[Feature] Nuget source "github"

[MoazAlkharfan]

With the new github package registry i think this would be a good feature to have.

[brandedoutcast]

Yeah I tried it before but the dotnet cli didn't support GPR. I need to see if something changed with the GPR support

If you're aware of this & think that it's resolved then please feel free to create a PR

[alexrosenfeld10]

Any plans to make the source not just nuget or github, but parameterizable? I'm looking to use this to publish to a private nuget repository, like my own artifactory.

[AraHaan]

me I would like a config varaible like so:

NUGET_SOURCE: <url source>
NUGET_SYMBOL_SOURCE: <url symbol source>

NUGET_SYMBOL_SOURCE would then be used for symbol packages (symbols.nupkg / *.snupkg).

[brandedoutcast]

@alexrosenfeld10 @AraHaan yup I'll push an update sometime soon

[brandedoutcast]

@MoazAlkharfan I believe the issue with GPR while pushing a package is resolved recently but I'm not sure on the support of GPR yet as this action uses https://api.nuget.org/v3-flatcontainer/ for version change detection & I'm yet to find a way to do that with GPR (any suggestions on this are welcome)

I'll anyways update the action to parameterize the NuGet feed url & it should work with feeds that are either similar to or built with NuGet

[brandedoutcast]

@alexrosenfeld10 @AraHaan v2.4.0 has custom NuGet feed support, it only works with feeds that have v3-flatcontainer/ endpoint due to the way this action does version change detection

[alexrosenfeld10]

@rohith thanks I actually ended up rolling my own, it does a bunch of other behavior I was also looking for.

[Rutgerz]

I was also hoping to use this action to publish to github packages and ended up having a look around the Nuget API spec . Turns out Github packages does support the required endpoint, but the URL is different. The v3-flatcontainer/ that is being queried is called the PackageBaseAddress. Having this endpoint is required for any nuget server, however the URL for it is specified in the Service Index. So what would have to changes is that first the NugetSource/index.json is queried and from that resource url with type PackageBaseAddress/3.0.0 is found. Than can then be queried as before.

Nuget.org

GET https://api.nuget.org/v3/index.json

returns

{
  "version": "3.0.0",
  "resources": [
    // removed for brevity...
    {
      "@id": "https://api.nuget.org/v3/registration5-semver1/",
      "@type": "RegistrationsBaseUrl",
      "comment": "Base URL of Azure storage where NuGet package registration info is stored"
    },
    {
      "@id": "https://api.nuget.org/v3-flatcontainer/",
      "@type": "PackageBaseAddress/3.0.0",
      "comment": "Base URL of where NuGet packages are stored, in the format https://api.nuget.org/v3-flatcontainer/{id-lower}/{version-lower}/{id-lower}.{version-lower}.nupkg"
    },
    // more removed for brevity
  ],
  "@context": {
    "@vocab": "http://schema.nuget.org/services#",
    "comment": "http://www.w3.org/2000/01/rdf-schema#comment"
  }
}

This tells us to use https://api.nuget.org/v3-flatcontainer/. Github will return similar response:

Github Packages

GET https://nuget.pkg.github.com/OWNER/index.json
Authorization: Bearer TOKEN

returns

{
      "version": "3.0.0-beta.1",
      "resources": [
        {
          "@id": "https://nuget.pkg.github.com/OWNER/download",
          "@type": "PackageBaseAddress/3.0.0",
          "comment": "Get package content (.nupkg)."
        },
        // removed
      ]
    }

So https://nuget.pkg.github.com/OWNER/download functions the same as the v3-flatcontainer on nuget.org.

Hopefully this makes sense. I felt like it would be a waste to not at least try to dump this information here after looking into it. I've never used node.js before myself, otherwise I would have attempted a quick PR (and maybe I still might)

[brandedoutcast]

@Rutgerz Thank you that's a great news & such a detailed comment. I'll wait for that PR & if not I'll update the action to support GPR

[brgrz]

It'd be awesome if this action could also publish to GitHub Packages. @jcansdale from GitHub is the GPR maintainer, maybe he can help?

[jcansdale]

Some notes when publishing to GitHub Packages:

1. The project's RepositoryUrl must point to a GitHub repository URL
2. The OWNER in https://nuget.pkg.github.com/OWNER/index.json can be anything
3. Basic authentication must be used with a PAT as the password (the username can be anything)

Yes, it's a little strange. 😉

[fasetto]

https://github.com/brandedoutcast/publish-nuget/blob/c12b8546b67672ee38ac87bea491ac94a587f7cc/index.js#L90-L115 I think there is no need to use flatcontainer endpoint. Push operating will fail anyways if the package with provided version already exists on the nuget.

[Rebel028]

So since there's no progress on this issue you can try using my fork of this action: https://github.com/marketplace/actions/publish-nuget-2

I made it work in my case (private team repo) so maybe it will help some of you.

It also has the feature described in #43

[Rutgerz]

Just as an update, I not longer have real need for this issue. I can now succesfully push (and restore from) github packages by using https://github.com/actions/setup-dotnet. Here an example of what I run now

steps:
    - uses: actions/checkout@v2
    - name: Setup .NET
      uses: actions/setup-dotnet@v1
      with:
        dotnet-version: 3.1.x
        source-url: https://nuget.pkg.github.com/<owner>/index.json
      env:
        NUGET_AUTH_TOKEN: ${{secrets.PACKAGES_TOKEN}}
    - name: Build
      run: dotnet build --configuration Release
    - name: Pack
      run: dotnet pack src/myproject.csproj --output nuget-packages --configuration Release
    - name: Push
      run: dotnet nuget push **/*.nupkg --skip-duplicate --source https://nuget.pkg.github.com/<owner>/index.json

This is using a Personal Access Token because the secrets.GITHUB_TOKEN doesn't have permission to read packages from other repositories. My build requires this, but you might not need it. The --skip-duplicate makes it not fail if a package already exists, so only new versions are published.