Skip to content

Commit 75a020d

Browse files
nquinquenelnquinquenel
committed
Add build axis, upload artifacts, restrict to private repox, introduce package locking
1 parent 5041e0d commit 75a020d

File tree

58 files changed

+105298
-51
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+105298
-51
lines changed

‎.github/workflows/build-fork.yml‎

Lines changed: 105 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -10,40 +10,112 @@ on:
1010
merge_group:
1111
workflow_dispatch:
1212

13+
permissions:
14+
id-token: write
15+
contents: write
16+
17+
env:
18+
DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "true"
19+
DOTNET_CLI_TELEMETRY_OPTOUT: "true"
20+
1321
jobs:
14-
build:
22+
build_windows:
1523
runs-on: github-windows-latest-s
16-
name: Build
17-
permissions:
18-
id-token: write
19-
contents: write
24+
name: Build Windows (net472 + net6)
25+
steps:
26+
- uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
27+
with:
28+
version: 2025.7.12
29+
30+
- name: Checkout
31+
uses: actions/checkout@v4
32+
with:
33+
clean: "false"
34+
fetch-depth: "0"
35+
36+
- name: 🎁 Get Repox Credentials from Vault
37+
id: secrets
38+
uses: SonarSource/vault-action-wrapper@v3
39+
with:
40+
secrets: |
41+
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader username | ARTIFACTORY_USER;
42+
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN;
43+
development/kv/data/next url | SQS_NEXT_URL;
44+
development/kv/data/next token | SQS_NEXT_TOKEN;
45+
46+
- name: 🔨 Build and Package
47+
env:
48+
ARTIFACTORY_USER: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USER }}
49+
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
50+
run: |
51+
powershell -File build.ps1 -target Quick -configuration Release
52+
53+
- name: ⬆️ Upload Windows Artifacts
54+
uses: actions/upload-artifact@v4
55+
with:
56+
name: omnisharp-windows
57+
path: artifacts/package/**/omnisharp-*.*
58+
if-no-files-found: error
59+
60+
- name: 🎁 Install SonarScanner
61+
env:
62+
ARTIFACTORY_USER: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USER }}
63+
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
64+
run: |
65+
dotnet tool install --global dotnet-sonarscanner
66+
67+
- name: ⚙️ Analyze on SQS Next
68+
env:
69+
ARTIFACTORY_USER: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USER }}
70+
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
71+
SONAR_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQS_NEXT_URL }}
72+
SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQS_NEXT_TOKEN }}
73+
run: |
74+
bash .github/workflows/build_scan_dotnet.sh
75+
76+
build_linux:
77+
runs-on: github-ubuntu-latest-s
78+
name: Build Linux (mono + net6)
2079
steps:
80+
- uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
81+
with:
82+
version: 2025.7.12
83+
84+
- name: Checkout
85+
uses: actions/checkout@v4
86+
with:
87+
clean: "false"
88+
fetch-depth: "0"
89+
90+
- name: Install Mono
91+
run: |
92+
sudo apt-get update
93+
sudo apt-get install -y ca-certificates gnupg
94+
sudo gpg --homedir /tmp --no-default-keyring --keyring /usr/share/keyrings/mono-official-archive-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
95+
echo "deb [signed-by=/usr/share/keyrings/mono-official-archive-keyring.gpg] https://download.mono-project.com/repo/ubuntu stable-focal main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
96+
sudo apt-get update
97+
sudo apt-get install -y mono-complete mono-roslyn msbuild
98+
sudo rm -rf /var/lib/apt/lists/*
99+
100+
- name: 🎁 Get Repox Credentials from Vault
101+
id: secrets
102+
uses: SonarSource/vault-action-wrapper@v3
103+
with:
104+
secrets: |
105+
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader username | ARTIFACTORY_USER;
106+
development/artifactory/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ARTIFACTORY_ACCESS_TOKEN;
107+
108+
- name: 🔨 Build and Package
109+
env:
110+
ARTIFACTORY_USER: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USER }}
111+
ARTIFACTORY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
112+
run: |
113+
chmod +x ./build.sh
114+
./build.sh --target Quick --configuration Release
21115
22-
- uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
23-
with:
24-
version: 2025.7.12
25-
26-
- name: Checkout
27-
uses: actions/checkout@v2
28-
with:
29-
clean: "false"
30-
fetch-depth: "0"
31-
32-
- name: 🎁 Get Repox Credentials from Vault
33-
id: secrets
34-
uses: SonarSource/vault-action-wrapper@v3
35-
with:
36-
secrets: |
37-
development/kv/data/next url | SQS_NEXT_URL;
38-
development/kv/data/next token | SQS_NEXT_TOKEN;
39-
40-
- name: 🎁 Install SonarScanner
41-
run: |
42-
dotnet tool install --global dotnet-sonarscanner
43-
44-
- name: ⚙️ Build and analyze dotnet project on SQS Next
45-
env:
46-
SONAR_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQS_NEXT_URL }}
47-
SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQS_NEXT_TOKEN }}
48-
run: |
49-
bash .github/workflows/build_scan_dotnet.sh
116+
- name: ⬆️ Upload Linux Artifacts
117+
uses: actions/upload-artifact@v4
118+
with:
119+
name: omnisharp-linux
120+
path: artifacts/package/**/omnisharp-*.*
121+
if-no-files-found: error

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,10 @@ nuget.exe
2727
debugSettings.json
2828
buildlog
2929
/.vs
30-
*.lock.json
30+
# Ignore old project.lock.json but keep packages.lock.*.json for reproducible builds
31+
project.lock.json
32+
!packages.lock.windows.json
33+
!packages.lock.linux.json
3134
/omnisharp*.tar.gz
3235
scripts/Omnisharp*
3336
.msbuild-*/

‎Directory.Build.props‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@
33
<RepositoryRootDirectory>$(MSBuildThisFileDirectory)</RepositoryRootDirectory>
44

55
<RestoreUseStaticGraphEvaluation>true</RestoreUseStaticGraphEvaluation>
6+
7+
<!-- Enable NuGet package lock files for reproducible builds -->
8+
<RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
9+
10+
<!-- Use platform-specific lock files -->
11+
<NuGetLockFilePath Condition="$([MSBuild]::IsOSPlatform('Windows'))">$(MSBuildProjectDirectory)\packages.lock.windows.json</NuGetLockFilePath>
12+
<NuGetLockFilePath Condition="!$([MSBuild]::IsOSPlatform('Windows'))">$(MSBuildProjectDirectory)\packages.lock.linux.json</NuGetLockFilePath>
613
</PropertyGroup>
714

815
<Import Project="build\Settings.props" />

‎NuGet.Config‎

Lines changed: 45 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,53 @@
11
<?xml version="1.0" encoding="utf-8"?>
2+
23
<configuration>
34
<packageSources>
45
<clear />
5-
<add key="NuGet" value="https://api.nuget.org/v3/index.json" />
6-
<add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
7-
<add key="dotnet6" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet6/nuget/v3/index.json" />
8-
<add key="dotnet6-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet6-transport/nuget/v3/index.json" />
9-
<add key="vs-impl" value="https://pkgs.dev.azure.com/azure-public/vside/_packaging/vs-impl/nuget/v3/index.json" />
10-
<add key="OmniSharp" value="https://www.myget.org/F/omnisharp/api/v3/index.json" />
6+
<add key="Repox" value="https://repox.jfrog.io/artifactory/api/nuget/v3/nuget/index.json" protocolVersion="3" />
7+
<add key="DotnetTools" value="https://repox.jfrog.io/artifactory/api/nuget/v3/dotnet-tools/index.json" protocolVersion="3" />
8+
<add key="Dotnet6" value="https://repox.jfrog.io/artifactory/api/nuget/v3/dotnet6/index.json" protocolVersion="3" />
119
</packageSources>
10+
11+
<packageSourceCredentials>
12+
<Repox>
13+
<add key="Username" value="%ARTIFACTORY_USER%" />
14+
<add key="ClearTextPassword" value="%ARTIFACTORY_PASSWORD%" />
15+
</Repox>
16+
<DotnetTools>
17+
<add key="Username" value="%ARTIFACTORY_USER%" />
18+
<add key="ClearTextPassword" value="%ARTIFACTORY_PASSWORD%" />
19+
</DotnetTools>
20+
<Dotnet6>
21+
<add key="Username" value="%ARTIFACTORY_USER%" />
22+
<add key="ClearTextPassword" value="%ARTIFACTORY_PASSWORD%" />
23+
</Dotnet6>
24+
</packageSourceCredentials>
25+
26+
<config>
27+
<clear />
28+
<add key="signatureValidationMode" value="require" />
29+
</config>
30+
31+
<trustedSigners>
32+
<repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
33+
<certificate fingerprint="0e5f38f57dc1bcc806d8494f4f90fbcedd988b46760709cbeec6f4219aa6157d"
34+
hashAlgorithm="SHA256" allowUntrustedRoot="false" />
35+
<certificate fingerprint="5a2901d6ada3d18260b9c6dfe2133c95d74b9eef6ae0e5dc334c8454d1477df4"
36+
hashAlgorithm="SHA256" allowUntrustedRoot="false" />
37+
<certificate fingerprint="1f4b311d9acc115c8dc8018b5a49e00fce6da8e2855f9f014ca6f34570bc482d"
38+
hashAlgorithm="SHA256" allowUntrustedRoot="false" />
39+
</repository>
40+
<author name="Microsoft">
41+
<!-- Subject Name: CN=Microsoft Corporation, valid from 2023-07-27 -->
42+
<certificate fingerprint="566A31882BE208BE4422F7CFD66ED09F5D4524A5994F50CCC8B05EC0528C1353" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
43+
<!-- Subject Name: CN=Microsoft Corporation, valid from: 2020-09-30 -->
44+
<certificate fingerprint="AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
45+
</author>
46+
</trustedSigners>
47+
1248
<packageSourceMapping>
1349
<clear />
14-
<packageSource key="NuGet">
50+
<packageSource key="Repox">
1551
<package pattern="Antlr4.*" />
1652
<package pattern="BenchmarkDotNet" />
1753
<package pattern="BenchmarkDotNet.*" />
@@ -48,15 +84,12 @@
4884
<!-- Needed for analysis -->
4985
<package pattern="dotnet-sonarscanner" />
5086
</packageSource>
51-
<packageSource key="dotnet-tools">
87+
<packageSource key="DotnetTools">
5288
<package pattern="microsoft.*" />
5389
<package pattern="NuGet.*" />
5490
</packageSource>
55-
<packageSource key="dotnet6">
91+
<packageSource key="Dotnet6">
5692
<package pattern="microsoft.*" />
5793
</packageSource>
5894
</packageSourceMapping>
59-
<disabledPackageSources>
60-
<clear />
61-
</disabledPackageSources>
6295
</configuration>

‎build.cake‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -260,11 +260,12 @@ void BuildWithDotNetCli(BuildEnvironment env, string configuration)
260260

261261
settings
262262
.SetConfiguration(configuration)
263+
.WithProperty("RestoreLockedMode", "true") // Enforce NuGet package lock files
263264
.WithProperty("PackageVersion", env.VersionInfo.NuGetVersion)
264265
.WithProperty("AssemblyVersion", env.VersionInfo.AssemblySemVer)
265266
.WithProperty("FileVersion", env.VersionInfo.AssemblySemVer)
266267
.WithProperty("InformationalVersion", env.VersionInfo.InformationalVersion)
267-
.WithProperty("RuntimeFrameworkVersion", "6.0.0-preview.7.21317.1") // Set the minimum runtime to a .NET 6 prerelease so that prerelease SDKs will be considered during rollForward.
268+
.WithProperty("RuntimeFrameworkVersion", "6.0.36") // Set the minimum runtime to a .NET 6
268269
.WithProperty("RollForward", "LatestMajor");
269270

270271
DotNetMSBuild("OmniSharp.sln", settings);
@@ -538,11 +539,12 @@ string PublishBuild(string project, BuildEnvironment env, BuildPlan plan, string
538539
Configuration = configuration,
539540
OutputDirectory = outputFolder,
540541
MSBuildSettings = new DotNetMSBuildSettings()
542+
.WithProperty("RestoreLockedMode", "true") // Enforce NuGet package lock files
541543
.WithProperty("PackageVersion", env.VersionInfo.NuGetVersion)
542544
.WithProperty("AssemblyVersion", env.VersionInfo.AssemblySemVer)
543545
.WithProperty("FileVersion", env.VersionInfo.AssemblySemVer)
544546
.WithProperty("InformationalVersion", env.VersionInfo.InformationalVersion)
545-
.WithProperty("RuntimeFrameworkVersion", "6.0.0-preview.7.21317.1") // Set the minimum runtime to a .NET 6 prerelease so that prerelease SDKs will be considered during rollForward.
547+
.WithProperty("RuntimeFrameworkVersion", "6.0.36") // Set the minimum runtime to a .NET 6
546548
.WithProperty("RollForward", "LatestMajor"),
547549
ToolPath = env.DotNetCommand,
548550
WorkingDirectory = env.WorkingDirectory,
@@ -586,6 +588,7 @@ Task("PublishNuGet")
586588
OutputDirectory = "./artifacts/nuget/",
587589
MSBuildSettings = new DotNetMSBuildSettings()
588590
.SetConfiguration(configuration)
591+
.WithProperty("RestoreLockedMode", "true") // Enforce NuGet package lock files
589592
.WithProperty("PackageVersion", env.VersionInfo.NuGetVersion)
590593
.WithProperty("AssemblyVersion", env.VersionInfo.AssemblySemVer)
591594
.WithProperty("FileVersion", env.VersionInfo.AssemblySemVer)

0 commit comments

Comments
 (0)