENGINE" >> "$GITHUB_OUTPUT"
          echo "Pulling native libs from LadybugDB/ladybug release: $ENGINE"

      - name: Test gate (linux-x64 against the real engine)
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          dotnet run --project cake/LadybugDB.Build.csproj --
          --target Test
          --engine-version "${{ steps.engine.outputs.engine }}"

      - name: Pack + verify the full package family
        env:
          GH_TOKEN: ${{ github.token }}
        run: >
          dotnet run --project cake/LadybugDB.Build.csproj --
          --target Pack
          --package-version "${{ steps.ver.outputs.version }}"
          --engine-version "${{ steps.engine.outputs.engine }}"

      - uses: actions/upload-artifact@v7
        with:
          name: nuget-packages
          path: |
            artifacts/*.nupkg
            artifacts/*.snupkg
          if-no-files-found: error

  # Publish every package to nuget.org with trusted publishing. Only runs for v* tags.
  publish:
    needs: pack
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    # No GitHub environment for now: the nuget.org trusted-publishing policy is environment-blank.
    # Add one back (and set the policy's Environment to match) when we split release vs test.
    permissions:
      id-token: write   # required for the OIDC token used by NuGet/login
      contents: read
    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - name: Download packed artifacts
        uses: actions/download-artifact@v8
        with:
          name: nuget-packages
          path: artifacts

      - name: NuGet login (OIDC trusted publishing)
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}   # nuget.org profile name, NOT email

      - name: Push to nuget.org
        run: >
          dotnet nuget push "artifacts/*.nupkg"
          --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
          --source https://api.nuget.org/v3/index.json
          --skip-duplicate