feat(ci): 添加发布工作流支持NuGet和GitHub Packages#177
Merged
Merged
Conversation
- 实现自动构建和打包功能，支持标签触发 - 集成NuGet.org和GitHub Packages双重发布机制 - 添加许可证合规性检查和SBOM文件生成 - 实现GitHub Release自动创建和资产上传 - 配置OIDC身份验证和临时API密钥管理 - 添加包重复上传检测和跳过功能
- 移除了 NuGet.org 和 GitHub Packages 发布状态检查 - 简化了发布工作流的输出信息 - 更新了合规性检查部分的格式
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| C# |  |
Apr 5, 2026 12:23p.m. | Review ↗ |
| Secrets | |
Apr 5, 2026 12:23p.m. | Review ↗ |
Reviewer's Guide将发布工作流重构为多 Job 的流水线：先统一构建并打包，然后复用打包产物并发发布到 NuGet.org 和 GitHub Packages，最后创建携带合规产物的 GitHub Release，同时收紧权限配置，并将基于标签推导的版本号作为共享输出在各 Job 间传递。 基于标签触发的多 Job 发布流水线时序图sequenceDiagram
actor Developer
participant GitHub
participant job_build_pack as job_build_pack
participant job_publish_nuget as job_publish_nuget
participant job_publish_github as job_publish_github_packages
participant job_create_release as job_create_release
participant NuGetOrg
participant GitHubPackages
Developer->>GitHub: Push tag
GitHub->>job_build_pack: Trigger workflow on tag push
rect rgb(230,230,255)
job_build_pack->>job_build_pack: Checkout repository at tag
job_build_pack->>job_build_pack: Setup .NET 10.0.x
job_build_pack->>job_build_pack: Restore dependencies
job_build_pack->>job_build_pack: Determine tag version
job_build_pack->>job_build_pack: dotnet pack with tag-derived version
job_build_pack->>GitHub: Upload package artifacts (nupkg)
job_build_pack->>GitHub: Upload compliance artifacts (NOTICE, LICENSE-THIRD-PARTY, SBOM)
job_build_pack->>GitHub: Expose package_version as job output
end
GitHub-->>job_publish_nuget: Start after job_build_pack success
GitHub-->>job_publish_github: Start after job_build_pack success
rect rgb(230,255,230)
job_publish_nuget->>GitHub: Download package artifacts
job_publish_nuget->>job_publish_nuget: List downloaded packages
job_publish_nuget->>NuGetOrg: Exchange OIDC for temporary API key
job_publish_nuget->>NuGetOrg: dotnet nuget push *.nupkg with --skip-duplicate
end
rect rgb(255,230,230)
job_publish_github->>job_publish_github: Setup .NET
job_publish_github->>GitHub: Download package artifacts
job_publish_github->>job_publish_github: List downloaded packages
job_publish_github->>GitHubPackages: Configure GitHub Packages source using GITHUB_TOKEN
job_publish_github->>GitHubPackages: dotnet nuget push *.nupkg with --skip-duplicate
end
GitHub-->>job_create_release: Start after all publish jobs (always)
rect rgb(255,255,230)
job_create_release->>GitHub: Download package artifacts
job_create_release->>GitHub: Download compliance artifacts
job_create_release->>GitHub: Create GitHub Release using tag and package_version
job_create_release->>GitHub: Upload nupkg and compliance files as release assets
end
发布工作流中 CI Job 及产物复用的流程图flowchart TD
subgraph Trigger
A["Tag push<br/>(any tag)"]
end
subgraph Job1["job_build_pack"]
B1["Checkout repository at tag"]
B2["Setup .NET 10.0.x"]
B3["Restore dependencies"]
B4["Determine tag-derived version<br/>(output: package_version)"]
B5["dotnet pack → ./packages/*.nupkg"]
B6["Upload package artifacts<br/>(artifact: packages)"]
B7["Upload compliance artifacts<br/>(artifact: license-compliance)"]
end
subgraph Job2["job_publish_nuget"]
C1["Download packages artifact"]
C2["NuGet login via OIDC → temp API key"]
C3["dotnet nuget push *.nupkg<br/>to NuGet.org with --skip-duplicate"]
end
subgraph Job3["job_publish_github_packages"]
D1["Setup .NET 10.0.x"]
D2["Download packages artifact"]
D3["Configure GitHub Packages source<br/>using GITHUB_TOKEN"]
D4["dotnet nuget push *.nupkg<br/>to GitHub Packages with --skip-duplicate"]
end
subgraph Job4["job_create_release"]
E1["Download packages artifact"]
E2["Download license-compliance artifact"]
E3["Create GitHub Release<br/>for tag using package_version"]
E4["Attach nupkg and compliance files<br/>as release assets"]
end
A --> Job1
B1 --> B2 --> B3 --> B4 --> B5 --> B6 --> B7
Job1 -->|needs| Job2
Job1 -->|needs| Job3
Job2 --> C1 --> C2 --> C3
Job3 --> D1 --> D2 --> D3 --> D4
Job2 --> Job4
Job3 --> Job4
Job1 -->|output package_version| Job4
Job4 --> E1 --> E2 --> E3 --> E4
文件级变更
Tips and commands与 Sourcery 交互
自定义你的体验前往你的 dashboard 可以：
获取帮助Original review guide in EnglishReviewer's GuideRefactors the publish workflow into a multi-job pipeline that builds once, reuses packaged artifacts to publish concurrently to NuGet.org and GitHub Packages, and then creates a GitHub Release with compliance artifacts, while tightening permissions and using the tag-derived version as a shared output. Sequence diagram for tag-triggered multi-job publish pipelinesequenceDiagram
actor Developer
participant GitHub
participant job_build_pack as job_build_pack
participant job_publish_nuget as job_publish_nuget
participant job_publish_github as job_publish_github_packages
participant job_create_release as job_create_release
participant NuGetOrg
participant GitHubPackages
Developer->>GitHub: Push tag
GitHub->>job_build_pack: Trigger workflow on tag push
rect rgb(230,230,255)
job_build_pack->>job_build_pack: Checkout repository at tag
job_build_pack->>job_build_pack: Setup .NET 10.0.x
job_build_pack->>job_build_pack: Restore dependencies
job_build_pack->>job_build_pack: Determine tag version
job_build_pack->>job_build_pack: dotnet pack with tag-derived version
job_build_pack->>GitHub: Upload package artifacts (nupkg)
job_build_pack->>GitHub: Upload compliance artifacts (NOTICE, LICENSE-THIRD-PARTY, SBOM)
job_build_pack->>GitHub: Expose package_version as job output
end
GitHub-->>job_publish_nuget: Start after job_build_pack success
GitHub-->>job_publish_github: Start after job_build_pack success
rect rgb(230,255,230)
job_publish_nuget->>GitHub: Download package artifacts
job_publish_nuget->>job_publish_nuget: List downloaded packages
job_publish_nuget->>NuGetOrg: Exchange OIDC for temporary API key
job_publish_nuget->>NuGetOrg: dotnet nuget push *.nupkg with --skip-duplicate
end
rect rgb(255,230,230)
job_publish_github->>job_publish_github: Setup .NET
job_publish_github->>GitHub: Download package artifacts
job_publish_github->>job_publish_github: List downloaded packages
job_publish_github->>GitHubPackages: Configure GitHub Packages source using GITHUB_TOKEN
job_publish_github->>GitHubPackages: dotnet nuget push *.nupkg with --skip-duplicate
end
GitHub-->>job_create_release: Start after all publish jobs (always)
rect rgb(255,255,230)
job_create_release->>GitHub: Download package artifacts
job_create_release->>GitHub: Download compliance artifacts
job_create_release->>GitHub: Create GitHub Release using tag and package_version
job_create_release->>GitHub: Upload nupkg and compliance files as release assets
end
Flow diagram for CI jobs and artifact reuse in publish workflowflowchart TD
subgraph Trigger
A["Tag push<br/>(any tag)"]
end
subgraph Job1["job_build_pack"]
B1["Checkout repository at tag"]
B2["Setup .NET 10.0.x"]
B3["Restore dependencies"]
B4["Determine tag-derived version<br/>(output: package_version)"]
B5["dotnet pack → ./packages/*.nupkg"]
B6["Upload package artifacts<br/>(artifact: packages)"]
B7["Upload compliance artifacts<br/>(artifact: license-compliance)"]
end
subgraph Job2["job_publish_nuget"]
C1["Download packages artifact"]
C2["NuGet login via OIDC → temp API key"]
C3["dotnet nuget push *.nupkg<br/>to NuGet.org with --skip-duplicate"]
end
subgraph Job3["job_publish_github_packages"]
D1["Setup .NET 10.0.x"]
D2["Download packages artifact"]
D3["Configure GitHub Packages source<br/>using GITHUB_TOKEN"]
D4["dotnet nuget push *.nupkg<br/>to GitHub Packages with --skip-duplicate"]
end
subgraph Job4["job_create_release"]
E1["Download packages artifact"]
E2["Download license-compliance artifact"]
E3["Create GitHub Release<br/>for tag using package_version"]
E4["Attach nupkg and compliance files<br/>as release assets"]
end
A --> Job1
B1 --> B2 --> B3 --> B4 --> B5 --> B6 --> B7
Job1 -->|needs| Job2
Job1 -->|needs| Job3
Job2 --> C1 --> C2 --> C3
Job3 --> D1 --> D2 --> D3 --> D4
Job2 --> Job4
Job3 --> Job4
Job1 -->|output package_version| Job4
Job4 --> E1 --> E2 --> E3 --> E4
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - 我发现了 1 个问题，并给出了一些总体反馈：
publish-nuget这个 job 会调用dotnet nuget push，但在该 job 中并没有安装 .NET SDK；请在这里添加一个actions/setup-dotnet步骤（类似于build-pack/publish-github-packages），以避免运行时失败。- 在 GitHub Packages 配置和
action-gh-release步骤中，你都引用了secrets.GITHUB_TOKEN，但内置的 token 实际上是以github.token暴露的；请切换为使用${{ github.token }}（或者在支持的地方传入token: ${{ github.token }}），以确保身份验证在无需单独创建 secret 的情况下也能正常工作。
供 AI Agents 使用的提示词
请根据本次代码审查中的评论进行修改：
## 总体评论
- `publish-nuget` 这个 job 会调用 `dotnet nuget push`，但在该 job 中并没有安装 .NET SDK；请在这里添加一个 `actions/setup-dotnet` 步骤（类似于 `build-pack` / `publish-github-packages`），以避免运行时失败。
- 在 GitHub Packages 配置和 `action-gh-release` 步骤中，你都引用了 `secrets.GITHUB_TOKEN`，但内置的 token 实际上是以 `github.token` 暴露的；请切换为使用 `${{ github.token }}`（或者在支持的地方传入 `token: ${{ github.token }}`），以确保身份验证在无需单独创建 secret 的情况下也能正常工作。
## 具体评论
### 评论 1
<location path=".github/workflows/publish.yml" line_range="95-104" />
<code_context>
sbom-cyclonedx-validation.txt
- - name: Show packages
+
+ publish-nuget:
+ name: Publish To NuGet.org
+ runs-on: ubuntu-latest
+ needs: build-pack
+
+ permissions:
+ contents: read
+ packages: read
+ id-token: write
+
+ steps:
+ - name: Download package artifacts
+ uses: actions/download-artifact@v5
+ with:
+ name: packages
+ path: ./packages
+
+ - name: Show downloaded packages
run: ls -la ./packages || true
</code_context>
<issue_to_address>
**issue (bug_risk):** `publish-nuget` 这个 job 在没有设置 .NET SDK 的情况下使用了 `dotnet`，在缺少兼容 SDK 预安装的 runner 上可能会导致失败。
在原先的单一 job 中，.NET 是通过 `actions/setup-dotnet` 设置的，但新的 `publish-nuget` job 在没有该步骤的情况下调用了 `dotnet nuget push`。Ubuntu runner 可能没有安装兼容的 SDK。请在这里添加一个 `Setup .NET` 步骤（参考 `build-pack` / `publish-github-packages`），并使用相同的 `dotnet-version` 以保持行为一致并避免偶发性失败。
</issue_to_address>帮我变得更有用！请对每条评论点 👍 或 👎，我会根据反馈改进后续的代码审查。
Original comment in English
Hey - I've found 1 issue, and left some high level feedback:
- The
publish-nugetjob callsdotnet nuget pushbut doesn’t install the .NET SDK in that job; add aactions/setup-dotnetstep there (similar tobuild-pack/publish-github-packages) to avoid runtime failures. - In both the GitHub Packages configuration and the
action-gh-releasestep you referencesecrets.GITHUB_TOKEN, but the built-in token is exposed asgithub.token; switch to${{ github.token }}(or passtoken: ${{ github.token }}where supported) to ensure authentication works without requiring a separate secret.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `publish-nuget` job calls `dotnet nuget push` but doesn’t install the .NET SDK in that job; add a `actions/setup-dotnet` step there (similar to `build-pack`/`publish-github-packages`) to avoid runtime failures.
- In both the GitHub Packages configuration and the `action-gh-release` step you reference `secrets.GITHUB_TOKEN`, but the built-in token is exposed as `github.token`; switch to `${{ github.token }}` (or pass `token: ${{ github.token }}` where supported) to ensure authentication works without requiring a separate secret.
## Individual Comments
### Comment 1
<location path=".github/workflows/publish.yml" line_range="95-104" />
<code_context>
sbom-cyclonedx-validation.txt
- - name: Show packages
+
+ publish-nuget:
+ name: Publish To NuGet.org
+ runs-on: ubuntu-latest
+ needs: build-pack
+
+ permissions:
+ contents: read
+ packages: read
+ id-token: write
+
+ steps:
+ - name: Download package artifacts
+ uses: actions/download-artifact@v5
+ with:
+ name: packages
+ path: ./packages
+
+ - name: Show downloaded packages
run: ls -la ./packages || true
</code_context>
<issue_to_address>
**issue (bug_risk):** The `publish-nuget` job uses `dotnet` without setting up a .NET SDK, which can lead to failures on runners that don't have a compatible SDK preinstalled.
In the original monolithic job, .NET was set up via `actions/setup-dotnet`, but the new `publish-nuget` job calls `dotnet nuget push` without that step. Ubuntu runners may not have a compatible SDK installed. Please add a `Setup .NET` step here (mirroring `build-pack`/`publish-github-packages`) and use the same `dotnet-version` to keep behavior consistent and avoid flaky failures.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
- 添加 .NET 10.0 环境设置步骤 - 将密码参数从 secrets.GITHUB_TOKEN 替换为 github.token - 将环境变量中的 secrets.GITHUB_TOKEN 替换为 github.token
This was referenced May 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
将发布工作流拆分为多个独立的作业：构建/打包、发布到 NuGet.org 和 GitHub Packages，以及创建 GitHub Release，这些作业都由标签触发，并通过共享的构件和输出进行串联。
新功能：
增强改进：
Original summary in English
Summary by Sourcery
Split the publish workflow into separate jobs for building/packing, publishing to NuGet.org and GitHub Packages, and creating a GitHub Release, all triggered by tags and wired through shared artifacts and outputs.
New Features:
Enhancements: