ci.yml

name: "Build and Validate"

env:
  CAKE_TARGET: "BuildAll"
  CAKE_VERBOSITY: "Normal"
  RELEASE_MODE: "Beta"
  RUN_TESTS: "true"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions: {}

on:
  push:
    branches:
      - "develop"
      - "release/*"
  pull_request:
    branches:
      - "develop"
      - "release/*"
  workflow_dispatch:
    inputs:
      CAKE_TARGET:
        description: "Cake Target"
        type: "string"
        default: "BuildAll"
      CAKE_VERBOSITY:
        description: "Cake Verbosity"
        type: "choice"
        default: "Normal"
        options:
          - "Quiet"
          - "Minimal"
          - "Normal"
          - "Verbose"
          - "Diagnostic"
      RELEASE_MODE:
        description: "Release Mode"
        type: "choice"
        default: "Beta"
        options:
          - "Alpha"
          - "Beta"
          - "RC"
          - "Stable"
      RUN_TESTS:
        description: "Run Tests?"
        type: boolean
        default: true

jobs:
  build-and-validate:
    name: "Build and Validate"
    runs-on: "windows-2025-vs2026"
    permissions:
      checks: "write"
      pull-requests: "write"
    defaults:
      run:
        shell: "pwsh"
    steps:
      - name: "Setup Environment Variables"
        run: |
          "CAKE_TARGET=${{ inputs.CAKE_TARGET || env.CAKE_TARGET }}" >> $env:GITHUB_ENV;
          "CAKE_VERBOSITY=${{ inputs.CAKE_VERBOSITY || env.CAKE_VERBOSITY }}" >> $env:GITHUB_ENV;
          "RELEASE_MODE=${{ inputs.RELEASE_MODE || env.RELEASE_MODE }}" >> $env:GITHUB_ENV;
          "RUN_TESTS=${{ inputs.RUN_TESTS || env.RUN_TESTS }}" >> $env:GITHUB_ENV;

      - name: "Checkout"
        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
        with:
          fetch-depth: 0 # include all history for GitVersion

      # Built-in caching is broken for Yarn, using setup-node twice
      # See https://github.com/actions/setup-node/issues/531#issuecomment-3335630863
      - name: "Setup Node.js"
        uses: "actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f" # v6.3.0
        with:
          node-version-file: ".node-version"
          package-manager-cache: false

      - name: "Enable Corepack"
        run: "corepack enable"

      - name: "Setup Yarn cache"
        uses: "actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f" # v6.3.0
        with:
          cache: "yarn"

      - name: "Setup .NET SDK"
        uses: "actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7" # v5.2.0
        with:
          global-json-file: "global.json"

      - name: "Initialize Git User"
        run: |
          git config --global user.email 'noreply@dnncommunity.org';
          git config --global user.name 'DNN Platform CI Bot';

      - name: "Update Alpha/Beta/Stable flag"
        run: |
          $path = '.\DNN Platform\Library\Properties\AssemblyInfo.cs'
          $pattern3 = '\[assembly: AssemblyStatus'
          (Get-Content $path) | ForEach-Object {
            if ($_ -match $pattern3) {
            # We have found the matching line
            '[assembly: AssemblyStatus(ReleaseMode.{0})]' -f '${{ env.RELEASE_MODE }}'
          } else {
            $_
          }
          } | Set-Content $path

      - name: "Run DNN Build via Cake"
        run: "./build.ps1 --target=${{ env.CAKE_TARGET }} --verbosity=${{ env.CAKE_VERBOSITY }}"

      - name: "Run Unit Tests via Cake"
        if: ${{ env.RUN_TESTS == 'true' }}
        run: "./build.ps1 --target=UnitTests --verbosity=${{ env.CAKE_VERBOSITY }}"
        continue-on-error: true

      - name: "Publish Test Results"
        uses: "EnricoMi/publish-unit-test-result-action/windows@c950f6fb443cb5af20a377fd0dfaa78838901040" # v2.23.0
        if: ${{ !cancelled() && env.RUN_TESTS == 'true' }}
        with:
          files: "**/TestResults/*.trx"
          action_fail: true

      - name: "Publish Artifacts"
        id: "publish-artifacts-step"
        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
        if: ${{ !cancelled() }}
        with:
          path: "Artifacts"
          if-no-files-found: "error"
          compression-level: "0"
          overwrite: true

      - name: "Create GitHub Pull Request"
        if: ${{ success() && !contains('pull_request', github.event_name) && (contains(fromJSON('["develop", "main"]'), github.ref_name) || startsWith('release/', github.ref_name)) }}
        run: "./build.ps1 --target=CreateGitHubPullRequest --verbosity=${{ env.CAKE_VERBOSITY }}"
        env:
          GITHUB_APP_ID: ${{ secrets.GITHUB_APP_ID }}
          GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}

    outputs:
      artifact-id: ${{ steps.publish-artifacts-step.outputs.artifact-id }}

  attest-artifacts:
    name: "Attest Artifacts"
    needs: ["build-and-validate"]
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: "ubuntu-latest"
    permissions:
      id-token: "write"
      contents: "read"
      attestations: "write"
    steps:
      - name: "Download Artifacts"
        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
        with:
          artifact-ids: ${{ needs.build-and-validate.outputs.artifact-id }}

      - name: "Generate artifact attestations"
        uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0
        with:
          subject-path: |
            *.nupkg
            *.snupkg
            *.zip

  deploy-to-nuget:
    name: "Deploy to NuGet"
    needs: ["build-and-validate"]
    environment: "nuget.org"
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: "ubuntu-latest"
    permissions:
      id-token: "write"
    defaults:
      run:
        shell: "pwsh"
    steps:
      - name: "Download Artifacts"
        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
        with:
          artifact-ids: ${{ needs.build-and-validate.outputs.artifact-id }}

      - name: "NuGet login (OIDC → temp API key)"
        uses: "NuGet/login@d22cc5f58ff5b88bf9bd452535b4335137e24544" # v1
        id: "nuget-login"
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: "NuGet Push"
        run: "dotnet nuget push *.nupkg --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json"