From e17174c07fda2d0d7b70b8517d497d90b0dac3e6 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 26 Aug 2026 17:20:20 +0000 Subject: [PATCH 1/2] Stop pushing to MyGet and add a GitHub Release workflow Main CI no longer authenticode-signs with the IdentityServer SignClient or pushes to myget.org/F/identity. Tag 10.0.0 (or later) to pack, create a GitHub Release with nupkgs, and publish to nuget.org when NUGET_API_KEY is set. Co-authored-by: Jeff Jones --- .github/CONTRIBUTING.md | 2 +- .github/PULL_REQUEST_TEMPLATE.md | 6 +-- .github/workflows/ci.yml | 23 +++++---- .github/workflows/release.yml | 48 +++++++++++++++++++ README.md | 20 ++++++++ build.ps1 | 45 +++++++++-------- samples/Clients/readme.md | 2 +- .../IdentityServer/Views/Home/Index.cshtml | 4 +- .../IdentityServer/Views/Home/Index.cshtml | 4 +- .../IdentityServer/Views/Home/Index.cshtml | 4 +- .../IdentityServer/Views/Home/Index.cshtml | 4 +- .../Views/Home/Index.cshtml | 4 +- .../host/Views/Home/Index.cshtml | 4 +- src/Directory.Build.targets | 5 +- .../host/Views/Home/Index.cshtml | 4 +- .../host/Views/Home/Index.cshtml | 4 +- 16 files changed, 126 insertions(+), 57 deletions(-) create mode 100644 .github/workflows/release.yml diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 7c74c36a8..e1c8801e6 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -6,7 +6,7 @@ Then we can decide if and how a feature or a change could be implemented and if Also read this first: [Being a good open source citizen](https://hackernoon.com/being-a-good-open-source-citizen-9060d0ab9732#.x3hocgw85) ## Found an issue or a bug? -Please start a discussion on the [repository issue tracker](https://github.com/joneja09/IdentityServer4/issues). +Please start a discussion on the [repository issue tracker](https://github.com/joneja09/ForgePoint.Identity/issues). ## Filing issues The best way to get your bug fixed is to be as detailed as you can be about the problem. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 26ce4b101..81cfcd189 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,5 +1,3 @@ -**At this point we cannot accept PRs anymore. Thanks!** +Thanks for contributing to ForgePoint.Identity. -This organization is not maintained anymore besides critical security bugfixes (if feasible). This organization will be archived when .NET Core 3.1 end of support is reached (3rd Dec 2022). All new development is happening in the new [Duende Software](https://github.com/duendesoftware) organization. - -The new [Duende IdentityServer](https://duendesoftware.com/products/identityserver) comes with a commercial license but is [free](https://blog.duendesoftware.com/posts/20220111_fair_trade/) for dev/testing/personal projects and companies or individuals making less than 1M USD gross annnual revenue. Please [get in touch with us](https://duendesoftware.com/contact) if you have any question. +Please describe the change, why it is needed, and how you tested it. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 40aa3785e..f60ac2ac5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,8 +6,6 @@ on: - main - features/** - cursor/** - tags: - - '*.*.*' pull_request: env: @@ -23,25 +21,26 @@ jobs: runs-on: ${{ matrix.runs-on }} steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: actions/setup-dotnet@v4 with: dotnet-version: | 8.0.x 10.0.x + - run: dotnet --info - name: Upgrade script tests - if: contains(matrix.runs-on, 'macOS') || contains(matrix.runs-on, 'ubuntu') + if: runner.os != 'Windows' working-directory: scripts/upgrade-namespaces run: python3 test_rewrite.py - - - if: contains(matrix.runs-on, 'macOS') || contains(matrix.runs-on, 'ubuntu') + + - name: Build and test + if: runner.os != 'Windows' run: ./build.sh - - if: matrix.runs-on == 'windows-latest' && github.ref != 'refs/heads/main' && !contains(github.ref, 'refs/tags/') + + - name: Build and test + if: runner.os == 'Windows' run: ./build.ps1 - - if: (matrix.runs-on == 'windows-latest') && (github.ref == 'refs/heads/main' || contains(github.ref, 'refs/tags/')) - env: - SignClientSecret: ${{ secrets.SIGNCLIENT }} - run: | - ./build.ps1 sign - dotnet nuget push .\nuget\*.nupkg -s https://www.myget.org/F/identity/api/v2/package -k ${{ secrets.MYGET }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 000000000..694cf57d6 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,48 @@ +name: Release + +on: + push: + tags: + - '*.*.*' + +permissions: + contents: write + +env: + DOTNET_NOLOGO: true + +jobs: + release: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - uses: actions/setup-dotnet@v4 + with: + dotnet-version: | + 8.0.x + 10.0.x + + - name: Build, test, and pack + run: ./build.sh + + - name: Create GitHub Release + uses: softprops/action-gh-release@v2 + with: + generate_release_notes: true + files: nuget/*.nupkg + + - name: Publish to NuGet.org + env: + NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} + run: | + if [ -z "${NUGET_API_KEY}" ]; then + echo "NUGET_API_KEY is not set; skipping nuget.org. Packages are attached to the GitHub Release." + exit 0 + fi + dotnet nuget push ./nuget/*.nupkg \ + --source https://api.nuget.org/v3/index.json \ + --api-key "${NUGET_API_KEY}" \ + --skip-duplicate diff --git a/README.md b/README.md index b40e86fe7..207a7fd38 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,10 @@ Duende IdentityServer is the commercial successor of the original IdentityServer | `ForgePoint.Identity.EntityFramework.Storage` | EF Core entities and stores | | `ForgePoint.Identity.AspNetIdentity` | ASP.NET Core Identity integration | +```bash +dotnet add package ForgePoint.Identity +``` + ## How to build * Install the [.NET 10 SDK](https://dotnet.microsoft.com/download) (the SDK also builds the `net8.0` TFM) @@ -39,6 +43,22 @@ Duende IdentityServer is the commercial successor of the original IdentityServer The build packs each project into `./nuget` in dependency order: Storage → Identity → EntityFramework.Storage → EntityFramework → AspNetIdentity. +## Releasing + +Version numbers come from [MinVer](https://github.com/adamralph/minver) git tags (`10.0.0`, not `v10.0.0`). + +1. Optionally add a `NUGET_API_KEY` Actions secret (a nuget.org API key for the ForgePoint.Identity package prefix). Without it, a GitHub Release is still created and the `.nupkg` files are attached. +2. Tag main and push: + +```bash +git checkout main +git pull +git tag 10.0.0 +git push origin 10.0.0 +``` + +The Release workflow packs the libraries, creates the GitHub Release, and publishes to nuget.org when `NUGET_API_KEY` is set. + ## Quick start ```csharp diff --git a/build.ps1 b/build.ps1 index 0e5f6427c..490b18776 100644 --- a/build.ps1 +++ b/build.ps1 @@ -1,4 +1,4 @@ -$ErrorActionPreference = "Stop"; +$ErrorActionPreference = "Stop" if (Test-Path ./nuget) { Remove-Item ./nuget -Recurse -Force @@ -11,23 +11,26 @@ Get-ChildItem -Path $nugetPackages -Directory -ErrorAction SilentlyContinue | Remove-Item -Recurse -Force dotnet tool restore - -pushd ./src/Storage -Invoke-Expression "./build.ps1 $args" -popd - -pushd ./src/IdentityServer4 -Invoke-Expression "./build.ps1 $args" -popd - -pushd ./src/EntityFramework.Storage -Invoke-Expression "./build.ps1 $args" -popd - -pushd ./src/EntityFramework -Invoke-Expression "./build.ps1 $args" -popd - -pushd ./src/AspNetIdentity -Invoke-Expression "./build.ps1 $args" -popd +if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } + +$buildArgs = $args +$projects = @( + "./src/Storage", + "./src/IdentityServer4", + "./src/EntityFramework.Storage", + "./src/EntityFramework", + "./src/AspNetIdentity" +) + +foreach ($project in $projects) { + Push-Location $project + try { + & ./build.ps1 @buildArgs + if ($LASTEXITCODE -ne 0) { + throw "Build failed in $project (exit $LASTEXITCODE)." + } + } + finally { + Pop-Location + } +} diff --git a/samples/Clients/readme.md b/samples/Clients/readme.md index b1deaed0c..7dd39adf1 100644 --- a/samples/Clients/readme.md +++ b/samples/Clients/readme.md @@ -1,3 +1,3 @@ The client samples are designed to be used with the host in this repo: -https://github.com/joneja09/IdentityServer4/tree/main/src/IdentityServer4 +https://github.com/joneja09/ForgePoint.Identity/tree/main/src/IdentityServer4 diff --git a/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Home/Index.cshtml b/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Home/Index.cshtml +++ b/samples/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Home/Index.cshtml b/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Home/Index.cshtml +++ b/samples/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Home/Index.cshtml b/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Home/Index.cshtml +++ b/samples/Quickstarts/4_JavaScriptClient/src/IdentityServer/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Home/Index.cshtml b/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Home/Index.cshtml +++ b/samples/Quickstarts/5_EntityFramework/src/IdentityServer/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/samples/Quickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Home/Index.cshtml b/samples/Quickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/samples/Quickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Home/Index.cshtml +++ b/samples/Quickstarts/6_AspNetIdentity/src/IdentityServerAspNetIdentity/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/src/AspNetIdentity/host/Views/Home/Index.cshtml b/src/AspNetIdentity/host/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/src/AspNetIdentity/host/Views/Home/Index.cshtml +++ b/src/AspNetIdentity/host/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/src/Directory.Build.targets b/src/Directory.Build.targets index 9a2746a9a..20bf4e77e 100644 --- a/src/Directory.Build.targets +++ b/src/Directory.Build.targets @@ -7,8 +7,9 @@ ForgePoint Labs ForgePoint.Identity ForgePoint Labs - https://github.com/joneja09/IdentityServer4 - https://github.com/joneja09/IdentityServer4/releases + https://github.com/joneja09/ForgePoint.Identity + https://github.com/joneja09/ForgePoint.Identity/releases + https://github.com/joneja09/ForgePoint.Identity.git 10.0.0-* diff --git a/src/EntityFramework/host/Views/Home/Index.cshtml b/src/EntityFramework/host/Views/Home/Index.cshtml index 1521e3ca5..1fffa6d13 100644 --- a/src/EntityFramework/host/Views/Home/Index.cshtml +++ b/src/EntityFramework/host/Views/Home/Index.cshtml @@ -25,8 +25,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • diff --git a/src/IdentityServer4/host/Views/Home/Index.cshtml b/src/IdentityServer4/host/Views/Home/Index.cshtml index 7dc2e1544..cf49a2fe7 100644 --- a/src/IdentityServer4/host/Views/Home/Index.cshtml +++ b/src/IdentityServer4/host/Views/Home/Index.cshtml @@ -26,8 +26,8 @@
  • Here are links to the - source code repository, - and ready to use samples. + source code repository, + and ready to use samples.
    • From b1b8de0470cfef9a29fa5e0d8ab537fb1322a005 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 26 Aug 2026 17:33:02 +0000 Subject: [PATCH 2/2] Publish to nuget.org with Trusted Publishing instead of an API key The Release workflow exchanges a GitHub OIDC token for a short-lived nuget.org key via NuGet/login. Set the NUGET_USER repo variable and a matching Trusted Publishing policy; GitHub Releases still work without it. Co-authored-by: Jeff Jones --- .github/workflows/release.yml | 24 +++++++++++++++++------- README.md | 24 +++++++++++++++++++----- 2 files changed, 36 insertions(+), 12 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 694cf57d6..f62498b91 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,9 +4,15 @@ on: push: tags: - '*.*.*' + workflow_dispatch: + inputs: + tag: + description: 'Git tag to build and publish (for example 10.0.0)' + required: true permissions: contents: write + id-token: write env: DOTNET_NOLOGO: true @@ -18,6 +24,7 @@ jobs: - uses: actions/checkout@v4 with: fetch-depth: 0 + ref: ${{ github.event.inputs.tag || github.ref }} - uses: actions/setup-dotnet@v4 with: @@ -31,18 +38,21 @@ jobs: - name: Create GitHub Release uses: softprops/action-gh-release@v2 with: + tag_name: ${{ github.event.inputs.tag || github.ref_name }} generate_release_notes: true files: nuget/*.nupkg + - name: NuGet login (OIDC) + if: ${{ vars.NUGET_USER != '' }} + id: nuget-login + uses: NuGet/login@v1 + with: + user: ${{ vars.NUGET_USER }} + - name: Publish to NuGet.org - env: - NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }} + if: ${{ vars.NUGET_USER != '' }} run: | - if [ -z "${NUGET_API_KEY}" ]; then - echo "NUGET_API_KEY is not set; skipping nuget.org. Packages are attached to the GitHub Release." - exit 0 - fi dotnet nuget push ./nuget/*.nupkg \ --source https://api.nuget.org/v3/index.json \ - --api-key "${NUGET_API_KEY}" \ + --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" \ --skip-duplicate diff --git a/README.md b/README.md index 207a7fd38..0f644891a 100644 --- a/README.md +++ b/README.md @@ -47,17 +47,31 @@ The build packs each project into `./nuget` in dependency order: Storage → Ide Version numbers come from [MinVer](https://github.com/adamralph/minver) git tags (`10.0.0`, not `v10.0.0`). -1. Optionally add a `NUGET_API_KEY` Actions secret (a nuget.org API key for the ForgePoint.Identity package prefix). Without it, a GitHub Release is still created and the `.nupkg` files are attached. -2. Tag main and push: +The Release workflow packs the libraries, creates a GitHub Release with the `.nupkg` files, and publishes to nuget.org via [Trusted Publishing](https://learn.microsoft.com/nuget/nuget-org/trusted-publishing) (GitHub OIDC → a one-hour nuget.org API key). There is no long-lived `NUGET_API_KEY`. + +### One-time nuget.org setup + +1. Sign in at [nuget.org](https://www.nuget.org/) (your **profile name**, not your email). +2. Open **Trusted Publishing** and add a policy owned by your user (or your org): + - **Repository Owner:** `joneja09` + - **Repository:** `ForgePoint.Identity` + - **Workflow File:** `release.yml` (file name only) + - **Environment:** leave empty +3. In this GitHub repo, **Settings → Secrets and variables → Actions → Variables**, add `NUGET_USER` set to that same nuget.org profile name. + +Until `NUGET_USER` is set, the workflow still creates the GitHub Release and skips nuget.org. + +### Cut a release ```bash git checkout main git pull -git tag 10.0.0 -git push origin 10.0.0 +git tag 10.0.1 +git push origin 10.0.1 ``` -The Release workflow packs the libraries, creates the GitHub Release, and publishes to nuget.org when `NUGET_API_KEY` is set. +To publish an existing tag (for example `10.0.0`) after Trusted Publishing is configured: **Actions → Release → Run workflow** and enter the tag name. + ## Quick start