dotnet.yml

name: .NET Workflow

on:
  push:
    branches: [main, develop]
    paths-ignore:
      ["**.md", ".github/ISSUE_TEMPLATE/**", ".github/pull_request_template.md"]
  pull_request:
    paths-ignore:
      ["**.md", ".github/ISSUE_TEMPLATE/**", ".github/pull_request_template.md"]
  schedule:
    - cron: "0 23 * * *" # Daily at 11 PM UTC
  workflow_dispatch: # Allow manual triggers
    inputs:
      version-bump:
        description: 'Version bump type'
        required: false
        default: 'auto'
        type: choice
        options:
          - auto
          - patch
          - minor
          - major

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Default permissions
permissions:
  contents: read

env:
  DOTNET_VERSION: "10.0" # Only needed for actions/setup-dotnet

jobs:
  build:
    name: Build, Test & Release
    runs-on: windows-latest
    timeout-minutes: 20
    permissions:
      contents: write # For creating releases and committing metadata
      packages: write # For publishing packages

    outputs:
      version: ${{ steps.pipeline.outputs.version }}
      release_hash: ${{ steps.pipeline.outputs.release_hash }}
      should_release: ${{ steps.pipeline.outputs.should_release }}

    steps:
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: "zulu" # Alternative distribution options are available.

      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full history for versioning
          fetch-tags: true
          lfs: true
          submodules: recursive
          persist-credentials: true

      - name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}.x
          cache: true
          cache-dependency-path: "**/*.csproj"

      # Ensure NuGet packages directory exists for caching (prevents error when pipeline exits early)
      - name: Ensure NuGet cache directory exists
        run: New-Item -Path "$env:USERPROFILE\.nuget\packages" -ItemType Directory -Force
        shell: pwsh

      - name: Cache SonarQube Cloud packages
        if: ${{ env.SONAR_TOKEN != '' }}
        uses: actions/cache@v4
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          path: ~\sonar\cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Cache SonarQube Cloud scanner
        if: ${{ env.SONAR_TOKEN != '' }}
        id: cache-sonar-scanner
        uses: actions/cache@v4
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          path: .\.sonar\scanner
          key: ${{ runner.os }}-sonar-scanner
          restore-keys: ${{ runner.os }}-sonar-scanner

      - name: Install SonarQube Cloud scanner
        if: ${{ env.SONAR_TOKEN != '' && steps.cache-sonar-scanner.outputs.cache-hit != 'true' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        shell: powershell
        run: |
          New-Item -Path .\.sonar\scanner -ItemType Directory
          dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner

      - name: Configure SonarQube exclusions
        shell: bash
        run: |
          EXCLUSIONS="_temp/**,_actions/**"
          if [ "${{ github.event.repository.name }}" != "KtsuBuild" ]; then
            EXCLUSIONS="$EXCLUSIONS,**/KtsuBuild/**"
          fi
          echo "SONAR_EXCLUSIONS=$EXCLUSIONS" >> $GITHUB_ENV

      - name: Begin SonarQube
        if: ${{ env.SONAR_TOKEN != '' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        shell: powershell
        run: |
          .\.sonar\scanner\dotnet-sonarscanner begin /k:"${{ github.repository_owner }}_${{ github.event.repository.name }}" /o:"${{ github.repository_owner }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths="coverage/coverage.xml" /d:sonar.coverage.exclusions="**/*Test*.cs,**/*.Tests.cs,**/*.Tests/**/*,**/obj/**/*,**/*.dll" /d:sonar.cs.vstest.reportsPaths="coverage/TestResults/**/*.trx" /d:sonar.exclusions="${{ env.SONAR_EXCLUSIONS }}"

      - name: Clone KtsuBuild (Latest Tag)
        run: |
          LATEST_TAG=$(git ls-remote --tags https://github.com/ktsu-dev/KtsuBuild.git | grep -o 'refs/tags/v[0-9]*\.[0-9]*\.[0-9]*$' | sed 's/refs\/tags\///' | sort -V | tail -1 || true)
          if [ -z "$LATEST_TAG" ]; then
            echo "No version tags found, falling back to HEAD"
            git clone --depth 1 https://github.com/ktsu-dev/KtsuBuild.git "${{ runner.temp }}/KtsuBuild"
          else
            echo "Cloning KtsuBuild at tag: $LATEST_TAG"
            git clone --depth 1 --branch "$LATEST_TAG" https://github.com/ktsu-dev/KtsuBuild.git "${{ runner.temp }}/KtsuBuild"
          fi
        shell: bash

      - name: Run KtsuBuild CI Pipeline
        id: pipeline
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
          NUGET_API_KEY: ${{ secrets.NUGET_KEY }}
          KTSU_PACKAGE_KEY: ${{ secrets.KTSU_PACKAGE_KEY }}
          EXPECTED_OWNER: ktsu-dev
        run: |
          # Run the CI pipeline
          $versionBump = "${{ github.event.inputs.version-bump }}"

          # Build arguments array - only add --version-bump if explicitly set (for backward compatibility during bootstrap)
          $args = @("ci", "--workspace", "${{ github.workspace }}", "--verbose")
          if (![string]::IsNullOrEmpty($versionBump) -and $versionBump -ne "auto") {
            $args += @("--version-bump", $versionBump)
          }

          & dotnet run --project "${{ runner.temp }}/KtsuBuild/KtsuBuild.CLI" -- @args

          # Set outputs for downstream jobs
          $version = (Get-Content "${{ github.workspace }}/VERSION.md" -Raw).Trim()
          "version=$version" >> $env:GITHUB_OUTPUT

          $releaseHash = git rev-parse HEAD
          "release_hash=$releaseHash" >> $env:GITHUB_OUTPUT

          # Compute should_release (same logic as BuildConfigurationProvider)
          $isMain = "${{ github.ref }}" -eq "refs/heads/main"
          $isTagged = [bool](git tag --points-at "${{ github.sha }}" 2>$null)
          $isFork = "${{ github.event.repository.fork }}" -eq "true"
          $isExpectedOwner = "${{ github.repository_owner }}" -eq "ktsu-dev"
          $isOfficial = (-not $isFork) -and $isExpectedOwner
          $shouldRelease = $isMain -and (-not $isTagged) -and $isOfficial
          "should_release=$($shouldRelease.ToString().ToLower())" >> $env:GITHUB_OUTPUT

      - name: End SonarQube
        if: env.SONAR_TOKEN != ''
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        shell: powershell
        run: |
          .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"

      - name: Upload Coverage Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: |
            ./coverage/*
          retention-days: 7

  winget:
    name: Update Winget Manifests
    needs: build
    if: needs.build.outputs.should_release == 'true'
    runs-on: windows-latest
    timeout-minutes: 10
    permissions:
      contents: write

    steps:
      - name: Checkout Release Commit
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.build.outputs.release_hash }}
          fetch-depth: 0 # Full history for better auto-detection

      - name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}.x

      - name: Clone KtsuBuild (Latest Tag)
        run: |
          LATEST_TAG=$(git ls-remote --tags https://github.com/ktsu-dev/KtsuBuild.git | grep -o 'refs/tags/v[0-9]*\.[0-9]*\.[0-9]*$' | sed 's/refs\/tags\///' | sort -V | tail -1 || true)
          if [ -z "$LATEST_TAG" ]; then
            echo "No version tags found, falling back to HEAD"
            git clone --depth 1 https://github.com/ktsu-dev/KtsuBuild.git "${{ runner.temp }}/KtsuBuild"
          else
            echo "Cloning KtsuBuild at tag: $LATEST_TAG"
            git clone --depth 1 --branch "$LATEST_TAG" https://github.com/ktsu-dev/KtsuBuild.git "${{ runner.temp }}/KtsuBuild"
          fi
        shell: bash

      - name: Update Winget Manifests
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          dotnet run --project "${{ runner.temp }}/KtsuBuild/KtsuBuild.CLI" -- winget generate --version "${{ needs.build.outputs.version }}" --workspace "${{ github.workspace }}" --verbose

      - name: Upload Updated Manifests
        uses: actions/upload-artifact@v4
        with:
          name: winget-manifests-${{ needs.build.outputs.version }}
          path: winget/*.yaml
          retention-days: 30

  security:
    name: Security Scanning
    needs: build
    if: needs.build.outputs.should_release == 'true'
    runs-on: windows-latest
    timeout-minutes: 10
    permissions:
      id-token: write # For dependency submission
      contents: write # For dependency submission

    steps:
      - name: Checkout Release Commit
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.build.outputs.release_hash }}

      - name: Detect Dependencies
        uses: advanced-security/component-detection-dependency-submission-action@v0.0.2