Use new release method (#3)

.github/workflows/ci.yml

@@ -17,27 +17,40 @@ env:
   POWERSHELL_TELEMETRY_OPTOUT: 1
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
   DOTNET_NOLOGO: true
-  BUILD_CONFIGURATION: ${{ fromJSON('["Debug", "Release"]')[startsWith(github.ref, 'refs/tags/v')] }}
+  BUILD_CONFIGURATION: ${{ fromJSON('["Debug", "Release"]')[github.ref == 'refs/heads/main'] }}
 
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Azure OIDC auth
+      contents: read  # Repo checkout
+
     steps:
     - name: Check out repository
       uses: actions/checkout@v3
 
-    - name: Build module - Debug
+    - name: OIDC Login to Azure
+      if: ${{ env.BUILD_CONFIGURATION == 'Release' }}
+      uses: azure/login@v1
+      with:
+        client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+    - name: Build module - Release
+      if: ${{ env.BUILD_CONFIGURATION == 'Release' }}
       shell: pwsh
       run: ./build.ps1 -Configuration $env:BUILD_CONFIGURATION -Task Build
-      if: ${{ env.BUILD_CONFIGURATION == 'Debug' }}
+      env:
+        AZURE_KEYVAULT_NAME: ${{ secrets.AZURE_KEYVAULT_NAME }}
+        AZURE_KEYVAULT_CERT: ${{ secrets.AZURE_KEYVAULT_CERT }}
 
-    - name: Build module - Publish
+    - name: Build module - Debug
       shell: pwsh
       run: ./build.ps1 -Configuration $env:BUILD_CONFIGURATION -Task Build
-      if: ${{ env.BUILD_CONFIGURATION == 'Release' }}
-      env:
-        AZURE_KEYVAULT_CREDENTIALS: ${{ secrets.AZURE_KEYVAULT_CREDENTIALS }}
+      if: ${{ env.BUILD_CONFIGURATION == 'Debug' }}
 
     - name: Capture PowerShell Module
       uses: actions/upload-artifact@v3
@@ -136,28 +149,3 @@ jobs:
       with:
         files: ./output/TestResults/Coverage.xml
         flags: ${{ matrix.info.name }}
-
-  publish:
-    name: publish
-    if: startsWith(github.ref, 'refs/tags/v')
-    needs:
-    - build
-    - test
-    runs-on: ubuntu-latest
-    steps:
-    - name: Restore Built PowerShell Module
-      uses: actions/download-artifact@v3
-      with:
-        name: PSModule
-        path: ./
-
-    - name: Publish to Gallery
-      if: github.event_name == 'release'
-      shell: pwsh
-      run: >-
-        dotnet nuget push '*.nupkg'
-        --api-key $env:PSGALLERY_TOKEN
-        --source 'https://www.powershellgallery.com/api/v2/package'
-        --no-symbols
-      env:
-        PSGALLERY_TOKEN: ${{ secrets.PSGALLERY_TOKEN }}

.github/workflows/publish.yml

@@ -0,0 +1,36 @@
+name: Publish module
+on:
+  release:
+    types:
+    - published
+
+jobs:
+  build:
+    name: publish
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # Needed for GitHub release asset task
+
+    steps:
+    - name: Download
+      uses: dawidd6/action-download-artifact@v2
+      with:
+        workflow: ci.yml
+        commit: ${{ github.sha }}
+        name: PSModule
+
+    - name: Upload nupkg as release asset
+      uses: softprops/action-gh-release@v1
+      with:
+        files: '*.nupkg'
+
+    - name: Publish to the PowerShell Gallery
+      shell: pwsh
+      run: >-
+        dotnet nuget push '*.nupkg'
+        --api-key $env:PSGALLERY_TOKEN
+        --source 'https://www.powershellgallery.com/api/v2/package'
+        --no-symbols
+      env:
+        PSGALLERY_TOKEN: ${{ secrets.PSGALLERY_TOKEN }}

Ctypes.build.ps1

@@ -33,7 +33,7 @@ task Clean {
 
 task BuildDocs {
     $helpParams = @{
-        Path       = [IO.Path]::Combine($PSScriptRoot, 'docs', 'en-US')
+        Path = [IO.Path]::Combine($PSScriptRoot, 'docs', 'en-US')
         OutputPath = [IO.Path]::Combine($ReleasePath, 'en-US')
     }
     New-ExternalHelp @helpParams | Out-Null
@@ -65,10 +65,10 @@ task BuildManaged {
 
 task CopyToRelease {
     $copyParams = @{
-        Path        = [IO.Path]::Combine($PowerShellPath, '*')
+        Path = [IO.Path]::Combine($PowerShellPath, '*')
         Destination = $ReleasePath
-        Recurse     = $true
-        Force       = $true
+        Recurse = $true
+        Force = $true
     }
     Copy-Item @copyParams
 
@@ -83,26 +83,16 @@ task CopyToRelease {
 }
 
 task Sign {
-    if (-not $env:AZURE_KEYVAULT_CREDENTIALS) {
+    $vaultName = $env:AZURE_KEYVAULT_NAME
+    $vaultCert = $env:AZURE_KEYVAULT_CERT
+    if (-not $vaultName -or -not $vaultCert) {
         return
     }
 
-    $credInfo = ConvertFrom-Json -InputObject $env:AZURE_KEYVAULT_CREDENTIALS
-    $vaultName = $credInfo.vaultName
-    $vaultCert = $credInfo.vaultCert
-
-    $env:AZURE_CLIENT_ID = $credInfo.clientId
-    $env:AZURE_CLIENT_SECRET = $credInfo.clientSecret
-    $env:AZURE_TENANT_ID = $credInfo.tenantId
     $key = Get-OpenAuthenticodeAzKey -Vault $vaultName -Certificate $vaultCert
-    $env:AZURE_CLIENT_ID = ''
-    $env:AZURE_CLIENT_SECRET = ''
-    $env:AZURE_TENANT_ID = ''
-
     $signParams = @{
         Key = $key
         TimeStampServer = 'http://timestamp.digicert.com'
-        HashAlgorithm = 'SHA256'
     }
 
     Get-ChildItem -LiteralPath $ReleasePath -Recurse -ErrorAction SilentlyContinue |
@@ -123,9 +113,9 @@ task Package {
     }
 
     $repoParams = @{
-        Name               = 'LocalRepo'
-        SourceLocation     = $BuildPath
-        PublishLocation    = $BuildPath
+        Name = 'LocalRepo'
+        SourceLocation = $BuildPath
+        PublishLocation = $BuildPath
         InstallationPolicy = 'Trusted'
     }
     if (Get-PSRepository -Name $repoParams.Name -ErrorAction SilentlyContinue) {
@@ -143,9 +133,9 @@ task Package {
 
 task Analyze {
     $pssaSplat = @{
-        Path        = $ReleasePath
-        Settings    = [IO.Path]::Combine($PSScriptRoot, 'ScriptAnalyzerSettings.psd1')
-        Recurse     = $true
+        Path = $ReleasePath
+        Settings = [IO.Path]::Combine($PSScriptRoot, 'ScriptAnalyzerSettings.psd1')
+        Recurse = $true
         ErrorAction = 'SilentlyContinue'
     }
     $results = Invoke-ScriptAnalyzer @pssaSplat
@@ -181,16 +171,14 @@ task DoUnitTest {
             'test'
             $testsPath
             '--results-directory', $tempResultsPath
-            if ($Configuration -eq 'Debug') {
-                '--collect:"XPlat Code Coverage"'
-                '--'
-                "$runSettingsPrefix.Format=json"
-                if ($UseNativeArguments) {
-                    "$runSettingsPrefix.IncludeDirectory=`"$CSharpPath`""
-                }
-                else {
-                    "$runSettingsPrefix.IncludeDirectory=\`"$CSharpPath\`""
-                }
+            '--collect:"XPlat Code Coverage"'
+            '--'
+            "$runSettingsPrefix.Format=json"
+            if ($UseNativeArguments) {
+                "$runSettingsPrefix.IncludeDirectory=`"$CSharpPath`""
+            }
+            else {
+                "$runSettingsPrefix.IncludeDirectory=\`"$CSharpPath\`""
             }
         )
 
@@ -201,9 +189,7 @@ task DoUnitTest {
             throw "Unit tests failed"
         }
 
-        if ($Configuration -eq 'Debug') {
-            Move-Item -Path $tempResultsPath/*/*.json -Destination $resultsPath/UnitCoverage.json -Force
-        }
+        Move-Item -Path $tempResultsPath/*/*.json -Destination $resultsPath/UnitCoverage.json -Force
     }
     finally {
         Remove-Item -LiteralPath $tempResultsPath -Force -Recurse
@@ -234,33 +220,30 @@ task DoTest {
         '-OutputFile', $resultsFile
     )
 
-    if ($Configuration -eq 'Debug') {
-        # We use coverlet to collect code coverage of our binary
-        $unitCoveragePath = [IO.Path]::Combine($resultsPath, 'UnitCoverage.json')
-        $targetArgs = '"' + ($arguments -join '" "') + '"'
+    # We use coverlet to collect code coverage of our binary
+    $unitCoveragePath = [IO.Path]::Combine($resultsPath, 'UnitCoverage.json')
+    $targetArgs = '"' + ($arguments -join '" "') + '"'
 
-        if ($UseNativeArguments) {
-            $watchFolder = [IO.Path]::Combine($ReleasePath, 'bin', $PSFramework)
-        }
-        else {
-            $targetArgs = '"' + ($targetArgs -replace '"', '\"') + '"'
-            $watchFolder = '"{0}"' -f ([IO.Path]::Combine($ReleasePath, 'bin', $PSFramework))
-        }
-
-        $arguments = @(
-            $watchFolder
-            '--target', $pwsh
-            '--targetargs', $targetArgs
-            '--output', ([IO.Path]::Combine($resultsPath, 'Coverage.xml'))
-            '--format', 'cobertura'
-            if (Test-Path -LiteralPath $unitCoveragePath) {
-                '--merge-with', $unitCoveragePath
-            }
-        )
-        $pwsh = 'coverlet'
+    if ($UseNativeArguments) {
+        $watchFolder = [IO.Path]::Combine($ReleasePath, 'bin', $PSFramework)
     }
+    else {
+        $targetArgs = '"' + ($targetArgs -replace '"', '\"') + '"'
+        $watchFolder = '"{0}"' -f ([IO.Path]::Combine($ReleasePath, 'bin', $PSFramework))
+    }
+
+    $arguments = @(
+        $watchFolder
+        '--target', $pwsh
+        '--targetargs', $targetArgs
+        '--output', ([IO.Path]::Combine($resultsPath, 'Coverage.xml'))
+        '--format', 'cobertura'
+        if (Test-Path -LiteralPath $unitCoveragePath) {
+            '--merge-with', $unitCoveragePath
+        }
+    )
 
-    &$pwsh $arguments
+    & coverlet $arguments
     if ($LASTEXITCODE) {
         throw "Pester failed tests"
     }

requirements-dev.psd1

@@ -1,7 +1,7 @@
 @{
-    InvokeBuild      = '5.10.4'
-    OpenAuthenticode = '0.2.0'
-    Pester           = '5.4.1'
-    platyPS          = '0.14.2'
+    InvokeBuild = '5.10.4'
+    OpenAuthenticode = '0.4.0'
+    Pester = '5.5.0'
+    platyPS = '0.14.2'
     PSScriptAnalyzer = '1.21.0'
 }