Skip to content

Simplify release workflow with NuGet trusted publishing #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mrb0nj merged 1 commit into from
Jun 10, 2026
Merged

Simplify release workflow with NuGet trusted publishing #105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 77 additions & 23 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,38 +1,92 @@
name: Continuous Stuff
name: Build and Release

on:
push:
branches:
- feature/*
- hotfix/*
- master
tags:
- v*
Comment on lines 7 to 8

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Block releases from non-master commits.

Any v* tag push currently publishes the commit behind that tag, even if it never landed on master. That lets an unmerged branch commit become the NuGet release.

Suggested hardening 
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Verify tagged commit is on master
+        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/master

Also applies to: 49-50

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml around lines 7 - 8, The workflow currently
triggers on tags matching "v*" and releases whatever commit the tag points to;
add a guard so releases only proceed if that tagged commit is contained in
master: modify .github/workflows/main.yml where tags: - v* is declared to
include a job step (e.g., "Verify tag is on master") before publish that checks
out with full history (actions/checkout fetch-depth:0), fetches origin/master
and verifies the tag commit (GITHUB_SHA or github.ref) is contained in master
using git merge-base --is-ancestor or git branch --contains; if the check fails,
fail the job to block releases from non-master commits.

pull_request:
workflow_dispatch:

permissions:
contents: read

jobs:
build:
runs-on: windows-latest
name: Dotnet build
name: Build and test
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v5
- run: |
git fetch --prune --unshallow
- run: |
git branch master origin/master
if: github.event_name != 'push' || (github.event_name == 'push' && github.ref != 'refs/heads/master')
- name: Setup dotnet
- name: Checkout
uses: actions/checkout@v5
Comment on lines +21 to +22

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the relevant sections of the workflow around the referenced line numbers
FILE=".github/workflows/main.yml"
echo "=== File exists? ==="
ls -l "$FILE" || true

echo "=== Context around lines 1-120 ==="
nl -ba "$FILE" | sed -n '1,140p'

echo "=== Grep for checkout steps ==="
rg -n "uses:\s*actions/checkout@" "$FILE" || true

echo "=== Extract checkout blocks (few lines around each match) ==="
rg -n "uses:\s*actions/checkout@" "$FILE" -n --context 6 || true

Repository: mrb0nj/Slack.Webhooks

Length of output: 259

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/main.yml"
echo "=== First 200 lines (with numbers) ==="
awk '{printf "%6d %s\n", NR, $0}' "$FILE" | sed -n '1,200p'

echo
echo "=== Find checkout steps ==="
rg -n "uses:\s*actions/checkout@" "$FILE" || true

echo
echo "=== Extract checkout blocks with ~15 lines context ==="
rg -n "uses:\s*actions/checkout@" "$FILE" -C 8 || true

Repository: mrb0nj/Slack.Webhooks

Length of output: 3878

Disable checkout credential persistence in PR workflows.

pull_request runs the repo’s code via dotnet test, and both actions/checkout@v5 steps currently omit persist-credentials: false, so credentials can be written to .git/config. Set persist-credentials: false on both checkouts (lines 21-22 and 56-57), since no later step needs persisted GitHub checkout credentials.

Suggested hardening 
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
...
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout
uses: actions/checkout@v5
- name: Checkout
uses: actions/checkout@v5
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 21-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml around lines 21 - 22, The Checkout steps using
actions/checkout@v5 currently omit persist-credentials and can persist token
info to .git/config; update both Checkout usages (the steps named "Checkout"
that call actions/checkout@v5) to include the option persist-credentials: false
so credentials are not written to the checkout metadata. Ensure each checkout
step adds the key persist-credentials: false under its with: block.

Source: Linters/SAST tools


- name: Setup .NET
uses: actions/setup-dotnet@v5
Comment on lines +21 to 25

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate the workflow file(s)
ls -la .github/workflows || true
sed -n '1,200p' .github/workflows/main.yml

echo "----"
# Show the specific line ranges mentioned in the comment
nl -ba .github/workflows/main.yml | sed -n '1,140p' | sed -n '15,110p'

echo "----"
# Check for any action refs that are not pinned to SHAs
# (heuristic: looks for "uses: owner/repo@vX" or "uses: owner/repo@<branch/tag>")
rg -n --no-heading "uses:\s*[^@]+@v[0-9]+|uses:\s*[^@]+@v[0-9]+\.[0-9]+" .github/workflows/main.yml || true
rg -n --no-heading "uses:\s*[^@]+@v[0-9]+|uses:\s*[^@]+@refs/" .github/workflows/main.yml || true

# Look specifically for NuGet/login usage
rg -n --no-heading "NuGet/login" .github/workflows/main.yml || true

Repository: mrb0nj/Slack.Webhooks

Length of output: 2483

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/main.yml"
echo "---- file: $FILE ----"
wc -l "$FILE"

echo "---- uses: lines (with line numbers via awk) ----"
awk '
  /uses:/ {
    printf "%4d: %s\n", NR, $0
  }
' "$FILE"

echo "---- line ranges mentioned in the comment ----"
echo "--- lines 21-25 ---"
awk 'NR>=21 && NR<=25 {printf "%4d: %s\n", NR, $0}' "$FILE"

echo "--- lines 56-60 ---"
awk 'NR>=56 && NR<=60 {printf "%4d: %s\n", NR, $0}' "$FILE"

echo "--- lines 81-82 ---"
awk 'NR>=81 && NR<=82 {printf "%4d: %s\n", NR, $0}' "$FILE"

echo "---- check whether any uses: are pinned to 40-hex SHAs ----"
# Print uses: lines where the ref looks like a full commit SHA (40 hex)
rg -n --no-heading "uses:\s*[^@]+@([0-9a-f]{40})\b" "$FILE" || true

echo "---- check whether checkout/setup-dotnet/NuGet/login are pinned to SHAs ----"
for action in "actions/checkout" "actions/setup-dotnet" "NuGet/login"; do
  echo "== $action =="
  rg -n --no-heading "uses:\s*$action@" "$FILE" || true
done

Repository: mrb0nj/Slack.Webhooks

Length of output: 1260

Pin workflow actions to immutable SHAs.
In .github/workflows/main.yml, actions/checkout@v5, actions/setup-dotnet@v5, and NuGet/login@v1 use mutable tag refs; pin them to full commit SHAs to prevent upstream retagging from changing the pipeline (lines 21-25, 56-60, 81-82).

🧰 Tools
🪛 zizmor (1.25.2)

[warning] 21-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml around lines 21 - 25, The workflow uses mutable
tags for GitHub Actions (actions/checkout@v5, actions/setup-dotnet@v5, and
NuGet/login@v1); update those uses to pin to the corresponding full commit SHAs
instead of the tag refs so the pipeline cannot change if upstream retags. Locate
the three occurrences of actions/checkout, actions/setup-dotnet, and NuGet/login
in the workflow and replace the tag version with the exact commit SHA from each
action’s repository release you intend to target, keeping the rest of the step
configuration unchanged.

Source: Linters/SAST tools

with:
dotnet-version: 10.*
dotnet-version: 10.x

- name: Restore
run: dotnet restore src/Slack.Webhooks.sln

- name: Build
run: .\build.ps1
shell: pwsh
id: build
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NUGET_TOKEN: ${{ secrets.NugetKey }}
- name: Add artifacts
uses: actions/upload-artifact@v4
run: dotnet build src/Slack.Webhooks.sln --configuration Release --no-restore

- name: Test
run: >
dotnet test src/Slack.Webhooks.Tests/Slack.Webhooks.Tests.csproj
--configuration Release
--framework net10.0
--no-build
/p:CollectCoverage=true
/p:CoverletOutputFormat=opencover
/p:CoverletOutput=../../artifacts/coverlet-output

publish:
name: Publish to NuGet
runs-on: ubuntu-latest
needs: build
if: startsWith(github.ref, 'refs/tags/v')
environment: release
permissions:
contents: read
id-token: write

steps:
- name: Checkout
uses: actions/checkout@v5

- name: Setup .NET
uses: actions/setup-dotnet@v5
with:
name: ${{ steps.build.outputs.nupkg_name }}
path: ${{ steps.build.outputs.nupkg }}
dotnet-version: 10.x

- name: Set package version
id: version
shell: bash
run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

- name: Restore
run: dotnet restore src/Slack.Webhooks/Slack.Webhooks.csproj

- name: Pack
run: >
dotnet pack src/Slack.Webhooks/Slack.Webhooks.csproj
--configuration Release
--no-restore
--output artifacts
-p:PackageVersion=${{ steps.version.outputs.version }}
-p:ContinuousIntegrationBuild=true

- name: NuGet login
uses: NuGet/login@v1
id: login
with:
user: mrb0nj

- name: NuGet push
run: >
dotnet nuget push "artifacts/*.nupkg"
--api-key "${{ steps.login.outputs.NUGET_API_KEY }}"
--source https://api.nuget.org/v3/index.json
--skip-duplicate
6 changes: 0 additions & 6 deletions GitVersion.yml
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ Requirements:

1. You must first enable the Webhooks integration for your Slack Account to get the Token. You can enable it here: https://slack.com/services/new/incoming-webhook
2. Slack.Webhooks depends on JSON.net
3. Compatible with .NET 4.5+ and .NET Core. If you need .NET 3.5/4 you can use an older release, but this may be out of date.
3. Compatible with .NET Standard 2.0. If you need .NET Framework 4.5 or older .NET Standard support, use version 1.1.5 or earlier.

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check available versions of Slack.Webhooks package
curl -s 'https://api.nuget.org/v3/registration5-semver1/slack.webhooks/index.json' | jq -r '.items[].items[] | .catalogEntry | "\(.version) - \(.listed) - Targets: \(.dependencyGroups[].targetFramework // "N/A")"' | sort -V

Repository: mrb0nj/Slack.Webhooks

Length of output: 1063

Clarify legacy framework version guidance in README.md (lines 55 vs 68)

NuGet confirms Slack.Webhooks 1.1.5 exists and targets .NETFramework4.5 and .NETStandard1.3, so the line 55 reference is valid. However, the README still doesn’t clearly define the cutoff for “older .NET framework support” (line 68 uses 0.1.8) versus the “.NET Framework 4.5 or older” wording on line 55—please specify which framework versions/TFMs map to 1.1.5 vs 0.1.8.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 55, Update the README text to explicitly map the legacy
package versions to their target TFMs: state that version 1.1.5 targets
.NETFramework4.5 and .NETStandard1.3 (replace the ambiguous “.NET Framework 4.5
or older” phrasing) and clarify which TFMs the older 0.1.8 release targets (look
up the NuGet package metadata to get the exact TFMs) so the two sentences (the
“Compatible with .NET Standard 2.0…” line and the “older .NET framework
support”/0.1.8 reference) unambiguously list the exact framework versions for
1.1.5 and 0.1.8.


Download:

Expand Down
163 changes: 0 additions & 163 deletions build.cake
View file
Open in desktop

This file was deleted.

Loading