Repository navigation
Add build and release workflows - #2
Merged
Merged
Conversation
The repository had no CI, which is why the Android targets in #1 went unverified, and releases were packed by hand. Both workflows run on windows-latest, and that matters: the Windows target frameworks are conditioned on the host OS in the csproj, so packing on macOS or Linux produces a package without them. Published 2.0.0 carries net9.0-windows and net10.0-windows; a Mac-built 2.1.0 would have dropped both and taken Windows support away from anyone already on the library. Each workflow therefore inspects the package it just built and fails if an Android, iOS, MacCatalyst or Windows target is missing. Build runs on pushes to main and on pull requests, and uploads the package so it can be inspected before release. Release runs on a v* tag, takes the version from the tag so the csproj and the published package cannot disagree, pushes to NuGet and creates the GitHub release. It needs a NUGET_API_KEY secret and says so plainly if it is missing.
nuget.org recommends trusted publishing, and it is the better fit here: the workflow exchanges this run's OIDC token for an API key that lives minutes, so there is no long-lived secret in the repository to leak or rotate, and a key cannot be used from anywhere else. The job gains id-token: write, NuGet/login@v1 performs the exchange, and the push uses the temporary key it returns. The nuget.org side needs a policy naming this repository and release.yml, and the workflow reads the nuget.org username from a NUGET_USER repository variable — a username is not a secret.
Owner
Author
|
Switched the publish step to trusted publishing as you suggested — pushed to this branch. The job now carries Two bits of setup instead, both documented in the README:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The repo had no CI — which is why the Android targets in #1 went unverified — and releases were packed by hand.
Why both run on
windows-latestThe Windows TFMs are conditioned on the host OS:
So packing anywhere else silently drops them. I hit this packing 2.1.0 on a Mac:
Publishing that would have removed Windows support for existing users, and NuGet versions can't be deleted. Both workflows now unzip the package they just built and fail if an Android, iOS, MacCatalyst or Windows target is missing.
What each does
mainand PRs: builds, packs, verifies targets, uploads the.nupkgas an artifact.v*tag: builds, packs, verifies, pushes to NuGet, creates the GitHub release.workflow_dispatchtakes an explicit version for a re-run.The version comes from the tag (
v2.1.0→2.1.0) and is passed as-p:PackageVersion, so the csproj value and the published package can't disagree.Before the first release
Add a
NUGET_API_KEYsecret under Settings → Secrets and variables → Actions. Without it the publish step stops with a clear message rather than failing obscurely. Then:git tag v2.1.0 && git push origin v2.1.0🤖 Generated with Claude Code
https://claude.ai/code/session_012fvKRoJiVhmmARSE8k7Vtf