Compare commits

..

8 Commits

Author SHA1 Message Date
dependabot[bot]
e37da4f70e chore(deps): bump the dependencies group across 1 directory with 2 updates
Bumps the dependencies group with 2 updates in the / directory: [1password/load-secrets-action](https://github.com/1password/load-secrets-action) and [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages).


Updates `1password/load-secrets-action` from 2.0.0 to 4.0.0
- [Release notes](https://github.com/1password/load-secrets-action/releases)
- [Commits](581a835fb5...92467eb28f)

Updates `peaceiris/actions-gh-pages` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/peaceiris/actions-gh-pages/releases)
- [Changelog](https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md)
- [Commits](4f9cc6602d...84c30a85c1)

---
updated-dependencies:
- dependency-name: 1password/load-secrets-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: peaceiris/actions-gh-pages
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-02 10:05:28 +00:00
Ikiru Yoshizaki
e5acc106ee Merge pull request #715 from Cysharp/ci/nuget
ci: use OIDC for NuGet package push authentication
2026-05-20 21:40:43 +09:00
Ikiru Yoshizaki
b0d26bebea ci: add dedicated publish job gated on build and build-unity 2026-05-20 19:38:57 +09:00
Ikiru Yoshizaki
4cfac5c9d2 ci: fix symbol generation options 61d8d3 2026-05-20 18:59:38 +09:00
Ikiru Yoshizaki
37251f09d4 ci: publish symbol files 2026-05-20 18:22:01 +09:00
Ikiru Yoshizaki
a18e8e38da ci: handle SymbolPackageFormat on build 2026-05-20 18:06:57 +09:00
Ikiru Yoshizaki
19b01fe8d6 ci: id-token permission 2026-05-20 16:48:40 +09:00
Ikiru Yoshizaki
a09a450b0f ci: use OIDC for NuGet package push authentication
This updates the build-release workflow to leverage OpenID Connect (OIDC) for authenticating with NuGet.org. The package push operation is now performed directly within the build job, replacing static API key usage with ephemeral credentials for enhanced security.
2026-05-20 16:12:26 +09:00
3 changed files with 32 additions and 9 deletions

View File

@@ -35,7 +35,7 @@ jobs:
steps: steps:
- name: Load secrets - name: Load secrets
id: op-load-secret id: op-load-secret
uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0 uses: 1password/load-secrets-action@92467eb28f72e8255933372f1e0707c567ce2259 # v4.0.0
with: with:
export-env: false export-env: false
env: env:

View File

@@ -17,7 +17,7 @@ jobs:
steps: steps:
- name: Load secrets - name: Load secrets
id: op-load-secret id: op-load-secret
uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0 uses: 1password/load-secrets-action@92467eb28f72e8255933372f1e0707c567ce2259 # v4.0.0
with: with:
export-env: false export-env: false
env: env:
@@ -52,7 +52,7 @@ jobs:
- name: Docfx build - name: Docfx build
run: dotnet docfx build docs/docfx.json run: dotnet docfx build docs/docfx.json
- name: Publish to GitHub Pages - name: Publish to GitHub Pages
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0 uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
with: with:
github_token: ${{ secrets.GITHUB_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: docs/_site publish_dir: docs/_site

View File

@@ -35,10 +35,10 @@ jobs:
with: with:
ref: ${{ needs.update-packagejson.outputs.sha }} ref: ${{ needs.update-packagejson.outputs.sha }}
- uses: Cysharp/Actions/.github/actions/setup-dotnet@main - uses: Cysharp/Actions/.github/actions/setup-dotnet@main
# build and pack # build and pack nuget (.nupkg and .symbols.nupkg will be created)
- run: dotnet build -c Release -p:Version=${{ inputs.tag }} - run: dotnet build -c Release -p:Version=${{ inputs.tag }}
- run: dotnet test -c Release --no-build - run: dotnet test -c Release --no-build
- run: dotnet pack ./src/UniTask.NetCore/UniTask.NetCore.csproj -c Release --no-build -p:Version=${{ inputs.tag }} -o ./publish - run: dotnet pack ./src/UniTask.NetCore/UniTask.NetCore.csproj -c Release --no-build -p:Version=${{ inputs.tag }} -p:IncludeSymbols=true -o ./publish
# Store artifacts. # Store artifacts.
- uses: Cysharp/Actions/.github/actions/upload-artifact@main - uses: Cysharp/Actions/.github/actions/upload-artifact@main
with: with:
@@ -58,7 +58,7 @@ jobs:
steps: steps:
- name: Load secrets - name: Load secrets
id: op-load-secret id: op-load-secret
uses: 1password/load-secrets-action@581a835fb51b8e7ec56b71cf2ffddd7e68bb25e0 # v2.0.0 uses: 1password/load-secrets-action@92467eb28f72e8255933372f1e0707c567ce2259 # v4.0.0
with: with:
export-env: false export-env: false
env: env:
@@ -96,9 +96,32 @@ jobs:
path: ./src/UniTask/UniTask.${{ inputs.tag }}.unitypackage path: ./src/UniTask/UniTask.${{ inputs.tag }}.unitypackage
retention-days: 1 retention-days: 1
# publish
publish:
name: "Publish NuGet packages"
needs: [build-dotnet, build-unity]
permissions:
contents: read
id-token: write # required for NuGet Trusted Publish
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: Cysharp/Actions/.github/actions/setup-dotnet@main
- uses: Cysharp/Actions/.github/actions/download-artifact@main
# push nuget
- name: NuGet login (OIDC)
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
id: login
with:
user: ${{ secrets.NUGET_USER }}
- run: dotnet nuget push "./nuget/*.nupkg" --skip-duplicate -s https://api.nuget.org/v3/index.json -k "${NUGET_KEY}"
if: ${{ !inputs.dry-run }}
env:
NUGET_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
# release # release
create-release: create-release:
needs: [update-packagejson, build-dotnet, build-unity] needs: [update-packagejson, publish]
permissions: permissions:
contents: write contents: write
id-token: write # required for NuGet Trusted Publish id-token: write # required for NuGet Trusted Publish
@@ -107,14 +130,14 @@ jobs:
commit-id: ${{ needs.update-packagejson.outputs.sha }} commit-id: ${{ needs.update-packagejson.outputs.sha }}
dry-run: ${{ inputs.dry-run }} dry-run: ${{ inputs.dry-run }}
tag: ${{ inputs.tag }} tag: ${{ inputs.tag }}
nuget-push: true nuget-push: false
release-upload: true release-upload: true
release-asset-path: ./UniTask.${{ inputs.tag }}.unitypackage/UniTask.${{ inputs.tag }}.unitypackage release-asset-path: ./UniTask.${{ inputs.tag }}.unitypackage/UniTask.${{ inputs.tag }}.unitypackage
secrets: inherit secrets: inherit
cleanup: cleanup:
if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }} if: ${{ needs.update-packagejson.outputs.is-branch-created == 'true' }}
needs: [update-packagejson, build-dotnet, build-unity] needs: [update-packagejson, create-release]
permissions: permissions:
contents: write contents: write
uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main uses: Cysharp/Actions/.github/workflows/clean-packagejson-branch.yaml@main