ci.yml

# If this file is renamed, the incrementing run attempt number will be reset.

name: CI

on:
  push:
    branches: [ "dev", "main" ]
  pull_request:
    branches: [ "dev", "main" ]
  workflow_dispatch:
    inputs:
      publish:
        description: 'Publish a GitHub release'
        type: boolean
        required: true
        default: true

env:
  CI_BUILD_NUMBER_BASE: ${{ github.run_number }}
  CI_TARGET_BRANCH: ${{ github.head_ref || github.ref_name }}
  CI_PUBLISH: ${{ (github.event_name == 'push' && github.ref_name == 'main') || inputs.publish }}

jobs:
  build-windows:
    name: Build (Windows)
    runs-on: windows-latest

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6
      - name: Setup
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Build and Publish
        env:
          DOTNET_CLI_TELEMETRY_OPTOUT: true
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: pwsh
        run: |
          ./build/Build.Windows.ps1
      - name: Upload archives
        # Consumed by the publish-npm job
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@v7
        with:
          name: archives
          path: |
            artifacts/seqcli-*-*.zip
            artifacts/seqcli-*-*.tar.gz
          if-no-files-found: error
          retention-days: 1

  build-linux:
    name: Build (Linux)
    runs-on: ubuntu-24.04

    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v6
      - name: Setup
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 10.0.x
      - name: Configure Docker
        run: |
          docker run --privileged --rm linuxkit/binfmt:bebbae0c1100ebf7bf2ad4dfb9dfd719cf0ef132
          sudo service docker restart
      - name: Build and Publish
        env:
          DOTNET_CLI_TELEMETRY_OPTOUT: true
          DOCKER_USER: ${{ secrets.DOCKER_USER }}
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
          SEQ_DOCKER_TAG: 2026.1
        shell: pwsh
        run: |
          ./build/Build.Linux.ps1 -SeqDockerTag $env:SEQ_DOCKER_TAG

  publish-npm:
    name: Publish (npm)
    runs-on: ubuntu-24.04
    needs: build-windows

    # Mirrors NuGet publishing: builds from any branch this workflow targets (dev builds as
    # prereleases under the `dev` dist-tag, main builds as `latest`), but never pull requests.
    if: github.event_name != 'pull_request'

    permissions:
      contents: read
      # Required for npm trusted publishing (OIDC) and provenance
      id-token: write

    steps:
      - uses: actions/checkout@v6
      - name: Setup
        uses: actions/setup-node@v7
        with:
          node-version: 24.x
          # Bootstrap only: together with NODE_AUTH_TOKEN below, authenticates using the NPM_TOKEN
          # secret. Once trusted publishing is configured for every @datalust/seqcli* package
          # (bound to this workflow file, ci.yml), remove `registry-url` here and `NODE_AUTH_TOKEN`
          # below so that npm authenticates with the OIDC token instead.
          registry-url: https://registry.npmjs.org/
      - name: Update npm
        # Trusted publishing and automatic provenance require npm 11.5.1 or later
        run: |
          npm install -g npm@latest
          npm --version
      - name: Download archives
        uses: actions/download-artifact@v8
        with:
          name: archives
          path: npm-archives
      - name: Publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        shell: pwsh
        run: |
          ./build/Build.Npm.ps1 -ArchiveDir ./npm-archives