Use GitHub Packages NuGet Registry

.github/workflows/czicompress_cmake.yml

@@ -124,3 +124,81 @@ jobs:
         with:
           name: czicompress-${{env.name}}
           path: czicompress/czicompress-${{env.name}}/
+
+  package:
+    needs: build-tests
+    runs-on: windows-latest
+    permissions:
+      packages: write
+
+    steps:
+
+      - name: Checkout the source codes.
+        uses: actions/checkout@v4
+
+        # Download all artifacts from previous job
+        # No wildcard possible as of v3
+        # https://github.com/actions/download-artifact/issues/6
+        # Downloading to ${{github.workspace}} as of https://github.com/actions/download-artifact
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+
+      - name: Copy Natives
+        run: |
+            mkdir -p ./czicompress/pack/runtimes/win-x64/native
+            mkdir -p ./czicompress/pack/runtimes/linux-x64/native
+            cp ./czicompress-windows-64-msvc-package-on-Release/libczicompressc.dll ./czicompress/pack/runtimes/win-x64/native
+            cp ./czicompress-windows-64-msvc-package-on-Release/THIRD_PARTY_LICENSES*.txt ./czicompress/pack
+            cp ./czicompress-ubuntu-package-off-Release/libczicompressc.so ./czicompress/pack/runtimes/linux-x64/native
+
+        # https://github.com/marketplace/actions/setup-nuget-exe-for-use-with-actions#usage
+        # Use NuGet 6.x to enable package source mapping
+        # https://devblogs.microsoft.com/nuget/introducing-package-source-mapping/
+        # https://learn.microsoft.com/en-us/nuget/concepts/security-best-practices
+        # https://devblogs.microsoft.com/nuget/quickly-map-your-nuget-packages-to-sources/
+      - uses: nuget/setup-nuget@v1
+        with:
+          nuget-version: '6.x'
+
+      - name: Get libczicompressc Version
+        # See https://github.com/orgs/community/discussions/25713
+        # Note: FileVersionRaw.Revision is ignored as per https://learn.microsoft.com/en-us/nuget/concepts/package-versioning#version-basics
+        shell: pwsh
+        working-directory: ${{github.workspace}}/czicompress/pack
+        run: |
+            $NewFileVersion = (Get-Item "./runtimes/win-x64/native/libczicompressc.dll").VersionInfo.FileVersionRaw
+            $NewLibVersion = $NewFileVersion.Major, $NewFileVersion.Minor, $NewFileVersion.Build | Join-String -Separator '.'
+            "LibVersion=$NewLibVersion" >> $env:GITHUB_ENV
+
+      - name: Create NuGet Package
+        # See https://learn.microsoft.com/en-us/nuget/reference/nuspec#replacement-tokens
+        # No link between commit/run and package in UI as of 2023-11-16
+        # However: Adding as part of nuspec (https://learn.microsoft.com/en-us/nuget/reference/nuspec#repository)
+        # fuget.org will show this after transitioned to nuget.org
+        # See https://github.com/NuGet/NuGetGallery/issues/7537
+        working-directory: ${{github.workspace}}/czicompress/pack
+        run: |
+            nuget pack libczicompressc.nuspec -properties token_version=${{env.LibVersion}};token_commit=${{github.sha}}
+
+      # Upload to artifacts for pre-testing without publishing to GH Packages
+      - name: Upload NuGet Package to Artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: czicompress-nuget
+          path: ${{github.workspace}}/czicompress/pack/libczicompressc.${{env.LibVersion}}.nupkg
+
+      - uses: actions/setup-dotnet@v3
+        # Only upload to GH Packages on CD on main
+        if: ${{ (github.event_name == 'push') && (github.ref == 'refs/heads/main') }}
+        # No requirements on version (only pushing)
+        # https://github.com/actions/setup-dotnet#github-package-registry-gpr
+        with:
+          source-url: https://nuget.pkg.github.com/ZEISS/index.json
+        env:
+          NUGET_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Publish NuGet Package
+        if: ${{ (github.event_name == 'push') && (github.ref == 'refs/heads/main') }}
+        working-directory: ${{github.workspace}}/czicompress/pack
+        run: |
+            dotnet nuget push libczicompressc.${{env.LibVersion}}.nupkg --skip-duplicate

.github/workflows/czishrink_dotnet.yml

@@ -4,6 +4,7 @@
 permissions:
   pull-requests: write
   contents: read
+  packages: read
 
 name: .NET Build (CziShrink)
 
@@ -68,6 +69,17 @@ jobs:
           $xml.Save($file.FullName)
         shell: pwsh
 
+      # To support package source mapping with mixed package feeds (see NuGet.config for details)
+      # See https://github.com/dotnet/sdk/issues/31461
+      # See https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-nuget-update-source
+      - name: Update GitHub package registry credentials in NuGet.config
+        run: dotnet nuget update source github_zeiss -p "$GH_TOKEN" -u ZEISS -s https://nuget.pkg.github.com/ZEISS/index.json --store-password-in-clear-text
+        # Run on bash explicitely to have cross-platform environment variable referencing
+        # See https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow
+        shell: bash
+        env:
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
       - name: Restore dependencies
         run: dotnet restore
 

.gitignore

@@ -432,6 +432,3 @@ FodyWeavers.xsd
 ##################################
 ### END VisualStudio.gitignore ###
 ##################################
-
-# Be able to commit local nupkg
-!czishrink/packages_local/*.nupkg

czicompress/CMakeLists.txt

@@ -11,7 +11,7 @@ cmake_policy(SET CMP0091 NEW) # enable new "MSVC runtime library selection" (htt
 project ("czicompress"
          VERSION 0.5.2)
 
-set(czicompress_VERSION_PATCH_FLAGS "")
+set(czicompress_VERSION_PATCH_FLAGS "-dev")
 set(czicompress_VERSION_TWEAK_FLAGS "")
 
 if(WIN32)

czishrink/libczicompressc/libczicompressc.nuspec → czicompress/pack/libczicompressc.nuspec

@@ -2,15 +2,13 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
   <metadata>
     <id>libczicompressc</id>
-    <version>0.5.2</version>
+    <version>$token_version$</version>
     <title>Native runtimes for CZI ZStd compression</title>
     <authors>Carl Zeiss Microscopy</authors>
-    <owners>Carl Zeiss Microscopy</owners>
     <description>Native runtimes for CZI ZStd compression</description>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
-    <projectUrl>https://github.com/zeissmicroscopy/czicompress/</projectUrl>
     <copyright>© Carl Zeiss Microscopy GmbH and others. All rights reserved.</copyright>
-    <repository type="git" url="https://github.com/ZEISS/czicompress" branch="main" commit="40a2ba8489544626c2481ca95177b3235b5c0de7" />
+    <repository type="git" url="https://github.com/ZEISS/czicompress" commit="$token_commit$"/>
   </metadata>
 </package>

czishrink/NuGet.config

@@ -1,6 +1,33 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Since we are using a mix of different package sources we need to safeguard against dependency confusion attacks (be it intentional or unintentional)-->
+<!-- Issue: There is no deterministic order of package sources to be fetched (fastest wins) -->
+<!-- See: https://github.com/NuGet/Home/issues/5611 -->
+<!-- Solution: https://devblogs.microsoft.com/nuget/introducing-package-source-mapping/ -->
+<!-- More Info: https://learn.microsoft.com/en-us/nuget/concepts/security-best-practices -->
+<!-- More Info: https://devblogs.microsoft.com/nuget/quickly-map-your-nuget-packages-to-sources/ -->
+<!-- Required Tooling: Visual Studio 2022 preview 4 and later | .NET SDK 6.0.100-rc.1 and later | nuget.exe 6.0.0-preview.4 and later -->
 <configuration>
-  <packageSources>
-    <add key="Local" value="packages_local" />
-  </packageSources>
+    <!-- `clear` ensures no additional sources are inherited from another config file. -->
+    <packageSources>
+        <clear />
+        <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+        <add key="github_zeiss" value="https://nuget.pkg.github.com/ZEISS/index.json" />
+    </packageSources>
+    <packageSourceCredentials>
+        <github_zeiss>
+             <add key="Username" value="%GITHUB_ZEISS_USERNAME%" /> 
+             <add key="ClearTextPassword" value="%GITHUB_ZEISS_PACKAGES_READ_PAT%" /> 
+        </github_zeiss>
+    </packageSourceCredentials>
+    <!-- Define mappings by adding package ID patterns beneath the target source. -->
+    <!-- Any package not matching other specified patterns will be restored from nuget.org without throwing an error. -->
+    <packageSourceMapping>
+        <!-- key value for <packageSource> should match key values from <packageSources> element -->
+        <packageSource key="nuget.org">
+            <package pattern="*" />
+        </packageSource>
+        <packageSource key="github_zeiss">
+            <package pattern="libczicompressc" />
+        </packageSource>
+    </packageSourceMapping>
 </configuration>

czishrink/README.md

@@ -126,26 +126,25 @@ There is no guarantee that any items on this list will be added, rather it is ju
 
 ## Contributing
 
+See [CONTRIBUTING.md](../CONTRIBUTING.md)
+
+### Build
+libczicompressc is pulled in as a [NuGet package dependency](https://github.com/ZEISS/czicompress/pkgs/nuget/libczicompressc). Until releasing to nuget.org, libczicompressc is [published to the GitHub NuGet package registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-nuget-registry) as part of [CMake Build (czicompress)](https://github.com/ZEISS/czicompress/actions/workflows/czicompress_cmake.yml).  
+To build locally, the following two environment variables need to be set in order to successfully authenticate against https://nuget.pkg.github.com/ZEISS/index.json:  
+- %GITHUB_ZEISS_USERNAME%: This is your GitHub handle associated to your GitHub user part of https://github.com/ZEISS.  
+- %GITHUB_ZEISS_PACKAGES_READ_PAT%: This is a PAT associated to your GitHub user part of https://github.com/ZEISS with read:packages permission scope.  
+
+For more information, see [NuGet.config](NuGet.config).
+
+Users not being able to authenticate against https://nuget.pkg.github.com/ZEISS/index.json can download the NuGet package as a published artifact from [CMake Build (czicompress)](https://github.com/ZEISS/czicompress/actions/workflows/czicompress_cmake.yml) and [add it locally](https://learn.microsoft.com/en-us/nuget/hosting-packages/local-feeds).
+
 ### Notes for Contributors
 * Test changes at least on Linux and Windows.
 * Note that the app will change appearance when the system theme is changed (Windows: Settings -> Personalization -> Colors -> Choose your colors: Light/Dark/Custom). Make sure that GUI changes look good both in the Light and in the Dark Theme. See https://docs.avaloniaui.net/docs/next/guides/styles-and-resources/how-to-use-theme-variants
 
-## How to upgrade libczicompressc automatically
-1. Create a 'classic' personal access token at https://github.com/settings/tokens, authorize it for the ZEISS organization via the "Configure SSO" button, and store it in a GITHUB_TOKEN environment variable.
-2. Open a Powershell terminal and run [./upgrade-libczicompressc.ps1](./upgrade-libczicompressc.ps1). Run `get-help ./upgrade-libczicompressc.ps1` for more info.
-
-## How to upgrade libczicompressc manually
-1. Build libczicompressc.so on linux-x64 and libczicompressc.dll on win-x64 in release mode, or (preferred) get them from the [github CI build](https://github.com/ZEISS/czicompress/actions/workflows/czicompress_cmake.yml).
-1. Put the binaries into [libczicompressc/runtimes/linux-x64/native](libczicompressc/runtimes/linux-x64/native) and [libczicompressc/runtimes/win-x64/native](libczicompressc/runtimes/win-x64/native)
-1. Update the nuspec file [libczicompressc/libczicompressc.nuspec](libczicompressc/libczicompressc.nuspec):
-    * `package/metadata/version` must be the 'ProductVersion' of libczicompressc.dll (explorer: Properties/Details)
-	* `package/metadata/repository[@commit]` must be the git commit from which the binaries were built
-1. [Install nuget if necessary](https://learn.microsoft.com/en-us/nuget/install-nuget-client-tools#cli-tools).
-1. Open a shell in [libczicompressc](libczicompressc), and run `path/to/nuget pack libczicompressc.nuspec`
-1. Move the resulting nupkg into [packages_local](packages_local) and delete the old package from there.
-1. Change the version of libczicompressc in [Directory.Packages.props](Directory.Packages.props)
+### How to upgrade czishrink to new libczicompressc
+1. Change the version of [libczicompressc](https://github.com/ZEISS/czicompress/pkgs/nuget/libczicompressc) in [Directory.Packages.props](Directory.Packages.props)
 1. If major or minor version has changed, change the expected version number in [PInvokeFileProcessor](netczicompress/Models/PInvokeFileProcessor.cs).
 1. Rebuild netczicompress.sln
 1. Run netczicompressTests
-1. Undo git changes to the libczicompressc.dll and libczicompressc.so files (no need to commit them, they are in the nupkg).
-1. Commit the remaining changes with message "Upgrade libczicompressc to new version: x.y.z"
+1. Commit the remaining changes with message "Upgrade czishrink to pull libczicompressc x.y.z"