pr.yml

name: pull request

on:
  pull_request:
    types: [opened, synchronize, reopened]

concurrency:
  group: pr-${{ github.event.number }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  version:
    name: resolve beta version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.resolve.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - id: resolve
        run: |
          # Base version lives in Directory.Build.props, as <dd-sdk-ios version>.<binding
          # revision>; the PR number and run number make each published prerelease unique, since
          # nuget.org never allows a version to be reused.
          native=$(sed -n 's:.*<DatadogNativeVersion>\(.*\)</DatadogNativeVersion>.*:\1:p' Directory.Build.props | head -1)
          revision=$(sed -n 's:.*<DatadogBindingRevision>\(.*\)</DatadogBindingRevision>.*:\1:p' Directory.Build.props | head -1)
          if [ -z "${native}" ] || [ -z "${revision}" ]; then
            echo "::error::could not read DatadogNativeVersion/DatadogBindingRevision from Directory.Build.props"
            exit 1
          fi
          version="${native}.${revision}-beta.${{ github.event.number }}.${{ github.run_number }}"
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "Building ${version}" >> "$GITHUB_STEP_SUMMARY"

  build:
    name: build
    needs: version
    uses: ./.github/workflows/build.yml
    with:
      version: ${{ needs.version.outputs.version }}

  publish:
    name: publish beta to nuget.org
    needs: [version, build]
    runs-on: ubuntu-latest
    # Forked pull requests get no OIDC token for this repository, so the exchange would fail with a
    # confusing error. Those PRs still build and test; only the publish step is skipped.
    if: github.event.pull_request.head.repo.full_name == github.repository
    # Must match the Environment on the nuget.org trusted publishing policy for this workflow.
    environment: nuget.org
    permissions:
      contents: read
      # Lets the job request the OIDC token that nuget.org exchanges for a short-lived API key.
      # Without it the token request fails silently and the login step gets no key.
      id-token: write
    steps:
      - name: Set up .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 9.0.x

      - name: Download packages
        uses: actions/download-artifact@v4
        with:
          name: nuget-packages
          path: artifacts

      # Deliberately immediately before the push: the issued key is valid for one hour, and each
      # OIDC token can be exchanged exactly once.
      - name: Authenticate to nuget.org
        id: nuget-login
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to nuget.org
        run: |
          # Symbol packages are pushed automatically alongside each matching .nupkg. The eleven
          # packages depend on each other at an exact version, so they are pushed together - a
          # partial push leaves ids that cannot restore.
          dotnet nuget push "artifacts/*.nupkg" \
            --source https://api.nuget.org/v3/index.json \
            --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \
            --skip-duplicate

      - name: Summarise
        run: |
          {
            echo "### Published \`${{ needs.version.outputs.version }}\` to nuget.org"
            echo
            for package in Core RUM Logs Trace SessionReplay WebViewTracking CrashReporting Flags Profiling Internal OpenTelemetryApi Objc; do
              id="DatadogNet.${package}.iOS"
              echo "- [${id}](https://www.nuget.org/packages/${id}/${{ needs.version.outputs.version }})"
            done
          } >> "$GITHUB_STEP_SUMMARY"