ci.yml

name: CI

on:
  push:
    branches:
      - master
      - main
      - develop
      - beta/*
      - release/*
      - experimental/*
      - feature/*
    paths-ignore:
      - 'README.md'
      - 'docs/**'
      - 'samples/**'
  pull_request:
    branches:
      - master
      - main
      - develop

env:
  DOTNET_VERSION: '10.0'
  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
  DOTNET_INSTALL_DIR: ${{ github.workspace }}/.dotnet

jobs:
  validate:
    name: Validate Build Context
    runs-on: windows-latest
    steps:
      - name: Display build context
        run: |
          echo "Build branch: ${{ github.ref }}"
          echo "Build configuration: ${{ env.BUILD_CONFIGURATION }}"
          echo ".NET Version: ${{ env.DOTNET_VERSION }}"
    
  build:
    name: Build and Test
    runs-on: windows-latest
    needs: validate
    env:
      BUILD_CONFIGURATION: ${{ github.ref == 'refs/heads/master' && 'Release' || github.ref == 'refs/heads/develop' && 'Alpha' || startsWith(github.ref, 'refs/heads/beta/') && 'Beta' || startsWith(github.ref, 'refs/heads/release/') && 'Preview' || startsWith(github.ref, 'refs/heads/experimental/') && 'Experimental' || 'Debug' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Cache .NET SDK
        uses: actions/cache@v4
        with:
          path: ${{ env.DOTNET_INSTALL_DIR }}
          key: ${{ runner.os }}-dotnet-${{ env.DOTNET_VERSION }}
          restore-keys: |
            ${{ runner.os }}-dotnet-
            
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json
          
      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-
            
      - name: Set version variables
        uses: dotnet/nbgv@master
        with:
          setAllVars: true
          
      - name: Cache .NET tools
        uses: actions/cache@v4
        with:
          path: ~/.dotnet/tools
          key: ${{ runner.os }}-dotnet-tools-reportgenerator
          restore-keys: |
            ${{ runner.os }}-dotnet-tools-
            
      - name: Install ReportGenerator
        run: |
          $tools = dotnet tool list -g
          if ($tools -notmatch "dotnet-reportgenerator-globaltool") {
            dotnet tool install -g dotnet-reportgenerator-globaltool
          }
        
      - name: Restore packages
        run: dotnet restore
        
      - name: Build
        run: dotnet build --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore -p:ContinuousIntegrationBuild=true
        
      - name: Run unit tests with coverage
        run: |
          dotnet test --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --collect:"XPlat Code Coverage" --settings coverlet.runsettings --filter "Category!=Integration" --logger trx --results-directory ${{ runner.temp }}
        continue-on-error: ${{ contains(fromJSON('["Experimental", "Alpha"]'), env.BUILD_CONFIGURATION) }}
        
      - name: Generate coverage report
        if: always()
        run: |
          reportgenerator -reports:${{ runner.temp }}/**/coverage.cobertura.xml -targetdir:${{ runner.temp }}/CodeCoverage -reporttypes:"Cobertura;Html;Badges"
        continue-on-error: true
        
      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: ${{ runner.temp }}/*.trx
          
      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: ${{ runner.temp }}/CodeCoverage
          
      - name: Pack packages
        run: |
          dotnet pack --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output ${{ github.workspace }}/packages -p:RepositoryUrl=${{ github.server_url }}/${{ github.repository }} -p:RepositoryBranch=${{ github.ref_name }} -p:RepositoryCommit=${{ github.sha }}
          
      - name: Upload packages
        uses: actions/upload-artifact@v4
        with:
          name: packages
          path: ${{ github.workspace }}/packages
          
  security-scan:
    name: Security Scanning
    runs-on: windows-latest
    needs: validate
    if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/beta/') || startsWith(github.ref, 'refs/heads/release/')
    permissions:
      actions: read
      contents: read
      security-events: write
    env:
      BUILD_CONFIGURATION: ${{ github.ref == 'refs/heads/master' && 'Release' || github.ref == 'refs/heads/develop' && 'Alpha' || startsWith(github.ref, 'refs/heads/beta/') && 'Beta' || startsWith(github.ref, 'refs/heads/release/') && 'Preview' || 'Alpha' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          
      - name: Cache .NET SDK
        uses: actions/cache@v4
        with:
          path: ${{ env.DOTNET_INSTALL_DIR }}
          key: ${{ runner.os }}-dotnet-${{ env.DOTNET_VERSION }}
          restore-keys: |
            ${{ runner.os }}-dotnet-
            
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          global-json-file: global.json
          
      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/Directory.Packages.props') }}
          restore-keys: |
            ${{ runner.os }}-nuget-
            
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: csharp
          
      - name: Restore packages
        run: dotnet restore
        
      - name: Build for CodeQL
        run: dotnet build --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore
        
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        
      - name: Security audit
        run: dotnet list package --vulnerable --include-transitive
        
  publish-packages:
    name: Publish Packages
    runs-on: windows-latest
    needs: [build, security-scan]
    if: |
      github.event_name == 'push' &&
      (github.ref == 'refs/heads/master' || 
       github.ref == 'refs/heads/main' ||
       github.ref == 'refs/heads/develop' ||
       startsWith(github.ref, 'refs/heads/beta/') ||
       startsWith(github.ref, 'refs/heads/release/'))
    steps:
      - name: Download packages
        uses: actions/download-artifact@v4
        with:
          name: packages
          path: ${{ github.workspace }}/packages
          
      - name: List package contents
        run: |
          Get-ChildItem -Path "${{ github.workspace }}/packages" -Recurse
          
      # For GitHub Packages - only for nightly/experimental branches
      - name: Push to GitHub Packages
        if: |
          github.event_name == 'push' &&
          (github.ref == 'refs/heads/develop' ||
           startsWith(github.ref, 'refs/heads/experimental/') ||
           startsWith(github.ref, 'refs/heads/feature/'))
        run: |
          Get-ChildItem -Path "${{ github.workspace }}/packages" -Filter "*.nupkg" -Recurse | ForEach-Object {
            dotnet nuget push $_.FullName --source "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json" --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate
          }
        continue-on-error: true
        
      # For NuGet.org - publish stable and prerelease versions
      - name: Push to NuGet.org
        if: |
          github.event_name == 'push' && 
          (github.ref == 'refs/heads/master' || 
           github.ref == 'refs/heads/main' ||
           github.ref == 'refs/heads/develop' ||
           startsWith(github.ref, 'refs/heads/release/')) &&
          env.NUGET_API_KEY != ''
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: |
          Get-ChildItem -Path "${{ github.workspace }}/packages" -Filter "*.nupkg" -Recurse | ForEach-Object {
            dotnet nuget push $_.FullName --source "https://api.nuget.org/v3/index.json" --api-key ${{ secrets.NUGET_API_KEY }} --skip-duplicate
          }
        continue-on-error: true
        
      - name: Tag release
        if: github.ref == 'refs/heads/master'
        run: |
          git config user.email "cmblair@domesticateddata.com"
          git config user.name "jConner"
          git tag -a "v${{ env.NBGV_SemVer2 }}" -m "Release v${{ env.NBGV_SemVer2 }}"
          git push origin "v${{ env.NBGV_SemVer2 }}"
        continue-on-error: true