CoreLoop .NET build #36
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CoreLoop .NET build | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| paths-ignore: | |
| - "**.md" | |
| release: | |
| types: | |
| - published | |
| schedule: | |
| # A daily build to check all is still functioning. | |
| - cron: "0 0 * * *" | |
| env: | |
| # This environment variable is checked in tests. | |
| # For TPM either a Windows simulator or a platform TPM is used. | |
| # Tests check that platform TPM tests must be run on Windows or Linux, | |
| # MacOS tests are skipped. | |
| USE_PLATFORM_TPM: true | |
| DOTNET_ENVIRONMENT: CI | |
| BUILD_CONFIGURATION: Release | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| DOTNET_NOLOGO: true | |
| NUGET_XMLDOC_MODE: skip | |
| NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages | |
| NUGET_FEED: https://api.nuget.org/v3/index.json | |
| GITHUB_USER: ${{ github.repository_owner }} | |
| GITHUB_FEED: https://nuget.pkg.github.com/lumoin/ | |
| # These are the Nuget packages that will be packed and uploaded. | |
| CORELOOP_UNTP: CoreLoop.Untp | |
| jobs: | |
| build: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ ubuntu-latest, windows-latest, macos-latest ] | |
| steps: | |
| - name: Harden Runner | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| dotnetbuilds.azureedge.net:443 | |
| aka.ms:443 | |
| api.github.com:443 | |
| api.nuget.org:443 | |
| pkgs.dev.azure.com:443 | |
| dashboard.stryker-mutator.io:443 | |
| dotnetcli.azureedge.net:443 | |
| github.com:443 | |
| nuget.pkg.github.com:443 | |
| api.clearlydefined.io:443 | |
| cacerts.digicert.com:80 | |
| ts-crl.ws.symantec.com:80 | |
| crl3.digicert.com:80 | |
| crl4.digicert.com:80 | |
| s.symcb.com:80 | |
| ocsp.digicert.com:80 | |
| # Windows builds may have insufficient resource limits, so they're increased. | |
| - name: Configure Windows Pagefile | |
| if: ${{ matrix.os == 'windows-latest' }} | |
| uses: al-cheb/configure-pagefile-action@a3b6ebd6b634da88790d9c58d4b37a7f4a7b8708 | |
| with: | |
| minimum-size: 8GB | |
| maximum-size: 32GB | |
| disk-root: "D:" | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Cache Nuget packages '${{ matrix.os }}' | |
| uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 | |
| with: | |
| path: ${{ env.NUGET_PACKAGES }} | |
| key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }} | |
| restore-keys: | | |
| ${{runner.os}}-nuget- | |
| - name: Setup .NET SDK | |
| uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee | |
| with: | |
| global-json-file: global.json | |
| - name: Install dependencies | |
| run: dotnet restore --locked-mode | |
| - name: Restore local .NET tools | |
| run: dotnet tool restore | |
| - name: Add Problem Matcher for dotnet-format | |
| uses: xt0rted/dotnet-format-problem-matcher@b90c4f18e3daa4f8fd266e41eba4f351b2e00b75 | |
| # - name: Run dotnet format | |
| # run: dotnet format --check | |
| # The version numbers are determined and set here so it can be set appropriately to code and NuGet packages. | |
| # See explanation at https://dusted.codes/github-actions-for-dotnet-core-nuget-packages. | |
| - name: Set NuGet packages and suffix version | |
| run: | | |
| # Bash script to determine the version and version suffix for CI/CD | |
| # Use git to find the latest tag; if none are found, default to "0.0.1". | |
| latestTag=$(git describe --tags --abbrev=0 2>/dev/null || echo 0.0.1) | |
| # Case 1: A release is being created. | |
| # Extract the version from the tag and add a suffix with the short SHA. | |
| if [[ $GITHUB_EVENT_NAME == 'release' ]]; then | |
| # Extract the version number from the release tag and remove any 'v' prefix. | |
| arrTag=(${GITHUB_REF//\// }) | |
| VERSION="${arrTag[2]}" | |
| VERSION="${VERSION//v}" | |
| # Set PACKAGE_VERSION and VERSION, and add a VERSION_SUFFIX for clarity in identifying the release and commit. | |
| echo "PACKAGE_VERSION=${VERSION}+${GITHUB_SHA::7}" >> "$GITHUB_ENV" | |
| echo "VERSION=${VERSION}" >> "$GITHUB_ENV" | |
| echo "TAG_VERSION=${VERSION}" >> "$GITHUB_ENV" | |
| # Case 2: The 'develop' branch. | |
| # Use the latestTag as the base version and add a suffix with "develop", the run_id, and the short SHA. | |
| elif [[ $GITHUB_REF == 'refs/heads/develop' ]]; then | |
| # Set PACKAGE_VERSION and PACKAGE, and add a VERSION_SUFFIX for clarity in identifying the development build, run, and commit. | |
| echo "PACKAGE_VERSION=${latestTag//v}-develop.${GITHUB_RUN_ID}+${GITHUB_SHA::7}" >> "$GITHUB_ENV" | |
| echo "VERSION=${latestTag//v}-develop.${GITHUB_RUN_ID}+${GITHUB_SHA::7}" >> "$GITHUB_ENV" | |
| echo "TAG_VERSION=${latestTag//v}" >> "$GITHUB_ENV" | |
| # Case 3: Any other build (e.g., feature branches). | |
| # Use the latestTag as the base version and add a suffix with "build", the run_id, and the short SHA. | |
| else | |
| # Set PACKAGE_VERSION and VERSION, and add a VERSION_SUFFIX for clarity in identifying the build, run, and commit. | |
| echo "PACKAGE_VERSION=${latestTag//v}-build.${GITHUB_RUN_ID}+${GITHUB_SHA::7}" >> "$GITHUB_ENV" | |
| echo "VERSION=${latestTag//v}-build.${GITHUB_RUN_ID}+${GITHUB_SHA::7}" >> "$GITHUB_ENV" | |
| echo "TAG_VERSION=${latestTag//v}" >> "$GITHUB_ENV" | |
| fi | |
| shell: bash | |
| - name: Build | |
| # At the moment CoreLoop.Tests cannot be built with -isolate alone due to Coverlet. | |
| run: dotnet build --binaryLogger --tl --graphBuild -isolate:MessageUponIsolationViolation --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore --property:ContinuousIntegrationBuild=true --property:Version=${{ env.VERSION }} --property:InformationalVersion=${{ env.PACKAGE_VERSION }} --property:AssemblyVersion=${{ env.TAG_VERSION }} --property:FileVersion=${{ env.TAG_VERSION }} | |
| timeout-minutes: 5 | |
| # - name: Set PR markdown title name | |
| # run: | | |
| # echo "title=Test Run (${{ github.run_number }})" >> $GITHUB_ENV | |
| # echo "file_name=TestReport.${{ github.run_number }}.md" >> $GITHUB_ENV | |
| # shell: bash | |
| - name: Test | |
| # See the difference on drivers and paths at https://github.com/microsoft/vstest/issues/2378 and further | |
| # here on generating the reports. | |
| # run: dotnet test --verbosity normal --no-restore --no-build --configuration ${{ env.BUILD_CONFIGURATION }} --property:CollectCoverage=true --property:CoverletOutputFormat=cobertura --property:DeterministicSourcePaths=true --property:IncludeTestAssembly=true --property:CoverletOutput='${{ github.workspace }}/reports/coverage/' | |
| run: dotnet test --collect:"XPlat Code Coverage" --verbosity normal --no-restore --no-build --configuration ${{ env.BUILD_CONFIGURATION }} --logger JUnit -property:DeterministicSourcePaths=true -property:IncludeTestAssembly=true --results-directory '${{ github.workspace }}/reports/coverage/' | |
| timeout-minutes: 5 | |
| # Mutation tests skipped for now due to CI limits and temporarily reduced test coverage... | |
| # This either requires cd to test directory or --solution-path CoreLoop.sln (which may not work). | |
| # - name: Stryker.NET mutation Tests for CoreLoop.Untp.csproj | |
| # if: ${{ matrix.os == 'ubuntu-latest' }} | |
| # run: dotnet stryker --config-file stryker-config.json --reporter progress --reporter html --reporter dashboard --dashboard-api-key ${{ secrets.STRYKER_API_KEY }} --project CoreLoop.UNTransparencyProtocol.csproj | |
| # timeout-minutes: 15 | |
| #- name: Upload Stryker output artefacts | |
| # if: ${{ matrix.os == 'ubuntu-latest' }} | |
| # uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a | |
| # with: | |
| # name: 'Stryker output artefacts' | |
| # path: ${{ github.workspace }}/StrykerOutput/ | |
| # - name: Publish | |
| # run: dotnet publish -c Release --verbosity normal -o ./publish/ | |
| # - name: Archive publish results | |
| # uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a | |
| # with: | |
| # name: CoreLoop.Benchmarks | |
| # path: ./publish/* | |
| # - name: Run Benchmarks | |
| # run: dotnet "./publish/CoreLoop.Benchmarks.dll" -f "CoreLoop.Benchmarks.*" | |
| # - name: Upload benchmark results | |
| # uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a | |
| # with: | |
| # name: Benchmark_Results | |
| # path: ./BenchmarkDotNet.Artifacts/results/* | |
| # This step is run always (e.g. also for non-PRs) so the results can be inspected on the command line too. | |
| # - name: ReportGenerator | |
| # if: ${{ matrix.os == 'ubuntu-latest' }} | |
| # If not using MSBuild driver but the VSTest one, the files need to be explicitly found due to randomized path segmenets. | |
| # See more at https://github.com/microsoft/vstest/issues/2378. | |
| # run: dotnet reportgenerator -assemblyfilters:'-xunit*' -reports:'${{ github.workspace }}/reports/coverage/coverage.cobertura.xml' -targetdir:'${{ github.workspace }}/reports/coverage/' -reporttypes:'HtmlInline;Cobertura;MarkdownSummary' | |
| # run: dotnet reportgenerator -assemblyfilters:'-xunit*' -reports:`find ${{ github.workspace }}/reports/coverage/ -name coverage.cobertura.xml` -targetdir:'${{ github.workspace }}/reports/coverage/' -reporttypes:'HtmlInline;Cobertura;MarkdownSummary' | |
| # - name: Publish coverage report | |
| # if: ${{ matrix.os == 'ubuntu-latest' }} | |
| # uses: 5monkeys/cobertura-action@master | |
| # with: | |
| # path: '${{ github.workspace }}/reports/coverage/Cobertura.xml' | |
| # repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| # minimum_coverage: 75 | |
| - name: Publish coverage summary | |
| if: ${{ matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }} | |
| uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 | |
| with: | |
| header: Report | |
| path: '${{ github.workspace }}/reports/coverage/Summary.md' | |
| recreate: true | |
| - name: Create test summary | |
| if: ${{ matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }} | |
| uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 | |
| with: | |
| paths: '${{ github.workspace }}/reports/coverage/TestResults.xml' | |
| # output: '${{ github.workspace }}/${{ env.file_name }}' | |
| # - name: Comment PR with the generated test Markdown | |
| # if: ${{ matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }} | |
| # uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 | |
| # with: | |
| # path: ${{ env.file_name }} | |
| # - name: Upload PR build information artefact | |
| # if: ${{ matrix.os == 'ubuntu-latest' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }} | |
| # uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a | |
| # with: | |
| # name: 'Test Run' | |
| # path: ${{ github.workspace }}/${{ env.file_name }} | |
| # - name: Comment PR with the generated test Markdown | |
| # if: ${{ matrix.os == 'ubuntu-latest' }} | |
| # uses: machine-learning-apps/pr-comment@78e77cd435e0f9706512ea294d846058ae46f7ff | |
| # env: | |
| # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # with: | |
| # path: ${{ env.file_name }} | |
| # - name: The sbom-tool does not generate the output directory and fails if it not present. | |
| - name: Create SBOM output directory | |
| run: mkdir -p "${{ github.workspace }}/${{ matrix.os }}/sbom/" | |
| # There may a difference in libraries between platforms, so the tool is being run on all platforms. | |
| - name: Run BOM analysis | |
| run: dotnet tool run sbom-tool generate -DeleteManifestDirIfPresent true -BuildDropPath "${{ github.workspace }}/${{ matrix.os }}/sbom/" -FetchLicenseInformation true -EnablePackageMetadataParsing true -BuildComponentPath . -PackageName "CoreLoop" -PackageSupplier "Lumoin" -NamespaceUriBase "https://lumoin.com/coreloop" -PackageVersion ${{ env.PACKAGE_VERSION }} -Verbosity Verbose | |
| - name: Pack NuGet files | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$CORELOOP_UNTP/$CORELOOP_UNTP.*proj | |
| # Note that on Windows this would be simply "dotnet dotnet-validate package local ./snupkgs/*.nupkg", the handling of an array of paths works directly. | |
| - name: Validate generated NuGet files | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| for file in ./nupkgs/*.nupkg; do | |
| dotnet dotnet-validate package local "$file" | |
| done | |
| - name: Upload CoreLoop NuGet packages | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a | |
| with: | |
| name: nupkg | |
| path: ./nupkgs/*.* | |
| # The release idea is inspired by https://dusted.codes/github-actions-for-dotnet-core-nuget-packages. | |
| prerelease: | |
| permissions: | |
| # For setup-dotnet to create package. | |
| packages: write | |
| needs: build | |
| if: ${{ github.ref == 'refs/heads/develop' && github.repository_owner == 'lumoin' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| aka.ms:443 | |
| api.github.com:443 | |
| api.nuget.org:443 | |
| dashboard.stryker-mutator.io:443 | |
| dotnetcli.azureedge.net:443 | |
| github.com:443 | |
| nuget.pkg.github.com:443 | |
| api.clearlydefined.io:443 | |
| - name: Download NuGet artifacts | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 | |
| with: | |
| name: nupkg | |
| - name: Push to GitHub developer feed | |
| run: dotnet nuget push "**/*.nupkg" --source $GITHUB_FEED --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate | |
| deploy: | |
| permissions: | |
| # For setup-dotnet to create package. | |
| packages: write | |
| needs: build | |
| if: ${{ github.event_name == 'release' && github.repository_owner == 'lumoin' }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde | |
| with: | |
| disable-sudo: true | |
| egress-policy: audit | |
| allowed-endpoints: > | |
| aka.ms:443 | |
| api.github.com:443 | |
| api.nuget.org:443 | |
| dashboard.stryker-mutator.io:443 | |
| dotnetcli.azureedge.net:443 | |
| github.com:443 | |
| nuget.pkg.github.com:443 | |
| - name: Download NuGet artifacts | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 | |
| with: | |
| name: nupkg | |
| - name: Push to GitHub developer feed | |
| run: dotnet nuget push "**/*.nupkg" --source $GITHUB_FEED --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate | |
| - name: Push to NuGet feed | |
| run: dotnet nuget push "**/*.nupkg" --source $NUGET_FEED --api-key ${{ secrets.NUGET_API_KEY }} --skip-duplicate |