From 87dc8b9d17cec7fabc9500cdc9ff92e3f92adfee Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:38:21 +1200 Subject: [PATCH 1/4] ci: fix release trigger and .NET setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The create trigger fires on every branch creation; releases now trigger on tag push. setup-dotnet pinned the exact 10.0.0 SDK with a manual fallback guarded by if: failure(), which never runs after continue-on-error — 10.0.x makes both the pin and the dead fallback unnecessary. Adds the missing contents: write permission the release upload relies on. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 33 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 1fd44aa..cb4f422 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -3,7 +3,6 @@ name: .NET on: push: branches: [ master ] - create: tags: - '*.*.*' pull_request: @@ -11,45 +10,39 @@ on: jobs: build: runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@v4 - - name: Setup .NET 10 - uses: actions/setup-dotnet@v4 + - name: Setup .NET + uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.0' - continue-on-error: true - - name: Fallback - Install .NET 10 manually - if: failure() - run: | - wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh - chmod +x dotnet-install.sh - ./dotnet-install.sh --channel 10.0 --install-dir $HOME/.dotnet - echo "$HOME/.dotnet" >> $GITHUB_PATH - + dotnet-version: '10.0.x' + - name: Check Tag id: check-tag run: | - if [[ v${{ github.event.ref }} =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if [[ ${{ github.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi - + - name: Run Unit Tests run: | dotnet restore dotnet build dotnet test --no-build --filter TestCategory!=OPTIONAL-TEST - + - name: Build Artifact if: steps.check-tag.outputs.match == 'true' id: build_artifact run: | + TAG_NAME=${GITHUB_REF#refs/tags/} dotnet restore dotnet build -c Release dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg - dotnet nuget push /tmp/nupkgs/NosCore.Networking.${{github.event.ref}}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} - echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.Networking.${{github.event.ref}}.nupkg" >> $GITHUB_OUTPUT - echo "ARTIFACT_NAME=NosCore.Networking.${{github.event.ref}}.nupkg" >> $GITHUB_OUTPUT - + dotnet nuget push /tmp/nupkgs/NosCore.Networking.${TAG_NAME}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} + echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.Networking.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT + - name: Upload Release Asset if: steps.check-tag.outputs.match == 'true' uses: softprops/action-gh-release@v2 From 90e505bdc1ff2f150ad8bcd938c13c4eed8cfca3 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:49:15 +1200 Subject: [PATCH 2/4] ci: read GITHUB_REF from the environment, version the package from the tag Interpolating github.ref into the Bash source lets a crafted tag execute shell code on a runner holding the NuGet key before the regex check runs; reading $GITHUB_REF from the environment removes the injection point. PackageVersion now comes from the tag so a tag no longer has to match the csproj version for the push path to exist. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index cb4f422..83935d9 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -22,7 +22,7 @@ jobs: - name: Check Tag id: check-tag run: | - if [[ ${{ github.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+.[0-9]+.[0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi @@ -39,7 +39,7 @@ jobs: TAG_NAME=${GITHUB_REF#refs/tags/} dotnet restore dotnet build -c Release - dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg + dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:PackageVersion=${TAG_NAME} dotnet nuget push /tmp/nupkgs/NosCore.Networking.${TAG_NAME}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.Networking.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT From 70f55ba9ba0db80cb1ecb968202028bfb31dbad6 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:51:28 +1200 Subject: [PATCH 3/4] ci: match literal dots in the tag regex Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 83935d9..c05cedc 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -22,7 +22,7 @@ jobs: - name: Check Tag id: check-tag run: | - if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+.[0-9]+.[0-9]+$ ]]; then + if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+[.][0-9]+[.][0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi From 7bbfae6a2d2fff8f5237171de39ad0998118fc47 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 21:23:55 +1200 Subject: [PATCH 4/4] ci: read-only build job, write token confined to the tag release job Build and test ran pull-request code in a job holding a contents: write token that checkout also persisted into .git/config. Validation now runs in a read-only job with persist-credentials: false; packing, the NuGet push and the release upload move to a tag-gated job that alone gets contents: write. action-gh-release bumped to v3 for the current runner runtime. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index c05cedc..24ae10b 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -7,13 +7,38 @@ on: - '*.*.*' pull_request: branches: [ master ] + +permissions: + contents: read + jobs: build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Setup .NET + uses: actions/setup-dotnet@v5 + with: + dotnet-version: '10.0.x' + + - name: Run Unit Tests + run: | + dotnet restore + dotnet build + dotnet test --no-build --filter TestCategory!=OPTIONAL-TEST + + release: + needs: build + if: startsWith(github.ref, 'refs/tags/') runs-on: ubuntu-latest permissions: contents: write steps: - uses: actions/checkout@v4 + with: + persist-credentials: false - name: Setup .NET uses: actions/setup-dotnet@v5 with: @@ -26,13 +51,7 @@ jobs: echo "match=true" >> $GITHUB_OUTPUT fi - - name: Run Unit Tests - run: | - dotnet restore - dotnet build - dotnet test --no-build --filter TestCategory!=OPTIONAL-TEST - - - name: Build Artifact + - name: Pack and push to NuGet if: steps.check-tag.outputs.match == 'true' id: build_artifact run: | @@ -45,7 +64,7 @@ jobs: - name: Upload Release Asset if: steps.check-tag.outputs.match == 'true' - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: files: ${{ steps.build_artifact.outputs.ARTIFACT_PATH }} env: