on-prerelease.yml

# SPDX-License-Identifier: Apache-2.0
# Licensed to the Ed-Fi Alliance under one or more agreements.
# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
# See the LICENSE and NOTICES files in the project root for more information.

name: On Pre-Release
on:
  release:
    types:
      - prereleased

env:
  ARTIFACTS_API_KEY: ${{ secrets.AZURE_ARTIFACTS_PERSONAL_ACCESS_TOKEN }}
  AZURE_ARTIFACT_URL: "https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_packaging/EdFi/nuget/v3/index.json"
  VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: '{"endpointCredentials": [{"endpoint": "https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_packaging/EdFi/nuget/v3/index.json","password": "${{ secrets.AZURE_ARTIFACTS_PERSONAL_ACCESS_TOKEN }}"}]}'
  MANIFEST_FILE: "_manifest/spdx_2.2/manifest.spdx.json"
  PACKAGE_NAME: "EdFi.ApiPublisher"

jobs:
  pack:
    name: Build and Pack
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: pwsh
    outputs:
      hash-code: ${{ steps.hash-code.outputs.hash-code }}
      api-pub-version: ${{ steps.versions.outputs.api-pub }}

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1
        with:
          fetch-depth: 0

      - name: Set Version Numbers
        id: versions
        run: |
          $appPrefix = "v"

          # Install the MinVer CLI tool
          &dotnet tool install --global minver-cli

          $appVersion = $(minver -t $appPrefix)

          # Full release name
          "api-pub=$appVersion" >> $env:GITHUB_OUTPUT

          # SemVer
          "api-pub-semver=$($appVersion -Replace $appPrefix)" >> $env:GITHUB_OUTPUT

      - name: Setup .NET
        uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3.0.3
        with:
          dotnet-version: 8.0.x

      - name: Publish .NET Assemblies
        run: |
          $appVersion = "${{ steps.versions.outputs.api-pub-semver }}"

          ./build.ps1 -Command BuildAndPublish `
              -Configuration Release `
              -Version $appVersion

      - name: Setup Nuget.exe
        uses: nuget/setup-nuget@a21f25cd3998bf370fde17e3f1b4c12c175172f9  #v2.0.0

      - name: Create NuGet Packages
        if: success()
        run: |
          $appVersion = "${{ steps.versions.outputs.api-pub-semver }}"

          "Building ${{ env.PACKAGE_NAME }} NuGet Package" | Write-Output
          # ApiPublisher
          ./build.ps1 -Command Package `
              -Version $appVersion `
              -Configuration Release

      - name: Generate hash for NuGet package
        id: hash-code
        shell: bash
        run: |
          echo "hash-code=$(sha256sum *.nupkg | base64 -w0)" >> $GITHUB_OUTPUT

      - name: Upload Packages as Artifacts
        if: success()
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: "${{ env.PACKAGE_NAME }}-NuGet"
          path: ./*.nupkg
          if-no-files-found: error
          retention-days: 30

  sbom-create:
    name: Create SBOM
    runs-on: ubuntu-latest
    needs: pack
    permissions:
      actions: read
      contents: write
    outputs:
      sbom-hash-code: ${{ steps.sbom-hash-code.outputs.sbom-hash-code }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Get Artifacts
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a #v3.0.2
        with:
          name: ${{ env.PACKAGE_NAME }}-NuGet

      - name: Generate Software Bill of Materials (SBOM) - API
        shell: pwsh
        run: |
          $packageName = "${{ env.PACKAGE_NAME }}"

          $url = "https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64"
          $out = "$($env:RUNNER_TEMP)/sbom-tool"
          Invoke-RestMethod -Uri $url -OutFile $out
          chmod +x $out

          Get-ChildItem -Include "$packageName.*.nupkg" -Recurse | ForEach-Object { $_.FullName } > buildfilelist.txt
          New-Item -Path manifest -Type Directory

          $version = "${{ needs.pack.outputs.api-pub-version }}"

          &$out generate `
              -b ./ `
              -bl ./buildfilelist.txt `
              -bc "./src/EdFi.Tools.ApiPublisher.Cli" `
              -pn "$packageName" `
              -pv $version `
              -nsb https://ed-fi.org `
              -m manifest `
              -ps "Ed-Fi Alliance"

      - name: Upload SBOM
        if: success()
        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
        with:
          name: ${{ env.PACKAGE_NAME }}-SBOM
          path: ./manifest
          if-no-files-found: error
          retention-days: 30

      - name: Generate hash code for SBOM
        id: sbom-hash-code
        shell: bash
        run: |
          # sha256sum returns "<hashcode>  <name of file". Split that and return only the <hashcode>.
          sbom_hash=$(sha256sum ./manifest/${{ env.MANIFEST_FILE }} | awk '{split($0,a); print a[1]}')
          echo "sbom-hash-code=$sbom_hash" >> $GITHUB_OUTPUT

  sbom-attach:
    name: Attach SBOM file
    runs-on: ubuntu-latest
    needs:
      - sbom-create
      - pack
    permissions:
      actions: read
      contents: write
    steps:
      - name: Download the SBOM
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@07e64b653f10a80b6510f4568f685f8b7b9ea830  # v1.9.0
        with:
          name: "${{ env.PACKAGE_NAME }}-SBOM"
          path: ${{ env.MANIFEST_FILE }}
          sha256: "${{ needs.sbom-create.outputs.sbom-hash-code }}"

      - name: Attach to release
        shell: pwsh
        run: |
          $release = "${{ github.ref_name }}"
          $repo = "${{ github.repository }}"
          $token = "${{ secrets.GITHUB_TOKEN }}"
          $file = "${{ env.MANIFEST_FILE }}"
          $uploadName = "${{ env.PACKAGE_NAME }}-SBOM.zip"

          $url = "https://api.github.com/repos/$repo/releases/tags/$release"

          $gh_headers = @{
              "Accept"        = "application/vnd.github+json"
              "Authorization" = "Bearer $token"
          }

          $response = Invoke-RestMethod -Uri $url -Headers $gh_headers
          $releaseId = $response.id

          $url = "https://uploads.github.com/repos/$repo/releases/$releaseId/assets"

          Compress-Archive $file -DestinationPath $uploadName

          $gh_headers["Content-Type"] = "application/octet"
          Invoke-RestMethod -Method POST `
              -Uri "$($url)?name=$($uploadName)" `
              -Headers $gh_headers `
              -InFile $uploadName

  provenance-create:
    name: Create Provenance
    needs: pack
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: Ed-Fi-Alliance-OSS/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.5.0
    with:
      base64-subjects: ${{ needs.pack.outputs.hash-code }}
      provenance-name: EdFi.ApiPublisher.intoto.jsonl
      upload-assets: true

  publish-package:
    name: Publish NuGet Package
    needs: pack
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: pwsh
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

      - name: Get Artifact
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a #v3.0.2
        with:
          name: ${{ env.PACKAGE_NAME }}-NuGet

      - name: Install-credential-handler
        run: iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx"

      - name: Push Package to Azure Artifacts
        run: |
          $artifact = (Get-ChildItem -Path $_ -Name -Include *.nupkg)
          $arguments = @{
            EdFiNuGetFeed = "${{ env.AZURE_ARTIFACT_URL }}"
            NuGetApiKey = "${{ env.ARTIFACTS_API_KEY }}"
          }

          $artifact | ForEach-Object {
              $arguments.PackageFile = $_
              ./build.ps1 Push @arguments
           }