chore: rework build infra onto shared subfolder + PackTS layout

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto
+

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 5
+    labels:
+      - internal
+    commit-message:
+      prefix: chore
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: nuget
+    cooldown:
+      default-days: 7
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - internal
+    commit-message:
+      prefix: chore
+    groups:
+      nuget:
+        patterns:
+          - "*"

.github/workflows/build.yml

@@ -10,39 +10,34 @@ on:
 jobs:
     build:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
         steps:
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
-                    fetch-depth: 0 # Need to fetch all for proper history
-            -   name: Collect build info
-                id: info
-                run: |
-                    # Get short SHA
-                    SHA_SHORT=$(git rev-parse --short HEAD)
-                    echo "sha_short=$SHA_SHORT" >> $GITHUB_OUTPUT
-
-                    # Extract version from csproj
-                    VERSION=$(grep -oP '(?<=<Version>)[^<]+' BepisLocaleLoader.csproj)
-                    echo "version=$VERSION" >> $GITHUB_OUTPUT
-                    echo "Version found: $VERSION"
-            -   uses: actions/setup-dotnet@v4
+                    fetch-depth: 0
+                    persist-credentials: false
+            -   uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
                 with:
-                    dotnet-version: "9.0.x"
-            -   name: Build
+                    global-json-file: global.json
+            -   name: Build and create Thunderstore package
+                id: build
                 run: |
-                    dotnet build -c Release
+                    dotnet build -c Release -t:PackTS
                     dotnet pack -c Release --no-build -o ./bin/dist
-                    # Copy the built DLL to dist folder
-                    cp ./bin/Release/BepisLocaleLoader.dll ./bin/dist/
-            -   name: Create Thunderstore Package
+                    cp ./BepisLocaleLoader/bin/Release/BepisLocaleLoader.dll ./bin/dist/
+            -   name: Show version
+                id: info
+                env:
+                    VERSION: '${{ steps.build.outputs.version }}'
                 run: |
-                    dotnet tool restore
-                    dotnet tcli build --package-version ${{ steps.info.outputs.version }}
+                    echo "Version found: $VERSION"
+                    echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
             -   name: Upload artifacts
-                uses: actions/upload-artifact@v4
+                uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
                 with:
-                    name: BepisLocaleLoader-${{ steps.info.outputs.version }}-${{ steps.info.outputs.sha_short }}
+                    name: 'BepisLocaleLoader-${{ steps.build.outputs.version }}-${{ steps.info.outputs.sha_short }}'
                     path: |
                         ./bin/dist/*.nupkg
                         ./bin/dist/*.dll
-                        ./build/*.zip
+                        ./build/*.zip

.github/workflows/publish.yml

@@ -6,34 +6,17 @@ on:
 jobs:
     release:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
         steps:
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
-                    fetch-depth: 0 # Need to fetch all for proper history
-            -   name: Collect build info
-                id: info
-                run: |
-                    # Get short SHA
-                    SHA_SHORT=$(git rev-parse --short HEAD)
-                    echo "sha_short=$SHA_SHORT" >> $GITHUB_OUTPUT
-
-                    # Extract version from csproj
-                    VERSION=$(grep -oP '(?<=<Version>)[^<]+' BepisLocaleLoader.csproj)
-                    echo "version=$VERSION" >> $GITHUB_OUTPUT
-                    echo "Version found: $VERSION"
-            -   uses: actions/setup-dotnet@v4
+                    fetch-depth: 0
+                    persist-credentials: false
+            -   uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
                 with:
-                    dotnet-version: "9.0.x"
-            -   name: Build
-                run: |
-                    dotnet build -c Release
-            -   name: Create Thunderstore Package
-                run: |
-                    dotnet tool restore
-                    dotnet tcli build --package-version ${{ steps.info.outputs.version }}
-            -   name: Publish to Thunderstore
-                run: |
-                    ZIP_FILE=$(ls ./build/*.zip | head -1)
-                    dotnet tcli publish --file "$ZIP_FILE"
+                    global-json-file: global.json
+            -   name: Build and publish Thunderstore package
                 env:
-                    TCLI_AUTH_TOKEN: ${{ secrets.TCLI_AUTH_TOKEN }}
+                    TCLI_AUTH_TOKEN: ${{ secrets.TCLI_AUTH_TOKEN }}
+                run: dotnet build -c Release -t:PackTS -P:PublishTS=true

.github/workflows/release.yml

@@ -18,64 +18,45 @@ on:
 jobs:
     release:
         runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            id-token: write
+            attestations: write
         steps:
-            -   uses: actions/checkout@v3
+            -   uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
-                    fetch-depth: 0 # Need to fetch all for proper history
-            -   name: Collect build info
-                id: info
-                run: |
-                    # Get short SHA
-                    SHA_SHORT=$(git rev-parse --short HEAD)
-                    echo "sha_short=$SHA_SHORT" >> $GITHUB_OUTPUT
-
-                    # Extract version from csproj
-                    VERSION=$(grep -oP '(?<=<Version>)[^<]+' BepisLocaleLoader.csproj)
-                    echo "version=$VERSION" >> $GITHUB_OUTPUT
-                    echo "Version found: $VERSION"
-            -   uses: actions/setup-dotnet@v4
+                    fetch-depth: 0
+                    persist-credentials: false
+            -   uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
                 with:
-                    dotnet-version: "9.0.x"
-            -   name: Build
+                    global-json-file: global.json
+            -   name: Build and create Thunderstore package
+                id: build
                 run: |
-                    dotnet build -c Release
+                    dotnet build -c Release -t:PackTS
                     dotnet pack -c Release --no-build -o ./bin/dist
-                    # Copy the built DLL to dist folder for release
-                    cp ./bin/Release/BepisLocaleLoader.dll ./bin/dist/
-            -   name: Create Thunderstore Package
-                run: |
-                    dotnet tool restore
-                    dotnet tcli build --package-version ${{ steps.info.outputs.version }}
-            -   name: Create Git Tag (if needed)
-                if: ${{ github.event_name == 'workflow_dispatch' }}
-                run: |
-                    TAG_NAME="${{ steps.info.outputs.version }}"
-                    # Check if tag already exists
-                    if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
-                        echo "Tag $TAG_NAME already exists"
-                    else
-                        echo "Creating tag $TAG_NAME"
-                        git config user.name github-actions
-                        git config user.email github-actions@github.com
-                        git tag -a "$TAG_NAME" -m "Release $TAG_NAME"
-                        git push origin "$TAG_NAME"
-                    fi
-            -   name: Publish to Nuget
-                run: |
-                    dotnet nuget push ./bin/dist/*.nupkg --api-key ${{ secrets.NUGET_API_KEY }} --source https://nuget-modding.resonite.net/v3/index.json --skip-duplicate
-            -   name: Create GitHub Release
-                if: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || (github.event_name == 'workflow_dispatch' && github.event.inputs.create_release == 'true') }}
-                uses: softprops/action-gh-release@v2
+                    cp ./BepisLocaleLoader/bin/Release/BepisLocaleLoader.dll ./bin/dist/
+            -   name: Attest artifacts
+                uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
                 with:
-                    draft: true
-                    prerelease: false
-                    generate_release_notes: false
-                    name: ${{ steps.info.outputs.version }}
-                    tag_name: ${{ steps.info.outputs.version }}
-                    target_commitish: ${{ github.sha }}
-                    files: |
+                    subject-path: |
                         ./bin/dist/*.nupkg
                         ./bin/dist/*.dll
                         ./build/*.zip
+            -   name: Publish to Nuget
                 env:
-                    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                    NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+                run: |
+                    dotnet nuget push ./bin/dist/*.nupkg --api-key "$NUGET_API_KEY" --source https://nuget-modding.resonite.net/v3/index.json --skip-duplicate
+            -   name: Create GitHub Release
+                if: ${{ (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) || (github.event_name == 'workflow_dispatch' && github.event.inputs.create_release == 'true') }}
+                env:
+                    TAG_NAME: ${{ steps.build.outputs.version }}
+                    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                run: |
+                    gh release create "$TAG_NAME" \
+                        --draft \
+                        --title "$TAG_NAME" \
+                        ./bin/dist/*.nupkg \
+                        ./bin/dist/*.dll \
+                        ./build/*.zip