QuanTAlib/.github/workflows/Publish.yml

# This workflow integrates SonarCloud analysis, coverage reporting,
# CodeQL analysis, SecurityCodeScan, and Codacy Security Scan
# for code scanning and vulnerability detection.

name: Publish Workflow

on:
  push:         # Triggers on push events to any branch
  pull_request: # Triggers on pull request events targeting any branch
  workflow_dispatch: # Allows manual triggering of the workflow

permissions:
  contents: write
  pull-requests: read     # Allows SonarCloud to decorate PRs with analysis results
  security-events: write  # Required for CodeQL analysis and uploading SARIF results

jobs:
  SonarCloud:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Install JDK11 for Sonar Scanner
        uses: actions/setup-java@v3
        with:
          java-version: '11'
          distribution: 'zulu'

      - name: Install dotnet-sonarscanner
        run: |
          dotnet tool install --global dotnet-sonarscanner
          dotnet tool install JetBrains.dotCover.GlobalTool --global
          dotnet tool install dotnet-coverage --global
          dotnet restore

      - name: SonarCloud Scanner Start
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          dotnet sonarscanner begin \
            /k:"mihakralj_QuanTAlib" \
            /o:"mihakralj" \
            /d:sonar.login="${{ secrets.SONAR_TOKEN }}" \
            /d:sonar.host.url="https://sonarcloud.io" \
            /d:sonar.cs.dotcover.reportsPaths=dotcover*

      - name: Build
        run: |
          dotnet build --no-restore --configuration Debug
          dotnet build ./lib/quantalib.csproj --configuration Release --nologo
          dotnet build ./quantower/Averages/Averages.csproj --configuration Release --nologo
          dotnet build ./quantower/Statistics/Statistics.csproj --configuration Release --nologo
          dotnet build ./quantower/Volatility/Volatility.csproj --configuration Release --nologo
          dotnet build ./SyntheticVendor/SyntheticVendor.csproj --configuration Release --nologo
          dotnet dotcover test Tests/Tests.csproj --dcReportType=HTML --dcoutput=./dotcover.html

      - name: SonarCloud Scanner End
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: dotnet sonarscanner end /d:sonar.login="${{ secrets.SONAR_TOKEN }}"

  Code_Coverage:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Install dotnet tools
        run: |
          dotnet tool install JetBrains.dotCover.GlobalTool --global
          dotnet tool install dotnet-sonarscanner --global
          dotnet tool install dotnet-coverage --global
          dotnet tool install --global coverlet.console
          dotnet tool install --global dotnet-reportgenerator-globaltool
          dotnet restore

      - name: Build Projects
        run: |
          dotnet build --no-restore --configuration Debug
          dotnet build ./lib/quantalib.csproj --configuration Release --nologo
          dotnet build ./quantower/Averages/Averages.csproj --configuration Release --nologo
          dotnet build ./quantower/Statistics/Statistics.csproj --configuration Release --nologo
          dotnet build ./quantower/Volatility/Volatility.csproj --configuration Release --nologo
          dotnet build ./SyntheticVendor/SyntheticVendor.csproj --configuration Release --nologo

      - name: Run Tests with Coverage
        run: |
          dotnet test --no-build --configuration Debug /p:CollectCoverage=true /p:CoverletOutputFormat=opencover
          dotnet-coverage collect "dotnet test" -f xml -o "coverage.xml"
          dotnet dotcover test Tests/Tests.csproj --dcReportType=HTML --dcoutput=./dotcover.html
          dotnet dotcover test Tests/Tests.csproj --dcReportType=DetailedXML --dcoutput=./dotcover.xml --verbosity=Detailed
          dotnet test -p:CollectCoverage=true --collect:"XPlat Code Coverage" --results-directory "./"

      - name: Generate Coverage Report
        run: |
          reportgenerator -reports:*cover*.xml -targetdir:.

      - name: Upload Coverage to Codacy
        uses: codacy/codacy-coverage-reporter-action@v1
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          coverage-reports: '*cover*.xml'

      - name: Upload Coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          files: 'cover*'
          verbose: true

  CodeQL:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: 'csharp'

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Debug

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  SecurityCodeScan:
    runs-on: windows-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup NuGet
        uses: nuget/setup-nuget@v1

      - name: Setup MSBuild
        uses: microsoft/setup-msbuild@v1

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '3.1.x'

      - name: Set up projects for analysis
        uses: security-code-scan/security-code-scan-add-action@v1

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Debug

      - name: Convert SARIF for uploading to GitHub
        uses: security-code-scan/security-code-scan-results-action@v1

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3

  Codacy_Scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Codacy Analysis CLI
        uses: codacy/codacy-analysis-cli-action@v4
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          verbose: true
          output: results.sarif
          format: sarif
          gh-code-scanning-compat: true
          max-allowed-issues: 2147483647

      - name: Upload SARIF results file
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

  build_publish:
    needs: [SonarCloud, Code_Coverage, CodeQL, SecurityCodeScan, Codacy_Scan]
    if: success()
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.x'

      - name: Install GitVersion
        uses: gittools/actions/gitversion/setup@v0
        with:
          versionSpec: '6.x'
          includePrerelease: true

      - name: Determine Version
        id: gitversion
        uses: gittools/actions/gitversion/execute@v0
        with:
          useConfigFile: true
          updateAssemblyInfo: true

      - name: Build projects
        run: |
          dotnet build ./lib/quantalib.csproj --configuration Release --nologo \
            -p:PackageVersion=${{ steps.gitversion.outputs.MajorMinorPatch }}
          dotnet build ./quantower/Averages/Averages.csproj --configuration Release --nologo
          dotnet build ./quantower/Statistics/Statistics.csproj --configuration Release --nologo
          dotnet build ./quantower/Volatility/Volatility.csproj --configuration Release --nologo
          dotnet build ./SyntheticVendor/SyntheticVendor.csproj --configuration Release --nologo

############# Publish dev release

      - name: Update Development Release
        if: github.ref == 'refs/heads/dev'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MYGET_URL: https://www.myget.org/feed/quantalib/package/nuget/QuanTAlib
          PACKAGE_VERSION: ${{ steps.gitversion.outputs.NuGetVersion }}
        run: |
          tag_name="development"
          release_name="Development Build"
          gh release delete $tag_name --yes || true
          git push origin :refs/tags/$tag_name || true
          gh release create $tag_name \
            --title "$release_name" \
            --notes "Latest development build from commit ${{ github.sha }}

            MyGet Package: [$MYGET_URL/$PACKAGE_VERSION]($MYGET_URL/$PACKAGE_VERSION) \n" \
            --prerelease \
            --target ${{ github.sha }} \
            quantower/Averages/bin/Release/Averages.dll \
            quantower/Statistics/bin/Release/Statistics.dll \
            quantower/Volatility/bin/Release/Volatility.dll \
            SyntheticVendor/bin/Release/SyntheticVendor.dll

      - name: Push prerelease package to myget.org
        if: github.ref == 'refs/heads/dev'
        run: |
          dotnet nuget push 'lib/bin/Release/QuanTAlib.*.nupkg' \
          --source https://www.myget.org/F/quantalib/api/v3/index.json \
          --force-english-output \
          --api-key ${{ secrets.MYGET_DEPLOY_KEY_QUANTALIB }}

############## Publish main release

      - name: Publish release assets
        if: ${{ github.ref == 'refs/heads/main' }}
        uses: SourceSprint/upload-multiple-releases@1.0.7
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          prerelease: false
          overwrite: true
          release_name: ${{ steps.gitversion.outputs.MajorMinorPatch }}
          tag_name: latest
          release_config: |
            quantower/Averages/bin/Release/Averages.dll
            quantower/Statistics/bin/Release/Statistics.dll
            quantower/Volatility/bin/Release/Volatility.dll
            SyntheticVendor/bin/Release/SyntheticVendor.dll

      - name: Push release package to nuget.org
        if: ${{ github.ref == 'refs/heads/main' }}
        run: dotnet nuget push 'lib/bin/Release/QuanTAlib.*.nupkg' \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate \
            --api-key ${{ secrets.NUGET_DEPLOY_KEY_QUANTLIB }}