package.yml

name: Package

on:
  release:
    types: [published]

env:
  DOTNET_GENERATE_ASPNET_CERTIFICATE: false
  DOTNET_NOLOGO: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true

permissions:
  contents: read

jobs:
  nuget:

    runs-on: ubuntu-latest

    steps:
      - name: 🛡️ Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            aka.ms:443
            api.nuget.org:443
            dotnetcli.azureedge.net:443
            github.com:443
            www.nuget.org:443

      - name: 🛒 Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: 🧰 Setup .NET
        uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0
        with:
          global-json-file: global.json

      - name: 🗃️ Setup NuGet cache
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
          restore-keys: ${{ runner.os }}-nuget-

      - name: 📥 Restore dependencies
        run: dotnet restore --locked-mode

      - name: 🏗️ Build
        run: dotnet build --no-restore -c Release

      - name: 📦 Pack
        run: dotnet pack /p:CI=true /p:PublicRelease=true --no-build -c Release

      - name: 🚀 Publish
        run: dotnet nuget push "artifacts/*.nupkg" -s https://api.nuget.org/v3/index.json -k ${{ secrets.NUGET_APIKEY }} --skip-duplicate