fix(ci): scope workflow permissions #8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull request pre-release | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| types: | |
| - opened | |
| - reopened | |
| - synchronize | |
| - closed | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish-prerelease: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| if: >- | |
| github.event.action != 'closed' && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout pull request commit | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| - name: Setup .NET 10 | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: 10.x | |
| - name: Install GitVersion | |
| uses: gittools/actions/gitversion/setup@7417b1089e2c7de93510f1901d656ddf60bb024f # v4.7.0 | |
| with: | |
| versionSpec: '6.7.x' | |
| - name: Determine version | |
| id: version | |
| shell: pwsh | |
| run: | | |
| $gitVersionJson = dotnet-gitversion "$env:GITHUB_WORKSPACE" /config VersionConfig.yml /output json | Out-String | |
| $gitVersion = ($gitVersionJson.TrimStart([char]0xFEFF) | ConvertFrom-Json) | |
| "fullSemVer=$($gitVersion.FullSemVer)" >> $env:GITHUB_OUTPUT | |
| "assemblySemVer=$($gitVersion.AssemblySemVer)" >> $env:GITHUB_OUTPUT | |
| "assemblySemFileVer=$($gitVersion.AssemblySemFileVer)" >> $env:GITHUB_OUTPUT | |
| - name: Restore dependencies | |
| run: dotnet restore --locked-mode | |
| working-directory: ./src | |
| - name: Build | |
| run: >- | |
| dotnet build --no-restore --configuration Release | |
| -p:Version=${{ steps.version.outputs.fullSemVer }} | |
| -p:AssemblyVersion=${{ steps.version.outputs.assemblySemVer }} | |
| -p:FileVersion=${{ steps.version.outputs.assemblySemFileVer }} | |
| working-directory: ./src | |
| - name: Test with coverage | |
| run: >- | |
| dotnet test --no-build --configuration Release --verbosity normal | |
| --collect:"XPlat Code Coverage" --results-directory ./TestResults | |
| working-directory: ./src | |
| - name: Pack pre-release packages | |
| run: >- | |
| dotnet pack --no-build --configuration Release --output ./nupkg | |
| -p:Version=${{ steps.version.outputs.fullSemVer }} | |
| -p:AssemblyVersion=${{ steps.version.outputs.assemblySemVer }} | |
| -p:FileVersion=${{ steps.version.outputs.assemblySemFileVer }} | |
| working-directory: ./src | |
| - name: Update pull request pre-release tag | |
| env: | |
| TAG: pr-${{ github.event.pull_request.number }} | |
| run: | | |
| git tag --force "$TAG" "${{ github.event.pull_request.head.sha }}" | |
| git push origin "refs/tags/$TAG" --force | |
| - name: Publish pre-release | |
| uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 | |
| with: | |
| tag: pr-${{ github.event.pull_request.number }} | |
| commit: ${{ github.event.pull_request.head.sha }} | |
| name: "Pre-release for PR #${{ github.event.pull_request.number }}" | |
| body: >- | |
| Evaluation packages for pull request #${{ github.event.pull_request.number }}. | |
| Package version: `${{ steps.version.outputs.fullSemVer }}`. | |
| This is not a stable release. | |
| prerelease: true | |
| allowUpdates: true | |
| updateOnlyUnreleased: true | |
| removeArtifacts: true | |
| artifacts: ./src/nupkg/*.nupkg,./src/nupkg/*.snupkg | |
| - name: Mark pull request as a pre-release | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const owner = context.repo.owner; | |
| const repo = context.repo.repo; | |
| const issue_number = context.issue.number; | |
| const label = 'pre-release'; | |
| try { | |
| await github.rest.issues.getLabel({ owner, repo, name: label }); | |
| } catch (error) { | |
| if (error.status !== 404) throw error; | |
| await github.rest.issues.createLabel({ | |
| owner, | |
| repo, | |
| name: label, | |
| color: '5319e7', | |
| description: 'A GitHub pre-release is available for this pull request.' | |
| }); | |
| } | |
| await github.rest.issues.addLabels({ owner, repo, issue_number, labels: [label] }); | |
| remove-prerelease: | |
| permissions: | |
| contents: write | |
| if: github.event.action == 'closed' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Remove pull request pre-release | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| const owner = context.repo.owner; | |
| const repo = context.repo.repo; | |
| const tag = `pr-${context.issue.number}`; | |
| try { | |
| const release = await github.rest.repos.getReleaseByTag({ owner, repo, tag }); | |
| await github.rest.repos.deleteRelease({ owner, repo, release_id: release.data.id }); | |
| } catch (error) { | |
| if (error.status !== 404) throw error; | |
| } | |
| try { | |
| await github.rest.git.deleteRef({ owner, repo, ref: `tags/${tag}` }); | |
| } catch (error) { | |
| if (error.status !== 422) throw error; | |
| } |