diff --git a/.github/actions/purview-build/action.yml b/.github/actions/purview-build/action.yml index 697618e..c18b813 100644 --- a/.github/actions/purview-build/action.yml +++ b/.github/actions/purview-build/action.yml @@ -1,10 +1,9 @@ name: Purview Build description: >- - Installs the pinned Purview.Build dotnet tool from the Purview-Dev GitHub Packages feed and runs - it against the repository. Configuration flows through job environment variables (Build__*, - Release__*, NuGet__*, PublishLocalNuGet__*) and secrets (NUGET_APIKEY, GITHUB_TOKEN, - LOCAL_NUGET_FEED_PATH). + Installs the pinned Purview.Build dotnet tool from nuget.org and runs it against the repository. + Configuration flows through job environment variables (Build__*, Release__*, NuGet__*, + PublishLocalNuGet__*) and secrets (NUGET_APIKEY, GITHUB_TOKEN, LOCAL_NUGET_FEED_PATH). inputs: build-version: @@ -23,22 +22,11 @@ runs: with: dotnet-version: ${{ inputs.dotnet-version }} - - name: Authenticate to Purview-Dev packages - shell: bash - run: >- - dotnet nuget add source - "https://nuget.pkg.github.com/purview-dev/index.json" - --name purview-dev - --username "${{ github.actor }}" - --password "${{ github.token }}" - --store-password-in-clear-text - - name: Install pinned shared build shell: bash run: >- dotnet tool install Purview.Build --tool-path "${{ runner.temp }}/purview-build" - --source "https://nuget.pkg.github.com/purview-dev/index.json" --version "${{ inputs.build-version }}" - name: Run shared build diff --git a/.github/workflows/purview-build.yml b/.github/workflows/purview-build.yml index 8856be7..aa466a5 100644 --- a/.github/workflows/purview-build.yml +++ b/.github/workflows/purview-build.yml @@ -50,7 +50,7 @@ on: required: false permissions: - contents: write + contents: read packages: read jobs: @@ -68,20 +68,10 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version }} - - name: Authenticate to Purview-Dev packages - run: >- - dotnet nuget add source - "https://nuget.pkg.github.com/purview-dev/index.json" - --name purview-dev - --username "${{ github.actor }}" - --password "${{ github.token }}" - --store-password-in-clear-text - - name: Install pinned shared build run: >- dotnet tool install Purview.Build --tool-path "${{ runner.temp }}/purview-build" - --source "https://nuget.pkg.github.com/purview-dev/index.json" --version "${{ inputs.build-version }}" - name: Run shared build diff --git a/.github/workflows/purview-release.yml b/.github/workflows/purview-release.yml index 3a7deec..3c80223 100644 --- a/.github/workflows/purview-release.yml +++ b/.github/workflows/purview-release.yml @@ -100,22 +100,11 @@ jobs: echo "tag=$TAG" >> "$GITHUB_OUTPUT" fi - - name: Authenticate to Purview-Dev packages - if: steps.version.outputs.should_release == 'true' - run: >- - dotnet nuget add source - "https://nuget.pkg.github.com/purview-dev/index.json" - --name purview-dev - --username "${{ github.actor }}" - --password "${{ github.token }}" - --store-password-in-clear-text - - name: Install pinned shared build if: steps.version.outputs.should_release == 'true' run: >- dotnet tool install Purview.Build --tool-path "${{ runner.temp }}/purview-build" - --source "https://nuget.pkg.github.com/purview-dev/index.json" --version "${{ inputs.build-version }}" - name: Run release pipeline diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 70403f0..0ee4f8f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,7 +10,6 @@ on: permissions: contents: write - packages: write concurrency: group: purview-build-release @@ -66,6 +65,16 @@ jobs: -p:Version=${{ steps.version.outputs.version }} -p:PackageVersion=${{ steps.version.outputs.version }} + - name: Verify NuGet API key + if: steps.version.outputs.release == 'true' + env: + NUGET_APIKEY: ${{ secrets.NUGET_APIKEY }} + run: | + if [ -z "$NUGET_APIKEY" ]; then + echo "The NUGET_APIKEY secret is not set. It is required to publish Purview.Build to nuget.org." >&2 + exit 1 + fi + - name: Install packed tool if: steps.version.outputs.release == 'true' run: >- @@ -78,10 +87,10 @@ jobs: if: steps.version.outputs.release == 'true' env: GITHUB_TOKEN: ${{ github.token }} + NUGET_APIKEY: ${{ secrets.NUGET_APIKEY }} Release__Mode: NuGet Release__UploadArtifacts: "true" - NuGet__FeedUrl: https://nuget.pkg.github.com/purview-dev/index.json - NuGet__ApiKey: ${{ github.token }} + NuGet__FeedUrl: https://api.nuget.org/v3/index.json Build__RunTests: "false" Build__RunLint: "false" Build__ValidatePack: "false" diff --git a/README.md b/README.md index 1e71726..be5965d 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ on: The reusable workflow checks whether `v{version}` (read from `package.json`) is already tagged and skips if so, so merging `main` into `release` releases exactly once. -The reusable workflows authenticate to the internal feed and install the exact CLI version; the consuming repository adds `purview-build.json` and a root `package.json` version. It does not need a copied pipeline project or package-source credentials. +The reusable workflows install the exact CLI version from nuget.org; the consuming repository adds `purview-build.json` and a root `package.json` version. It does not need a copied pipeline project or package-source credentials. ### Minimal repository setup (composite action) @@ -73,7 +73,7 @@ jobs: ### Local use ```shell -dotnet tool install Purview.Build --tool-path ./.tools --add-source https://nuget.pkg.github.com/purview-dev/index.json --version 0.2.0 +dotnet tool install Purview.Build --tool-path ./.tools --version 0.2.1 ./.tools/purview-build ``` @@ -118,6 +118,6 @@ Version ───────────────┘ This repository dogfoods the shared tool: CI builds and packs the tool from source, installs the generated package, then runs `purview-build` against this repository so the project builds and packs itself. Locked restore and warnings-as-errors compilation gate every pull request and merge. -On a push to `main`, the release workflow rebuilds and reinstalls the tool from the current source, then runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` pointing at the Purview-Dev GitHub Packages registry, and `Release__UploadArtifacts=true`. The tool therefore publishes the immutable package to `https://nuget.pkg.github.com/purview-dev/index.json` and tags and releases itself (`v{Version}` + generated-notes GitHub release with the package attached) — exactly like every other purview-dev repository. Maintainers bump the `package.json` version and merge; they do not create release tags manually. +On a push to `main`, the release workflow rebuilds and reinstalls the tool from the current source, then runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` pointing at nuget.org, and `Release__UploadArtifacts=true`. The tool therefore publishes the immutable package to `https://api.nuget.org/v3/index.json` and tags and releases itself (`v{Version}` + generated-notes GitHub release with the package attached) — exactly like every other purview-dev repository. Maintainers bump the `package.json` version and merge; they do not create release tags manually. -After the first publication, an organization owner must set `Purview.Build` to **Internal** under Purview-Dev → Packages → Purview.Build → Package settings. GitHub initially creates NuGet packages as private. Also enable internal package creation under the organization's package settings if it is disabled. \ No newline at end of file +GitHub initially creates NuGet packages as private. To make sure every package is **Internal** (consumable by all Purview-Dev members), an organization owner should set the org default: Purview-Dev → Settings → Packages → **Package Creation** → **Internal**, and change any already-published package's visibility in its **Package settings** → **Danger Zone**. See [docs/releasing.md](docs/releasing.md) for the exact steps and the `gh api` alternative. \ No newline at end of file diff --git a/docs/releasing.md b/docs/releasing.md index 9cadc33..9f9c588 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -23,9 +23,25 @@ In both models the reusable `purview-release.yml` workflow reads `package.json`' This repository dogfoods the shared tool. CI performs locked restore, warnings-as-errors compilation, packing, installation from the generated package, then runs `purview-build` against this repository so the project builds and packs itself. -On a push to `main`, the release workflow reads and validates the `package.json` version, skips when `v{version}` already exists, then builds and installs the tool from the current source and runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` set to the Purview-Dev GitHub Packages registry, and `Release__UploadArtifacts=true`. The tool performs the release build/pack steps, publishes the immutable package to the registry, and creates `v{version}` plus a generated-notes GitHub release with the package attached — tagging itself exactly like every other purview-dev repository. The tool therefore owns tagging; maintainers must not push release tags manually. +On a push to `main`, the release workflow reads and validates the `package.json` version, skips when `v{version}` already exists, then builds and installs the tool from the current source and runs it with `Release__Mode=NuGet`, `NuGet__FeedUrl` set to nuget.org, and `Release__UploadArtifacts=true`. The tool performs the release build/pack steps, publishes the immutable package to `https://api.nuget.org/v3/index.json` using the `NUGET_APIKEY` secret, and creates `v{version}` plus a generated-notes GitHub release with the package attached — tagging itself exactly like every other purview-dev repository. The tool therefore owns tagging; maintainers must not push release tags manually. -GitHub creates the package as private on its first publication. An organization owner must make the package Internal once in the package settings so Purview-Dev members can consume it, and must permit internal package creation in the organization's package policy. NuGet versions are immutable; `--skip-duplicate` makes recovery safe if publication succeeded but tagging was interrupted. +GitHub creates NuGet packages as private on first publication. To make sure every package is **Internal** (visible to all Purview-Dev members), set both: + +1. **Organization default (prevents future private packages)** — org owner: + GitHub → purview-dev → Settings → Packages → **Package Creation** → select **Internal**. + New NuGet packages published by organization members then default to Internal. +2. **Existing packages already published while private** — org owner, per package: + `https://github.com/orgs/purview-dev/packages/nuget/package/` → **Package settings** → **Danger Zone** → **Change visibility** → **Internal**. + + Or via the CLI/API for every package on the registry: + + ```shell + gh api --method PATCH "/orgs/purview-dev/packages/nuget/Purview.Build" -f visibility=internal + ``` + + Public packages cannot be made private again; private → internal is safe. + +NuGet versions are immutable; `--skip-duplicate` makes recovery safe if publication succeeded but tagging was interrupted. ## For local validation diff --git a/package.json b/package.json index 03e9d75..e06d370 100644 --- a/package.json +++ b/package.json @@ -1,5 +1,5 @@ { "name": "purview-build", - "version": "0.2.0", + "version": "0.2.1", "private": true } \ No newline at end of file