fix: address security vulnerabilities, architecture issues, and test coverage gaps #42

Workflow file for this run

	name: Build and Release

	on:
	push:
	branches: [ main, master ]
	tags:
	- 'v*'
	pull_request:
	branches: [ main, master ]
	workflow_dispatch: # Allows manual triggering

	jobs:
	create-tag:
	name: Create Tag from Version
	runs-on: ubuntu-latest
	if: github.ref == 'refs/heads/main' \|\| github.ref == 'refs/heads/master'
	permissions:
	contents: write
	outputs:
	tag_name: ${{ steps.get-version.outputs.tag }}

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Extract version from csproj
	id: get-version
	run: \|
	VERSION=$(grep '<Version>' teams-phonemanager.csproj \| sed -n 's/.<Version>$[0-9.]$<\/Version>.*/\1/p' \| head -1)
	TAG="v$VERSION"
	echo "version=$VERSION" >> $GITHUB_OUTPUT
	echo "tag=$TAG" >> $GITHUB_OUTPUT
	echo "Extracted version: $VERSION"
	echo "Tag will be: $TAG"

	- name: Check if tag exists
	id: check-tag
	run: \|
	TAG="${{ steps.get-version.outputs.tag }}"
	if git rev-parse "$TAG" >/dev/null 2>&1; then
	echo "exists=true" >> $GITHUB_OUTPUT
	echo "Tag $TAG already exists, skipping tag creation"
	else
	echo "exists=false" >> $GITHUB_OUTPUT
	echo "Tag $TAG does not exist, will create it"
	fi

	- name: Import GPG key
	if: steps.check-tag.outputs.exists == 'false'
	uses: crazy-max/ghaction-import-gpg@v6
	with:
	gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
	passphrase: ${{ secrets.GPG_PASSPHRASE }}
	git_user_signingkey: true
	git_commit_gpgsign: true

	- name: Create and push tag
	if: steps.check-tag.outputs.exists == 'false'
	env:
	GITHUB_TOKEN: ${{ secrets.PAT_TOKEN \|\| secrets.GITHUB_TOKEN }}
	run: \|
	TAG="${{ steps.get-version.outputs.tag }}"
	git remote set-url origin https://${{ github.actor }}:${{ secrets.PAT_TOKEN \|\| secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git
	git tag -s "$TAG" -m "Release $TAG"
	git push origin "$TAG"
	echo "Created and pushed tag: $TAG"

	build:
	name: Build ${{ matrix.runtime }} on ${{ matrix.os }}
	runs-on: ${{ matrix.os }}
	needs: create-tag
	if: \|
	(github.ref == 'refs/heads/main' \|\| github.ref == 'refs/heads/master') &&
	needs.create-tag.outputs.tag_name != ''
	strategy:
	fail-fast: false
	matrix:
	include:
	- os: windows-latest
	runtime: win-x64
	output-type: WinExe
	- os: macos-latest
	runtime: osx-x64
	output-type: Exe
	- os: macos-latest
	runtime: osx-arm64
	output-type: Exe
	- os: ubuntu-latest
	runtime: linux-x64
	output-type: Exe

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	ref: ${{ github.sha }}

	- name: Setup .NET
	uses: actions/setup-dotnet@v4
	with:
	dotnet-version: '10.0.x'

	- name: Download PowerShell modules (Windows)
	if: matrix.os == 'windows-latest'
	shell: pwsh
	run: ./Scripts/download-modules.ps1

	- name: Download PowerShell modules (macOS/Linux)
	if: matrix.os != 'windows-latest'
	shell: bash
	run: \|
	chmod +x Scripts/download-modules.sh
	./Scripts/download-modules.sh

	- name: Restore dependencies
	run: dotnet restore

	- name: Build
	run: dotnet build --configuration Release --no-restore

	- name: Run tests
	run: dotnet test --configuration Release --no-build --verbosity normal

	- name: Publish
	run: dotnet publish --configuration Release --runtime ${{ matrix.runtime }} --self-contained false --output ./publish/${{ matrix.runtime }} /p:OutputType=${{ matrix.output-type }}

	- name: Upload build artifacts
	uses: actions/upload-artifact@v4
	with:
	name: teams-phonemanager-${{ matrix.runtime }}
	path: ./publish/${{ matrix.runtime }}
	retention-days: 30

	create-release:
	name: Create Release
	needs: [create-tag, build]
	runs-on: ubuntu-latest
	if: \|
	(github.ref == 'refs/heads/main' \|\| github.ref == 'refs/heads/master') &&
	needs.create-tag.outputs.tag_name != ''
	permissions:
	contents: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Get tag name
	id: tag
	run: \|
	TAG_NAME="${{ needs.create-tag.outputs.tag_name }}"
	echo "tag_name=$TAG_NAME" >> $GITHUB_OUTPUT
	echo "Creating release for tag: $TAG_NAME"

	- name: Download Windows artifacts
	uses: actions/download-artifact@v4
	with:
	name: teams-phonemanager-win-x64
	path: ./artifacts/win-x64

	- name: Download macOS Intel artifacts
	uses: actions/download-artifact@v4
	with:
	name: teams-phonemanager-osx-x64
	path: ./artifacts/osx-x64

	- name: Download macOS Apple Silicon artifacts
	uses: actions/download-artifact@v4
	with:
	name: teams-phonemanager-osx-arm64
	path: ./artifacts/osx-arm64

	- name: Download Linux artifacts
	uses: actions/download-artifact@v4
	with:
	name: teams-phonemanager-linux-x64
	path: ./artifacts/linux-x64

	- name: List downloaded artifacts
	run: \|
	echo "Windows artifacts:"
	ls -la artifacts/win-x64/ \|\| echo "No Windows artifacts found"
	echo ""
	echo "macOS Intel artifacts:"
	ls -la artifacts/osx-x64/ \|\| echo "No macOS Intel artifacts found"
	echo ""
	echo "macOS Apple Silicon artifacts:"
	ls -la artifacts/osx-arm64/ \|\| echo "No macOS Apple Silicon artifacts found"
	echo ""
	echo "Linux artifacts:"
	ls -la artifacts/linux-x64/ \|\| echo "No Linux artifacts found"

	- name: Create zip archives
	run: \|
	if [ -d "artifacts/win-x64" ] && [ "$(ls -A artifacts/win-x64)" ]; then
	cd artifacts/win-x64
	zip -r ../teams-phonemanager-win-x64.zip .
	cd ../..
	echo "Created Windows zip archive"
	else
	echo "Windows artifacts directory is empty or missing"
	fi

	if [ -d "artifacts/osx-x64" ] && [ "$(ls -A artifacts/osx-x64)" ]; then
	# Ensure executable has proper permissions before zipping
	if [ -f "artifacts/osx-x64/teams-phonemanager" ]; then
	chmod +x artifacts/osx-x64/teams-phonemanager
	echo "Set executable permissions for teams-phonemanager"
	ls -la artifacts/osx-x64/teams-phonemanager
	fi
	cd artifacts/osx-x64
	zip -r ../teams-phonemanager-osx-x64.zip .
	cd ../..
	echo "Created macOS Intel zip archive"
	else
	echo "macOS Intel artifacts directory is empty or missing"
	fi

	if [ -d "artifacts/osx-arm64" ] && [ "$(ls -A artifacts/osx-arm64)" ]; then
	# Ensure executable has proper permissions before zipping
	if [ -f "artifacts/osx-arm64/teams-phonemanager" ]; then
	chmod +x artifacts/osx-arm64/teams-phonemanager
	echo "Set executable permissions for teams-phonemanager (Apple Silicon)"
	ls -la artifacts/osx-arm64/teams-phonemanager
	fi
	cd artifacts/osx-arm64
	zip -r ../teams-phonemanager-osx-arm64.zip .
	cd ../..
	echo "Created macOS Apple Silicon zip archive"
	else
	echo "macOS Apple Silicon artifacts directory is empty or missing"
	fi

	if [ -d "artifacts/linux-x64" ] && [ "$(ls -A artifacts/linux-x64)" ]; then
	# Ensure executable has proper permissions before zipping
	if [ -f "artifacts/linux-x64/teams-phonemanager" ]; then
	chmod +x artifacts/linux-x64/teams-phonemanager
	echo "Set executable permissions for teams-phonemanager (Linux)"
	ls -la artifacts/linux-x64/teams-phonemanager
	fi
	cd artifacts/linux-x64
	zip -r ../teams-phonemanager-linux-x64.zip .
	cd ../..
	echo "Created Linux zip archive"
	else
	echo "Linux artifacts directory is empty or missing"
	fi

	echo "Zip files created:"
	ls -lh artifacts/*.zip 2>/dev/null \|\| echo "No zip files found"

	- name: Create Release
	uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981 # v2.0.8
	with:
	tag_name: ${{ steps.tag.outputs.tag_name }}
	name: ${{ steps.tag.outputs.tag_name }}
	files: \|
	artifacts/teams-phonemanager-win-x64.zip
	artifacts/teams-phonemanager-osx-x64.zip
	artifacts/teams-phonemanager-osx-arm64.zip
	artifacts/teams-phonemanager-linux-x64.zip
	fail_on_unmatched_files: false
	draft: false
	prerelease: false
	generate_release_notes: true
	env:
	GITHUB_TOKEN: ${{ secrets.PAT_TOKEN \|\| secrets.GITHUB_TOKEN }}

Navigation Menu

fix: address security vulnerabilities, architecture issues, and test coverage gaps #42

Workflow file

fix: address security vulnerabilities, architecture issues, and test coverage gaps #42

Uh oh!

Workflow file for this run