mirror of
https://github.com/GoodOlClint/PSProxmoxVE.git
synced 2026-09-04 03:05:32 +00:00
goodolclint-claude[bot]
4cc4e86cfb
The tag name was substituted into the pwsh script text by expression, so a tag containing a quote could run arbitrary PowerShell in the job that holds NUGET_API_KEY. The script now reads it from an env var and rejects anything that is not vX.Y.Z with an optional prerelease suffix. Co-authored-by: goodolclint-claude[bot] <323206664+goodolclint-claude[bot]@users.noreply.github.com>
116 lines
3.8 KiB
YAML
116 lines
3.8 KiB
YAML
name: Publish to PSGallery
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v6
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Build module
|
|
run: dotnet publish src/PSProxmoxVE/PSProxmoxVE.csproj --configuration Release --output ./publish/netstandard2.0
|
|
|
|
- name: Clean publish output
|
|
run: rm -f ./publish/netstandard2.0/*.deps.json ./publish/netstandard2.0/*.runtimeconfig.json
|
|
|
|
- name: Upload build artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: module-netstandard2.0
|
|
path: ./publish/netstandard2.0/
|
|
|
|
smoke-test-ps51:
|
|
needs: build
|
|
runs-on: windows-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Download module artifact
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: module-netstandard2.0
|
|
path: ./publish/netstandard2.0/
|
|
|
|
- name: Import module on Windows PowerShell 5.1
|
|
shell: powershell
|
|
run: |
|
|
$modulePath = "$env:USERPROFILE\Documents\WindowsPowerShell\Modules\PSProxmoxVE"
|
|
New-Item -ItemType Directory -Path $modulePath -Force | Out-Null
|
|
Copy-Item -Path .\publish\netstandard2.0\* -Destination $modulePath -Recurse -Force
|
|
Import-Module PSProxmoxVE -Force -ErrorAction Stop
|
|
$commands = Get-Command -Module PSProxmoxVE
|
|
Write-Host "PS 5.1 smoke test: module loaded with $($commands.Count) commands"
|
|
if ($commands.Count -lt 150) {
|
|
throw "Expected at least 150 commands, got $($commands.Count)"
|
|
}
|
|
|
|
publish:
|
|
needs: [build, smoke-test-ps51]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Download module artifact
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
name: module-netstandard2.0
|
|
path: ./publish/PSProxmoxVE/
|
|
|
|
# The tag name reaches the script through the environment, never through
|
|
# expression substitution into the script text. A tag is free-form and
|
|
# this job holds NUGET_API_KEY.
|
|
- name: Update module version in manifest
|
|
shell: pwsh
|
|
env:
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
if ($env:TAG -notmatch '^v(\d+\.\d+\.\d+)(-[0-9A-Za-z.-]+)?$') {
|
|
throw "Tag '$env:TAG' is not vX.Y.Z or vX.Y.Z-prerelease"
|
|
}
|
|
$manifestPath = './publish/PSProxmoxVE/PSProxmoxVE.psd1'
|
|
$moduleVersion = $Matches[1]
|
|
$content = Get-Content $manifestPath -Raw
|
|
$content = $content -replace "ModuleVersion\s*=\s*'[^']*'", "ModuleVersion = '$moduleVersion'"
|
|
Set-Content $manifestPath $content
|
|
|
|
- name: Test module loads on PS 7.x
|
|
shell: pwsh
|
|
run: |
|
|
$modulePath = "$HOME/.local/share/powershell/Modules/PSProxmoxVE"
|
|
New-Item -ItemType Directory -Path $modulePath -Force | Out-Null
|
|
Copy-Item -Path ./publish/PSProxmoxVE/* -Destination $modulePath -Recurse -Force
|
|
Import-Module PSProxmoxVE -Force -ErrorAction Stop
|
|
$commands = Get-Command -Module PSProxmoxVE
|
|
Write-Host "Module loaded with $($commands.Count) commands"
|
|
if ($commands.Count -lt 150) {
|
|
throw "Expected at least 150 commands, got $($commands.Count)"
|
|
}
|
|
|
|
- name: Publish to PSGallery
|
|
shell: pwsh
|
|
env:
|
|
NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
|
|
run: |
|
|
Publish-Module -Path ./publish/PSProxmoxVE -NuGetApiKey $env:NUGET_API_KEY -Verbose
|
|
|
|
- name: Create GitHub Release
|
|
uses: softprops/action-gh-release@v3
|
|
with:
|
|
generate_release_notes: true
|