ci.yml

name: CI Build

on:
  push:
    branches:
      - master
      - 'release/**'
      - 'maintenance/**'
    paths-ignore:
      - '**/*.md'
      - '**/*.png'
  workflow_dispatch:
    inputs:
      run_tests:
        description: Run tests
        required: true
        default: true
        type: boolean
      collect_coverage:
        description: Collect and upload coverage (requires tests)
        required: true
        default: true
        type: boolean
      pack_nugets:
        description: Pack and upload NuGet artifacts
        required: true
        default: true
        type: boolean
      upload_artifacts:
        description: Create and upload the full artifact archive
        required: true
        default: true
        type: boolean
      publish_nuget:
        description: Publish to nuget.org (master only; forces packing)
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  # Never interrupt a master run while it may be publishing an immutable package set.
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

env:
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

jobs:
  build-and-test:
    name: CI Build & Test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      id-token: write

    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 1
        lfs: true

    - name: Setup .NET SDKs
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: |
          8.0.x
          9.0.x
          10.0.x

    - name: Build selected components
      shell: pwsh
      env:
        RUN_TESTS: ${{ github.event_name != 'workflow_dispatch' || inputs.run_tests }}
        COLLECT_COVERAGE: ${{ github.event_name != 'workflow_dispatch' || inputs.collect_coverage }}
        PACK_NUGETS: ${{ github.event_name != 'workflow_dispatch' || inputs.pack_nugets || inputs.publish_nuget }}
        CREATE_ARCHIVE: ${{ github.event_name != 'workflow_dispatch' || inputs.upload_artifacts }}
      run: |
        $buildArguments = @()
        if ($env:RUN_TESTS -ne 'true') { $buildArguments += '-SkipTests' }
        if ($env:COLLECT_COVERAGE -ne 'true') { $buildArguments += '-SkipCoverage' }
        if ($env:PACK_NUGETS -ne 'true') { $buildArguments += '-SkipPack' }
        if ($env:CREATE_ARCHIVE -ne 'true') { $buildArguments += '-SkipArchive' }
        ./Build/build.ps1 @buildArguments

    # Codecov intermittently fails while importing its verification key from Keybase.
    # Keep coverage non-blocking until upstream adds reliable retry/error handling:
    # https://github.com/codecov/codecov-action/issues/1876
    # https://github.com/codecov/wrapper/pull/66
    - name: Upload coverage to Codecov
      if: github.event_name != 'workflow_dispatch' || (inputs.run_tests && inputs.collect_coverage)
      continue-on-error: true
      uses: codecov/codecov-action@v6
      with:
        directory: Artifacts/Coverage
        fail_ci_if_error: true
        plugins: noop
        use_oidc: true

    - name: Upload artifacts
      if: github.event_name != 'workflow_dispatch' || inputs.upload_artifacts
      uses: actions/upload-artifact@v7
      with:
        name: artifacts
        path: Artifacts/
        retention-days: 30

    - name: Upload NuGet packages
      if: github.event_name != 'workflow_dispatch' || inputs.pack_nugets || inputs.publish_nuget
      uses: actions/upload-artifact@v7
      with:
        name: nuget-packages
        path: |
          Artifacts/**/*.nupkg
          Artifacts/**/*.snupkg
        if-no-files-found: error
        retention-days: 30

  publish-nuget:
    name: Publish NuGet packages
    needs: build-and-test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: >-
      github.ref == 'refs/heads/master' &&
      github.repository_owner == 'angularsen' &&
      (github.event_name == 'push' || inputs.publish_nuget)
    environment: Publish
    permissions:
      contents: read
      id-token: write

    steps:
    - name: Download NuGet packages
      uses: actions/download-artifact@v8
      with:
        name: nuget-packages
        path: nugets

    - name: Setup .NET SDK
      uses: actions/setup-dotnet@v6
      with:
        dotnet-version: 10.0.x

    - name: Log in to NuGet with trusted publishing
      uses: NuGet/login@v1
      id: nuget-login
      with:
        user: angularsen

    - name: Push to nuget.org
      env:
        NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
      run: dotnet nuget push "**/*.nupkg" --skip-duplicate --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json
      working-directory: nugets