ci-cd.yml

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CONFIGURATION: Release

permissions:
  contents: read

jobs:
  # ---------------------------------------------------------------------
  # Test stage — runs on every push to main AND every pull request
  # ---------------------------------------------------------------------
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      # NotifyHub/NotifyHub.AspNetCore multi-target net8.0;net10.0 - both SDKs must be
      # installed side by side for one `dotnet test` run to exercise both.
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.0.x
            10.0.x
      - uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            nuget-${{ runner.os }}-
      - run: dotnet restore tests/NotifyHub.Tests/NotifyHub.Tests.csproj
      - run: dotnet test tests/NotifyHub.Tests/NotifyHub.Tests.csproj --configuration ${{ env.CONFIGURATION }} --no-restore

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.0.x
            10.0.x
      - uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            nuget-${{ runner.os }}-
      - run: dotnet restore NotifyHub.slnx
      - run: dotnet build NotifyHub.slnx --configuration ${{ env.CONFIGURATION }} --no-restore

  # ---------------------------------------------------------------------
  # Version / pack / release — push to main only
  # ---------------------------------------------------------------------
  get-version:
    needs: [test, build]
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    concurrency:
      group: notifyhub-release-chain
      cancel-in-progress: false
    # @semantic-release/github verifies push/write access as part of its plugin lifecycle
    # even during a dry run - a read-only token fails that check outright. No actual writes
    # happen here regardless of these permissions; dry_run: true never pushes/tags/releases.
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      next_version: ${{ steps.semrel.outputs.new_release_version }}
      published: ${{ steps.semrel.outputs.new_release_published }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: semrel
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          dry_run: true
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/github
            @semantic-release/git
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: No release needed for this push
        if: steps.semrel.outputs.new_release_published != 'true'
        run: |
          echo "No releasable commits since the last tag (e.g. docs/ci/chore-only) - this is the expected, common case with Conventional Commits, not a failure. Downstream jobs below skip themselves via needs.get-version.outputs.published." | tee -a "$GITHUB_STEP_SUMMARY"

  # Packs both libraries at the version semantic-release just determined and uploads the
  # .nupkg/.snupkg files as a build artifact for the release job to attach to the GitHub
  # Release. Deliberately does NOT push to nuget.org - no NUGET_API_KEY secret yet; add a
  # `dotnet nuget push ... --source https://api.nuget.org/v3/index.json` step here (gated
  # on that secret being set) once it exists.
  pack:
    needs: [get-version]
    if: github.event_name == 'push' && needs.get-version.outputs.published == 'true'
    runs-on: ubuntu-latest
    env:
      NEXT_VERSION: ${{ needs.get-version.outputs.next_version }}
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.0.x
            10.0.x
      - uses: actions/cache@v6
        with:
          path: ~/.nuget/packages
          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
          restore-keys: |
            nuget-${{ runner.os }}-
      - run: dotnet pack src/NotifyHub/NotifyHub.csproj --configuration ${{ env.CONFIGURATION }} -p:Version=${{ env.NEXT_VERSION }} -o ${{ github.workspace }}/artifacts/nuget
      - run: dotnet pack src/NotifyHub.AspNetCore/NotifyHub.AspNetCore.csproj --configuration ${{ env.CONFIGURATION }} -p:Version=${{ env.NEXT_VERSION }} -o ${{ github.workspace }}/artifacts/nuget
      - uses: actions/upload-artifact@v7
        with:
          name: nuget-packages
          path: artifacts/nuget/*
          retention-days: 7

  semantic-release:
    # get-version listed explicitly (not just transitively via pack) so its outputs are
    # reliably accessible below - GitHub Actions' needs context only guarantees access to
    # directly-listed dependencies.
    needs: [get-version, pack]
    if: github.event_name == 'push' && needs.get-version.outputs.published == 'true'
    runs-on: ubuntu-latest
    concurrency:
      group: notifyhub-release-chain
      cancel-in-progress: false
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/download-artifact@v8
        with:
          name: nuget-packages
          path: packages
      - id: semrel
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/github
            @semantic-release/git
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true
      # Retry once for the narrow window where an out-of-band push to main landed between
      # this job's checkout and its own push (the concurrency group above already serializes
      # overlapping runs of this workflow, so this only guards against a genuinely external push).
      - if: steps.semrel.outcome == 'failure'
        run: |
          git fetch origin main
          git checkout -B main origin/main
      - if: steps.semrel.outcome == 'failure'
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/github
            @semantic-release/git
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}