ci-pipeline.yml

name: Newtonsoft.Json Ext. CI Pipeline
on:
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      configuration:
        type: choice
        description: The build configuration to use in the deploy stage.
        required: true
        default: Release
        options:
          - Debug
          - Release
      run_mac_tests:
        type: boolean
        description: Run the macOS test matrix despite the additional cost and runtime.
        default: false

permissions:
  contents: read

jobs:
  init:
    name: initialize
    runs-on: ubuntu-24.04
    outputs:
      run-mac-tests: ${{ steps.vars.outputs.run-mac-tests }}
      run-privileged-jobs: ${{ steps.vars.outputs.run-privileged-jobs }}
      strong-name-key-filename: ${{ steps.vars.outputs.strong-name-key-filename }}
      build-switches: ${{ steps.vars.outputs.build-switches }}
    steps:
      - id: vars
        name: calculate workflow variables
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.run_mac_tests }}" == "true" ]]; then
            echo "run-mac-tests=true" >> "$GITHUB_OUTPUT"
          else
            echo "run-mac-tests=false" >> "$GITHUB_OUTPUT"
          fi

          if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
            echo "run-privileged-jobs=false" >> "$GITHUB_OUTPUT"
            echo "strong-name-key-filename=" >> "$GITHUB_OUTPUT"
            echo "build-switches=-p:SkipSignAssembly=true" >> "$GITHUB_OUTPUT"
          else
            echo "run-privileged-jobs=true" >> "$GITHUB_OUTPUT"
            echo "strong-name-key-filename=newtonsoft.snk" >> "$GITHUB_OUTPUT"
            echo "build-switches=" >> "$GITHUB_OUTPUT"
          fi

  build:
    name: call-build
    needs: [init]
    strategy:
      matrix:
        configuration: [Debug, Release]
        arch: [X64, ARM64]
    uses: codebeltnet/jobs-dotnet-build/.github/workflows/default.yml@v3
    with:
      configuration: ${{ matrix.configuration }}
      strong-name-key-filename: ${{ needs.init.outputs.strong-name-key-filename }}
      build-switches: ${{ needs.init.outputs.build-switches }}
      runs-on: ${{ matrix.arch == 'ARM64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
      upload-build-artifact-name: build-${{ matrix.configuration }}-${{ matrix.arch }}
    secrets: inherit

  pack:
    name: call-pack
    needs: [build]
    strategy:
      matrix:
        configuration: [Debug, Release]
    uses: codebeltnet/jobs-dotnet-pack/.github/workflows/default.yml@v3
    with:
      configuration: ${{ matrix.configuration }}
      version: ${{ needs.build.outputs.version }}
      download-build-artifact-pattern: build-${{ matrix.configuration }}-X64

  test_linux:
    name: call-test-linux
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        arch: [X64, ARM64]
        configuration: [Debug, Release]
    uses: codebeltnet/jobs-dotnet-test/.github/workflows/default.yml@v3
    with:
      runs-on: ${{ matrix.arch == 'ARM64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
      configuration: ${{ matrix.configuration }}
      build-switches: -p:SkipSignAssembly=true
      restore: true # net48 requires restore
      build: true # net48 requires build
      download-pattern: build-${{ matrix.configuration }}-${{ matrix.arch }}

  test_windows:
    name: call-test-windows
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        arch: [X64, ARM64]
        configuration: [Debug, Release]
    uses: codebeltnet/jobs-dotnet-test/.github/workflows/default.yml@v3
    with:
      runs-on: ${{ matrix.arch == 'ARM64' && 'windows-11-arm' || 'windows-2025' }}
      configuration: ${{ matrix.configuration }}
      build-switches: -p:SkipSignAssembly=true
      restore: true # net48 requires restore
      build: true # net48 requires build
      download-pattern: build-${{ matrix.configuration }}-${{ matrix.arch }}

  test_mac:
    if: ${{ needs.init.outputs.run-mac-tests == 'true' }}
    name: call-test-mac
    needs: [init, build]
    strategy:
      fail-fast: false
      matrix:
        arch: [X64, ARM64]
        configuration: [Debug, Release]
    uses: codebeltnet/jobs-dotnet-test/.github/workflows/default.yml@v3
    with:
      runs-on: ${{ matrix.arch == 'ARM64' && 'macos-26' || 'macos-26-intel' }}
      configuration: ${{ matrix.configuration }}
      build-switches: -p:SkipSignAssembly=true
      restore: true
      build: true
      download-pattern: build-${{ matrix.configuration }}-${{ matrix.arch }}

  test_qualitygate:
    if: ${{ always() }}
    name: test-qualitygate
    needs: [init, test_linux, test_windows, test_mac]
    runs-on: ubuntu-24.04
    steps:
      - name: Evaluate test results
        shell: bash
        env:
          RUN_MAC_TESTS: ${{ needs.init.outputs.run-mac-tests }}
          TEST_LINUX_RESULT: ${{ needs.test_linux.result }}
          TEST_WINDOWS_RESULT: ${{ needs.test_windows.result }}
          TEST_MAC_RESULT: ${{ needs.test_mac.result }}
        run: |
          require_success() {
            local job_name="$1"
            local job_result="$2"

            if [[ "$job_result" != "success" ]]; then
              echo "::error::$job_name finished with '$job_result'."
              exit 1
            fi
          }

          require_success_or_skip() {
            local job_name="$1"
            local job_enabled="$2"
            local job_result="$3"

            if [[ "$job_enabled" == "true" ]]; then
              require_success "$job_name" "$job_result"
              return
            fi

            if [[ "$job_result" != "success" && "$job_result" != "skipped" ]]; then
              echo "::error::$job_name finished with '$job_result' while disabled."
              exit 1
            fi
          }

          require_success "test_linux" "$TEST_LINUX_RESULT"
          require_success "test_windows" "$TEST_WINDOWS_RESULT"
          require_success_or_skip "test_mac" "$RUN_MAC_TESTS" "$TEST_MAC_RESULT"
          
  sonarcloud:
    if: ${{always() && needs.init.outputs.run-privileged-jobs == 'true' && needs.build.result == 'success' && needs.test_qualitygate.result == 'success'}}
    name: call-sonarcloud
    needs: [init, build, test_qualitygate]
    uses: codebeltnet/jobs-sonarcloud/.github/workflows/default.yml@v3
    with:
      organization: geekle
      projectKey: newtonsoft-json
      version: ${{ needs.build.outputs.version }}
    secrets: inherit

  codecov:
    if: ${{always() && needs.init.outputs.run-privileged-jobs == 'true' && needs.build.result == 'success' && needs.test_qualitygate.result == 'success'}}
    name: call-codecov
    needs: [init, build, test_qualitygate]
    uses: codebeltnet/jobs-codecov/.github/workflows/default.yml@v1
    with:
      repository: codebeltnet/newtonsoft-json
    secrets: inherit
          
  codeql:
    if: ${{always() && needs.init.outputs.run-privileged-jobs == 'true' && needs.build.result == 'success' && needs.test_qualitygate.result == 'success'}}
    name: call-codeql
    needs: [init, build, test_qualitygate]
    uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v3
    permissions:
      security-events: write

  deploy:
    if: github.event_name != 'pull_request'
    name: call-nuget
    needs: [build, pack, test_qualitygate, sonarcloud, codecov, codeql]
    uses: codebeltnet/jobs-nuget-push/.github/workflows/default.yml@v3
    with:
      version: ${{ needs.build.outputs.version }}
      environment: Production
      configuration: ${{ inputs.configuration == '' && 'Release' || inputs.configuration }}
    permissions:
      contents: write
      packages: write
    secrets: inherit