elsa-core/.github/actions/push-nuget-packages/action.yml

name: Push NuGet packages
description: >
  Pushes every .nupkg in the working directory to a feed, a few at a time,
  retrying each package. Shared by the feedz.io and nuget.org publish jobs.  

inputs:
  feed-source:
    description: NuGet v3 index URL of the feed to push to.
    required: true
  api-key:
    description: API key for the feed.
    required: true
  push-timeout-seconds:
    description: Timeout for a single `dotnet nuget push`, in seconds.
    required: false
    default: "420"
  deadline-seconds:
    description: >
      How long the whole push step may take, in seconds. Keep this comfortably below the calling job's
      `timeout-minutes` so checkout, artifact download and the step's own failure report all fit inside it.      
    required: false
    default: "1200"

runs:
  using: composite
  steps:
    - name: Push packages
      shell: bash
      env:
        FEED_SOURCE: ${{ inputs.feed-source }}
        API_KEY: ${{ inputs.api-key }}
        PUSH_TIMEOUT: ${{ inputs.push-timeout-seconds }}
        PUSH_DEADLINE_SECONDS: ${{ inputs.deadline-seconds }}
      run: |
        set -euo pipefail

        mapfile -t packages < <(find . -maxdepth 1 -name '*.nupkg' | sort)

        # A single `dotnet nuget push *.nupkg` failed loudly when the glob
        # matched nothing; keep that, so a broken artifact upload can't pass
        # as a successful publish of zero packages.
        if [ ${#packages[@]} -eq 0 ]; then
          echo "::error::No .nupkg files found to push to ${FEED_SOURCE}."
          exit 1
        fi

        echo "Pushing ${#packages[@]} package(s) to ${FEED_SOURCE}"

        # `dotnet nuget push` applies its default 300s timeout per push, and the
        # package set has grown large enough that pushing it sequentially bumps
        # into that. Push a few at a time with a longer per-push timeout and
        # retry each one; --skip-duplicate keeps the retries idempotent.
        #
        # The callers' job timeout covers this whole step, and -P 4 means the
        # packages go through in waves rather than all at once, so a per-package
        # retry budget is not enough on its own: enough slow waves still run the
        # job out of time, and a cancelled runner leaves a release half published
        # with no record of which packages made it. So the retries are bounded by
        # a deadline for the step as a whole. No attempt is started that cannot
        # finish before it, and running out of time is reported as a failure
        # naming the packages, rather than as a mid-push cancellation.
        DEADLINE=$(( $(date +%s) + PUSH_DEADLINE_SECONDS ))
        MAX_ATTEMPTS=3
        MIN_ATTEMPT_SECONDS=60

        push_one() {
          local package="$1"
          local attempt remaining timeout
          for attempt in $(seq 1 "$MAX_ATTEMPTS"); do
            remaining=$(( DEADLINE - $(date +%s) ))

            if [ "$remaining" -lt "$MIN_ATTEMPT_SECONDS" ]; then
              echo "::error::Ran out of publishing time before ${package} was pushed (attempt ${attempt}/${MAX_ATTEMPTS})"
              return 1
            fi

            # Never let one push outlive the deadline it is being measured against.
            timeout=$PUSH_TIMEOUT
            if [ "$timeout" -gt "$remaining" ]; then
              timeout=$remaining
            fi

            if dotnet nuget push "$package" \
                -k "$API_KEY" \
                -s "$FEED_SOURCE" \
                --skip-duplicate \
                --timeout "$timeout"; then
              return 0
            fi

            if [ "$attempt" -eq "$MAX_ATTEMPTS" ]; then
              break
            fi

            echo "::warning::Pushing ${package} failed (attempt ${attempt}/${MAX_ATTEMPTS}); retrying in $((attempt * 15))s"
            sleep $((attempt * 15))
          done
          echo "::error::Failed to push ${package} after ${MAX_ATTEMPTS} attempts"
          return 1
        }
        # push_one runs in a child shell via xargs, so the budget has to travel
        # with it as environment variables rather than plain shell variables.
        export -f push_one
        export DEADLINE PUSH_TIMEOUT MAX_ATTEMPTS MIN_ATTEMPT_SECONDS

        # shellcheck disable=SC2016 # $0 is the package name in the child shell.
        printf '%s\0' "${packages[@]}" \
          | xargs -0 -n1 -P 4 bash -c 'push_one "$0"'