Improve workflows

.github/workflows/ci.yml

@@ -2,61 +2,80 @@ name: Always be deploying
 
 on:
   pull_request:
-    paths-ignore: 
+    paths-ignore:
       - 'README.md'
       - '.editorconfig'
   push:
     paths-ignore:
       - 'README.md'
       - '.editorconfig'
     branches:
-      - master 
+      - master
     tags:
       - "*.*.*"
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 1
     - run: |
         git fetch --prune --unshallow --tags
         echo exit code $?
         git tag --list
-    - uses: actions/setup-dotnet@v2
+    - uses: actions/setup-dotnet@v4
       with:
           dotnet-version: |
               3.0.103
               3.1.421
               6.0.302
           source-url: https://nuget.pkg.github.com/editorconfig/index.json
       env:
-          NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
-        
-    - run: ./build.sh build -s true
-      name: Build
-    - run: ./build.sh generatepackages -s true
-      name: Generate local nuget packages
-    - run: ./build.sh validatepackages -s true
-      name: "validate *.npkg files that were created"
-    - run: ./build.sh generateapichanges -s true
-      name: "Inspect public API changes"
+          NUGET_AUTH_TOKEN: ${{github.token}}
+
+    - name: Build
+      run: ./build.sh build -s true
+    - name: Generate local nuget packages
+      run: ./build.sh generatepackages -s true
+    - name: "validate *.npkg files that were created"
+      run: ./build.sh validatepackages -s true
+    - name: "Inspect public API changes"
+      run: ./build.sh generateapichanges -s true
 
     - name: publish to github package repository
       if: github.event_name == 'push' && startswith(github.ref, 'refs/heads')
+      env:
+        GH_TOKEN: ${{ github.token }}
       shell: bash
-      run:  |
-         until dotnet nuget push 'build/output/*.nupkg' -k ${{secrets.GITHUB_TOKEN}} --skip-duplicate --no-symbols true; do echo "Retrying"; sleep 1; done;
+      run: |
+        : publish to github package repository
+        log=$(mktemp)
+        until dotnet nuget push 'build/output/*.nupkg' -k "$GH_TOKEN" --skip-duplicate --no-symbols true | tee "$log"; do
+          if grep -q '^error:.*' "$log"; then
+            perl -ne 'next unless s/^error: /::error ::/; print;' "$log"
+            exit 1
+          fi
+          echo "Retrying"
+          sleep 1
+        done
 
-    - run: ./build.sh generatereleasenotes -s true
-      name: Generate release notes for tag
+    - name: Generate release notes for tag
       if: github.event_name == 'push' && startswith(github.ref, 'refs/tags')
-    - run: ./build.sh createreleaseongithub -s true --token ${{secrets.GITHUB_TOKEN}}
+      run: ./build.sh generatereleasenotes -s true
+    - name: Create or update release for tag on github
       if: github.event_name == 'push' && startswith(github.ref, 'refs/tags')
-      name: Create or update release for tag on github
-
-    - run: dotnet nuget push 'build/output/*.nupkg' -k ${{secrets.NUGET_ORG_API_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols true
-      name: release to nuget.org
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: ./build.sh createreleaseongithub -s true --token "$GH_TOKEN"
+
+    - name: release to nuget.org
       if: github.event_name == 'push' && startswith(github.ref, 'refs/tags')
+      env:
+        NUGET_ORG_API_KEY: ${{secrets.NUGET_ORG_API_KEY}}
+      run: |
+        dotnet nuget push 'build/output/*.nupkg' -k "$NUGET_ORG_API_KEY" -s https://api.nuget.org/v3/index.json --skip-duplicate --no-symbols true

.github/workflows/verify.yaml

@@ -5,15 +5,17 @@ on: [push, pull_request]
 jobs:
   linux:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 1
     - run: |
         git fetch --prune --unshallow --tags
         echo exit code $?
         git tag --list
-    - uses: actions/setup-dotnet@v2
+    - uses: actions/setup-dotnet@v4
       with:
           dotnet-version: |
               3.0.103
@@ -32,16 +34,16 @@ jobs:
     - name: Core tests
       run: 'cmake . && ctest . -E "max_property_(name|value)|max_section_name_ignore" '
   windows:
-    runs-on: windows-2019
+    runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 1
     - run: |
         git fetch --prune --unshallow --tags
         echo exit code $?
         git tag --list
-    - uses: actions/setup-dotnet@v2
+    - uses: actions/setup-dotnet@v4
       with:
           dotnet-version: |
               3.0.103