From ffd23b6ee065b3b419dcf7a40c69b923fd71aac6 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:40:30 +1200 Subject: [PATCH 1/3] ci: trigger releases on tag push, attach the nupkg instead of the snupkg MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The create trigger fires on every branch creation; releases now trigger on tag push with the tag name derived from GITHUB_REF. The release asset output also pointed at the .snupkg while the package pushed to nuget.org is the .nupkg — the release now carries the same artifact. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index d12c9d2..090115f 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -3,7 +3,6 @@ name: .NET on: push: branches: [ master ] - create: tags: - '*.*.*' pull_request: @@ -19,34 +18,33 @@ jobs: uses: actions/setup-dotnet@v5 with: dotnet-version: '10.0.x' - + - name: Check Tag id: check-tag run: | - if [[ v${{ github.event.ref }} =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if [[ ${{ github.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi - + - name: Run Unit Tests run: | dotnet restore dotnet build dotnet test test/NosCore.ParserInputGenerator.Tests -v m - + - name: Build Artifact if: steps.check-tag.outputs.match == 'true' id: build_artifact run: | + TAG_NAME=${GITHUB_REF#refs/tags/} dotnet restore dotnet build -c Release dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg - dotnet nuget push /tmp/nupkgs/NosCore.ParserInputGenerator.${{github.event.ref}}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} - echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.ParserInputGenerator.${{github.event.ref}}.snupkg" >> $GITHUB_OUTPUT - echo "ARTIFACT_NAME=NosCore.ParserInputGenerator.${{github.event.ref}}.snupkg" >> $GITHUB_OUTPUT - + dotnet nuget push /tmp/nupkgs/NosCore.ParserInputGenerator.${TAG_NAME}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} + echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.ParserInputGenerator.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT + - name: Upload Release Asset if: steps.check-tag.outputs.match == 'true' uses: softprops/action-gh-release@v2 with: files: ${{ steps.build_artifact.outputs.ARTIFACT_PATH }} - From 3c8011ea55a27abb78fccfa8fa6642c7e2eff26f Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:49:30 +1200 Subject: [PATCH 2/3] ci: read GITHUB_REF from the environment, version the package from the tag Interpolating github.ref into the Bash source lets a crafted tag execute shell code on a runner holding the NuGet key before the regex check runs; reading $GITHUB_REF from the environment removes the injection point. PackageVersion now comes from the tag so a tag no longer has to match the csproj version for the push path to exist. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 090115f..bc3764b 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -22,7 +22,7 @@ jobs: - name: Check Tag id: check-tag run: | - if [[ ${{ github.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+.[0-9]+.[0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi @@ -39,7 +39,7 @@ jobs: TAG_NAME=${GITHUB_REF#refs/tags/} dotnet restore dotnet build -c Release - dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg + dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:PackageVersion=${TAG_NAME} dotnet nuget push /tmp/nupkgs/NosCore.ParserInputGenerator.${TAG_NAME}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.ParserInputGenerator.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT From e38cc2c8114d7cbc7013f9ff49ab1ddae167bf9d Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:51:42 +1200 Subject: [PATCH 3/3] ci: match literal dots in the tag regex Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index bc3764b..15f960c 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -22,7 +22,7 @@ jobs: - name: Check Tag id: check-tag run: | - if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+.[0-9]+.[0-9]+$ ]]; then + if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+[.][0-9]+[.][0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi