# This workflow is triggered by new releases and on a daily schedule.
# It builds, unit tests, live tests and publishes the Open AI NuGet package.
# For daily runs, the package is published to the GitHub package registry.
# For releases, the package is published to the NuGet package registry.
name: Release package

on:
  release:
    types: [published]
  schedule:
    # run every day at 00:00
    - cron: '0 0 * * *'

permissions:
  contents: read

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    environment: Live Testing
    env:
      version_suffix_args: ${{ github.event_name == 'schedule' && format('/p:VersionSuffix="alpha.{0}"', github.run_number) || '' }}
    steps:
      - name: Setup .NET 10
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: '10.x'

      - name: Setup .NET 9
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: '9.x'

      - name: Setup .NET 8
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: '8.x'

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Restore tools
        run: dotnet tool restore --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json

      # Pack the client NuGet package and include URL back to the repository and release tag
      - name: Build and pack
        run: dotnet pack
          --configuration Release
          --output "${{ github.workspace }}/artifacts/packages"
          /p:PackageProjectUrl="${{ github.server_url }}/${{ github.repository }}/tree/${{ github.event.release.tag_name }}"
          /p:PackageReleaseNotes="${{ github.server_url }}/${{ github.repository }}/blob/${{ github.event.release.tag_name }}/CHANGELOG.md"
          ${{ env.version_suffix_args }}

      - name: Run tests in Playback mode
        run: dotnet test ./tests/OpenAI.Tests.csproj
          --configuration Release
          --logger "trx;LogFilePrefix=playback"
          --results-directory ${{ github.workspace }}/artifacts/test-results
          ${{ env.version_suffix_args }}
        env:
          CLIENTMODEL_TEST_MODE: Playback
          CLIENTMODEL_DISABLE_AUTO_RECORDING: true

      - name: Upload artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ !cancelled() }}
        with:
          name: build-artifacts
          path: ${{ github.workspace }}/artifacts

  sign:
    needs: build
    runs-on: windows-latest # Code signing must run on a Windows agent for Authenticode signing (dll/exe)
    environment: release # Needed for OIDC subject for releases triggered on release being created.
    permissions:
      id-token: write # Required for requesting the JWT

    steps:
    - name: Download build artifacts
      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
      with:
        name: build-artifacts
        path: ${{ github.workspace }}/build-artifacts

    - name: Setup .NET
      uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
      with:
        dotnet-version: '9.x'

    - name: Install Sign CLI tool
      run: dotnet tool install --tool-path . --prerelease sign

    - name: 'Az CLI login'
      uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
      with:
        client-id: 80125de0-6f58-4f16-bd05-b2fa621d36a5
        tenant-id: 16076fdc-fcc1-4a15-b1ca-32c9a255900e
        allow-no-subscriptions: true

    - name: Sign artifacts
      shell: pwsh
      run: >
        ./sign code azure-key-vault
        **/*.nupkg
        --base-directory "${{ github.workspace }}/build-artifacts/packages"
        --publisher-name "OpenAI"
        --description "OpenAI library for .NET"
        --description-url "https://github.com/openai/openai-dotnet"
        --azure-credential-type "azure-cli"
        --azure-key-vault-url "https://sc-openaisdk.vault.azure.net/"
        --azure-key-vault-certificate "OpenAISDKSCCert"

    - name: Upload signed artifact
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: build-artifacts-signed
        path: ${{ github.workspace }}/build-artifacts

  publish-github-packages:
    name: Publish package to GitHub Packages
    needs: sign
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: build-artifacts-signed
          path: ${{ github.workspace }}/build-artifacts

      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: '9.x'

      - name: NuGet authenticate
        run: dotnet nuget add source
          "https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json"
          --name "github"
          --username ${{ github.actor }}
          --password ${{ secrets.GITHUB_TOKEN }}
          --store-password-in-clear-text

      - name: Publish package to local feed
        run: dotnet nuget push
            ${{ github.workspace }}/build-artifacts/packages/*.nupkg
            --source "github"
            --api-key ${{ secrets.GITHUB_TOKEN }}
            --skip-duplicate

  publish-nuget:
    name: Publish package to NuGet.org
    if: github.event_name == 'release'
    needs: sign
    runs-on: ubuntu-latest
    environment: publish
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Download build artifacts
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: build-artifacts-signed
          path: ${{ github.workspace }}/build-artifacts

      - name: Upload release asset
        run: gh release upload ${{ github.event.release.tag_name }}
          ${{ github.workspace }}/build-artifacts/packages/*.*nupkg
          --clobber
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}

      - name: Update GitHub release notes to point to the changelog
        run: |
          gh release edit "${{ github.event.release.tag_name }}" \
            --notes "See full changelog: ${{ github.server_url }}/${{ github.repository }}/blob/${{ github.event.release.tag_name }}/CHANGELOG.md"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}

      - name: Setup .NET
        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
        with:
          dotnet-version: '9.x'

      - name: NuGet login
        uses: NuGet/login@ebc737b6fc418a6ca0073cf116ec8dc156d8b81e # v1
        id: nuget-login
        with:
          user: openai-publisher

      - name: Publish package to nuget.org
        run: dotnet nuget push
            ${{ github.workspace }}/build-artifacts/packages/*.nupkg
            --source https://api.nuget.org/v3/index.json
            --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
            --skip-duplicate