release.yml

name: Release

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - 'src/**'
      - 'tests/**'
      - 'example/**'
      - '.github/workflows/release.yml'
      - 'README-NuGet.md'

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:

  build:

    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0

    # The NuGet package we're building supports both .NET 8 and .NET 9, so we need
    # to install both so that we can build the project.
    - name: Setup .NET 8.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '8.0.x'

    - name: Setup .NET SDK 9.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '9.0.x'

    - name: Install dependencies
      run: dotnet restore --locked-mode

    - name: Build
      run: dotnet build --configuration Release --no-restore
  
  test:
    needs: [build]
    runs-on: ubuntu-latest
    name: Run all tests

    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
      
    # The NuGet package we're building supports both .NET 8 and .NET 9, so we need
    # to install both so that we can test the project.
    - name: Setup .NET 8.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '8.0.x'

    - name: Setup .NET SDK 9.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '9.0.x'

    - name: Run all tests
      run: dotnet test OwaspHeaders.Core.sln --verbosity minimal


  package:
    needs: [build, test]
    runs-on: ubuntu-latest
    name: Create and upload NuGet package

    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0
      
    # The NuGet package we're building supports both .NET 8 and .NET 9, so we need
    # to install both so that we can create the NuGet package.
    - name: Setup .NET 8.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '8.0.x'

    - name: Setup .NET SDK 9.0
      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
      with:
        dotnet-version: '9.0.x'

    - name: Build NuGet package
      run: dotnet pack src/OwaspHeaders.Core.csproj --configuration Release
    
    - name: Generate Attestations
      uses: actions/attest-build-provenance@963f8a02f24ac90336362e63ca6730cf69ad102e # v2.1.0
      with:
        subject-path: ${{ github.workspace }}/**/*.nupkg
    
    - name: Push NuGet package
      run: dotnet nuget  push **\*.nupkg --source 'https://api.nuget.org/v3/index.json' --api-key ${{secrets.NUGET_API_KEY}}
      env:
        GITHUB_TOKEN: ${{ secrets.NUGET_API_KEY }}