ci.yml

name: CI

# Every push runs CI, on every branch. Pull requests run it only when they come from a fork; a branch of this
# repository was already checked by its push.
on:
  push:
    branches: ['**']
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  DOTNET_NOLOGO: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages

jobs:
  linux:
    name: Linux build, tests, coverage
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: actions/cache@v6
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', '.config/dotnet-tools.json') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore nUpdate.sln && dotnet tool restore

      - name: Check formatting
        run: dotnet format nUpdate.sln --verify-no-changes --no-restore

      - name: Build
        run: dotnet build nUpdate.sln --configuration Release --no-restore

      # Every public type and member of the packages needs an entry on website/api.html (tools/ApiDocsCheck).
      - name: API page documents the public API
        run: bash tools/ci/api-docs-check.sh

      - name: Tests (unit and Docker integration)
        env:
          NUPDATE_REQUIRE_DOCKER: "1" # fail instead of skipping the Docker tests when the daemon does not answer
        run: |
          dotnet test nUpdate.Tests/nUpdate.Tests.csproj --configuration Release --no-build --results-directory TestResults/nUpdate.Tests -- \
            --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml \
            --report-trx --report-trx-filename nUpdate.Tests.trx

      - name: Merge coverage reports
        if: always()
        run: |
          dotnet reportgenerator -reports:"TestResults/*/coverage.cobertura.xml" -targetdir:TestResults/report \
            -reporttypes:"Cobertura;HtmlInline;MarkdownSummaryGithub" -assemblyfilters:"-nUpdate.Tests"
          cat TestResults/report/SummaryGithub.md >> "$GITHUB_STEP_SUMMARY"

      - name: Coverage gate
        run: |
          dotnet run --project tools/CoverageGate --configuration Release -- TestResults/report/Cobertura.xml \
            --require nUpdate=100,100 \
            --require nUpdate.UpdateInstaller=100,100 \
            --require nUpdate.UpdateInstaller.UI.Avalonia=90,90 \
            --require nUpdate.UI.Avalonia=90,90 \
            --require nUpdate.Administration.Core=100,100 \
            --require nUpdate.Administration.TransferInterface=100,100 \
            --require nUpdate.Administration=90,90 \
            --show-uncovered

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: coverage-report
          path: TestResults/report

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: test-results-linux
          path: TestResults/**/*.trx

      # Self-contained, so users need no .NET; packed as tarballs, which keep the executable bit.
      - name: Publish nUpdate Administration for Linux
        run: |
          bash tools/ci/administration-linux.sh linux-x64 artifacts/administration-linux
          bash tools/ci/administration-linux.sh linux-arm64 artifacts/administration-linux

      # Under Xvfb, with a home folder of its own; still running after 15 seconds means it started.
      - name: Start nUpdate Administration for linux-x64
        run: |
          mkdir -p "$RUNNER_TEMP/administration" "$RUNNER_TEMP/home"
          tar -xzf artifacts/administration-linux/nUpdate-Administration-linux-x64.tar.gz -C "$RUNNER_TEMP/administration"
          HOME="$RUNNER_TEMP/home" xvfb-run -a bash tools/ci/check-starts.sh 15 \
            "$RUNNER_TEMP/administration/nUpdate-Administration/nUpdate.Administration"

      - uses: actions/upload-artifact@v7
        with:
          name: administration-linux-x64
          path: artifacts/administration-linux/nUpdate-Administration-linux-x64.tar.gz

      - uses: actions/upload-artifact@v7
        with:
          name: administration-linux-arm64
          path: artifacts/administration-linux/nUpdate-Administration-linux-arm64.tar.gz

  packages:
    name: Packages and the Linux installer
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: actions/cache@v6
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: nuget-packages-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', '.config/dotnet-tools.json') }}
          restore-keys: nuget-packages-${{ runner.os }}-

      # Packing publishes the built-in installer for all seven runtime identifiers, which all build on Linux.
      - name: Pack NuGet packages
        run: dotnet pack nUpdate.sln --configuration Release --output artifacts/packages

      - name: List the installers in the package
        run: |
          unzip -l artifacts/packages/nUpdate.UpdateInstaller.UI.Avalonia.[0-9]*.nupkg | tee artifacts/installer-package.txt
          test "$(grep -c 'installer/.*/nUpdate.UpdateInstaller.UI.Avalonia' artifacts/installer-package.txt)" -eq 7
          ls -la artifacts/packages

      - name: Install from the packages in a consumer project
        run: bash tools/ci/consumer-smoke-test.sh linux-x64

      # Under Xvfb, so the trimmed single-file window really opens; one test points the installer at a missing display.
      - name: Update with the published installer
        run: |
          dotnet build nUpdate.Tests/nUpdate.Tests.csproj --configuration Release
          xvfb-run -a dotnet test nUpdate.Tests/nUpdate.Tests.csproj --configuration Release --no-build -- --filter-trait "Category=PublishedInstaller"

      - uses: actions/upload-artifact@v7
        with:
          name: nuget-packages
          path: |
            artifacts/packages/*.nupkg
            artifacts/packages/*.snupkg

  windows:
    name: Windows build, tests, installer
    needs: packages
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: windows-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: actions/cache@v6
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', '.config/dotnet-tools.json') }}
          restore-keys: nuget-${{ runner.os }}-

      - name: Restore
        run: dotnet restore nUpdate.sln

      - name: Build
        run: dotnet build nUpdate.sln --configuration Release --no-restore

      - name: Unit tests (including the Windows-only adapter tests, without the Docker integration tests)
        shell: bash
        run: |
          dotnet test nUpdate.Tests/nUpdate.Tests.csproj --configuration Release --no-build --results-directory TestResults/nUpdate.Tests -- \
            --filter-not-trait "Category=Integration" \
            --report-trx --report-trx-filename nUpdate.Tests.trx

      - name: Screenshot of the Windows Forms update dialog for the README
        continue-on-error: true # a runner without a desktop session must not fail the build
        run: dotnet run --project tools/WinFormsScreenshots --configuration Release --no-build -- artifacts/screenshots

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: screenshots-windows
          path: artifacts/screenshots
          if-no-files-found: ignore

      - uses: actions/download-artifact@v8
        with:
          name: nuget-packages
          path: artifacts/packages

      - name: Install from the packages in a consumer project
        shell: bash
        run: bash tools/ci/consumer-smoke-test.sh win-x64

      - name: Update with the published installer
        run: dotnet test nUpdate.Tests/nUpdate.Tests.csproj --configuration Release --no-build -- --filter-trait "Category=PublishedInstaller"

      - name: Publish nUpdate Administration
        run: dotnet publish nUpdate.Administration/nUpdate.Administration.csproj --configuration Release --runtime win-x64 --self-contained false --output artifacts/administration-win-x64

      # Still running after 15 seconds means it started; the runner has a desktop session.
      - name: Start nUpdate Administration
        shell: bash
        run: bash tools/ci/check-starts.sh 15 artifacts/administration-win-x64/nUpdate.Administration.exe

      - uses: actions/upload-artifact@v7
        with:
          name: administration-win-x64
          path: artifacts/administration-win-x64

      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: test-results-windows
          path: TestResults/**/*.trx

  macos:
    name: macOS installer and bundle swap
    needs: packages
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
    runs-on: macos-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v6
        with:
          global-json-file: global.json

      - uses: actions/cache@v6
        with:
          path: ${{ env.NUGET_PACKAGES }}
          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', '.config/dotnet-tools.json') }}
          restore-keys: nuget-${{ runner.os }}-

      - uses: actions/download-artifact@v8
        with:
          name: nuget-packages
          path: artifacts/packages

      - name: Install from the packages in a consumer project
        run: bash tools/ci/consumer-smoke-test.sh osx-arm64

      # The SDK signs the apphost ad hoc when it publishes on Linux; macOS refuses unsigned arm64 code.
      - name: Check the installer's signature
        run: codesign --verify --strict --verbose=2 "$NUPDATE_INSTALLER"

      - name: Update with the published installer, including the swap of a signed bundle
        run: |
          dotnet build nUpdate.Tests/nUpdate.Tests.csproj --configuration Release
          dotnet test nUpdate.Tests/nUpdate.Tests.csproj --configuration Release --no-build -- --filter-trait "Category=PublishedInstaller"

      # Self-contained and signed ad hoc, for Apple silicon and Intel; zipped with ditto, which keeps the extended
      # attributes the signature needs.
      - name: Build the nUpdate Administration bundles
        run: |
          bash tools/ci/administration-macos-app.sh osx-arm64 artifacts/administration-osx-arm64
          bash tools/ci/administration-macos-app.sh osx-x64 artifacts/administration-osx-x64

      # Each with a home folder of its own; still running after 15 seconds means it started. The runner is an Apple
      # silicon Mac, so the Intel bundle runs under Rosetta.
      - name: Start the nUpdate Administration bundles
        run: |
          if ! arch -x86_64 /usr/bin/true 2> /dev/null; then sudo softwareupdate --install-rosetta --agree-to-license; fi
          mkdir -p "$RUNNER_TEMP/home"
          for rid in osx-arm64 osx-x64; do
            HOME="$RUNNER_TEMP/home" bash tools/ci/check-starts.sh 15 \
              "artifacts/administration-$rid/nUpdate Administration.app/Contents/MacOS/nUpdate.Administration"
          done

      - uses: actions/upload-artifact@v7
        with:
          name: administration-osx-arm64
          path: artifacts/administration-osx-arm64/nUpdate-Administration-osx-arm64.zip

      - uses: actions/upload-artifact@v7
        with:
          name: administration-osx-x64
          path: artifacts/administration-osx-x64/nUpdate-Administration-osx-x64.zip