build: Fallout CI + nuget.org Trusted Publishing (Chrison.* IDs)

.fallout/.gitignore

@@ -0,0 +1 @@
+/temp

.fallout/build.schema.json

@@ -0,0 +1,130 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "definitions": {
+    "Host": {
+      "type": "string",
+      "enum": [
+        "AppVeyor",
+        "AzurePipelines",
+        "Bamboo",
+        "Bitbucket",
+        "Bitrise",
+        "GitHubActions",
+        "GitLab",
+        "Jenkins",
+        "Rider",
+        "SpaceAutomation",
+        "TeamCity",
+        "Terminal",
+        "TravisCI",
+        "VisualStudio",
+        "VSCode"
+      ]
+    },
+    "ExecutableTarget": {
+      "type": "string",
+      "enum": [
+        "Clean",
+        "Compile",
+        "Pack",
+        "Publish",
+        "Test"
+      ]
+    },
+    "Verbosity": {
+      "type": "string",
+      "description": "",
+      "enum": [
+        "Verbose",
+        "Normal",
+        "Minimal",
+        "Quiet"
+      ]
+    },
+    "FalloutBuild": {
+      "properties": {
+        "Continue": {
+          "type": "boolean",
+          "description": "Indicates to continue a previously failed build attempt"
+        },
+        "Help": {
+          "type": "boolean",
+          "description": "Shows the help text for this build assembly"
+        },
+        "Host": {
+          "description": "Host for execution. Default is 'automatic'",
+          "$ref": "#/definitions/Host"
+        },
+        "NoLogo": {
+          "type": "boolean",
+          "description": "Disables displaying the NUKE logo"
+        },
+        "Partition": {
+          "type": "string",
+          "description": "Partition to use on CI"
+        },
+        "Plan": {
+          "type": "boolean",
+          "description": "Shows the execution plan (HTML)"
+        },
+        "Profile": {
+          "type": "array",
+          "description": "Defines the profiles to load",
+          "items": {
+            "type": "string"
+          }
+        },
+        "Root": {
+          "type": "string",
+          "description": "Root directory during build execution"
+        },
+        "Skip": {
+          "type": "array",
+          "description": "List of targets to be skipped. Empty list skips all dependencies",
+          "items": {
+            "$ref": "#/definitions/ExecutableTarget"
+          }
+        },
+        "Target": {
+          "type": "array",
+          "description": "List of targets to be invoked. Default is '{default_target}'",
+          "items": {
+            "$ref": "#/definitions/ExecutableTarget"
+          }
+        },
+        "Verbosity": {
+          "description": "Logging verbosity during build execution. Default is 'Normal'",
+          "$ref": "#/definitions/Verbosity"
+        },
+        "BuildProjectFile": {
+          "type": [
+            "null",
+            "string"
+          ],
+          "description": "Path to the build project (.csproj) relative to the repository root. Defaults to 'build/_build.csproj' when unset. Read by the Fallout global tool's in-tool runner."
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "properties": {
+        "NuGetApiKey": {
+          "type": "string",
+          "description": "API key for the push. In CI this is the short-lived key from NuGet/login (Trusted Publishing), never a stored secret"
+        },
+        "NuGetSource": {
+          "type": "string",
+          "description": "nuget.org push source"
+        },
+        "VersionSuffix": {
+          "type": "string",
+          "description": "Prerelease suffix appended to VersionPrefix (e.g. 'preview.42'). Empty → stable"
+        }
+      }
+    },
+    {
+      "$ref": "#/definitions/FalloutBuild"
+    }
+  ]
+}

.fallout/parameters.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "build.schema.json"
+}

.github/workflows/ci.yml

@@ -6,9 +6,10 @@ on:
   pull_request:
     branches: [main]
 
+# Build + test only. Publishing (prerelease on main, stable on v* tag) lives in
+# publish.yml and uses nuget.org Trusted Publishing (OIDC) — no packages: write here.
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build:
@@ -20,22 +21,13 @@ jobs:
         with:
           dotnet-version: '10.0.x'
 
-      # Hand-written client (no codegen) — just build + test.
-      - name: Build
-        run: dotnet build -c Release
-
-      # Live DSM integration tests skip automatically without SYNOLOGY_* env.
-      - name: Test
-        run: dotnet test -c Release --no-build
-
-      # On every push to main, publish a PRERELEASE to GitHub Packages so other
-      # projects can reference the latest build (e.g. 0.1.0-preview.42). Stable
-      # versions are published from the publish.yml workflow on a v* tag.
-      - name: Publish prerelease
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        run: |
-          dotnet pack -c Release -o artifacts --version-suffix "preview.${{ github.run_number }}"
-          dotnet nuget push "artifacts/*.nupkg" \
-            --source "https://nuget.pkg.github.com/chrison-dev/index.json" \
-            --api-key "${{ secrets.GITHUB_TOKEN }}" \
-            --skip-duplicate --no-symbols
+      # Runs the Fallout build (Compile → Test). Hand-written client (no codegen);
+      # Test skips live DSM integration tests automatically without SYNOLOGY_* env.
+      #
+      # GITHUB_PACKAGES_PAT authenticates the Fallout-build package feed (nuget.config)
+      # so the build/ project can restore Fallout.*. PACKAGES_PAT is a PAT with
+      # read:packages on the Fallout-build org.
+      - name: Build & test (Fallout)
+        env:
+          GITHUB_PACKAGES_PAT: ${{ secrets.PACKAGES_PAT }}
+        run: ./build.sh Test

.github/workflows/publish.yml

@@ -1,37 +1,65 @@
 name: publish
 
-# Publishes both packages to GitHub Packages:
-#   SynoSharp.Api  (version = Synology client (no API-version tracking))
-#   SynoSharp      (independent SemVer, e.g. 0.1.0)
-# Versions come from the csprojs; a `v*` tag (the library release) just triggers it.
+# Publishes the two packages to nuget.org via Trusted Publishing (OIDC — no
+# stored API key):
+#   Chrison.SynoSharp      (independent SemVer, e.g. 0.1.0)
+#   Chrison.SynoSharp.Cli  (dotnet tool; co-versioned with the library)
+# Stable versions come from the csprojs' VersionPrefix; a `v*` tag just triggers a
+# stable publish. A push to main publishes a PRERELEASE (…-preview.N).
+#
+# Requires a nuget.org Trusted Publishing policy for this repo + this workflow file
+# (publish.yml) with Environment=Nuget.org, and the NUGET_USER secret (nuget.org
+# profile name). GITHUB_PACKAGES_PAT (from PACKAGES_PAT) only authenticates the
+# Fallout-build feed for the build/ project.
 on:
   push:
+    branches: [main]
     tags: ['v*']
   workflow_dispatch:
 
 permissions:
+  id-token: write   # enable GitHub OIDC token issuance (Trusted Publishing)
   contents: read
-  packages: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    # Must match the nuget.org Trusted Publishing policy's Environment field — the
+    # OIDC token only carries the environment claim when the job declares it here,
+    # and the policy rejects the exchange otherwise.
+    environment: Nuget.org
     steps:
       - uses: actions/checkout@v4
 
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: '10.0.x'
 
+      # Stable on a v* tag (version = csproj VersionPrefix); prerelease otherwise.
+      - name: Compute version suffix
+        id: ver
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            echo "suffix=" >> "$GITHUB_OUTPUT"
+          else
+            echo "suffix=preview.${{ github.run_number }}" >> "$GITHUB_OUTPUT"
+          fi
 
-      # Pack regenerates SynoSharp.Api from the schema, then packs the two
-      # packable projects (SchemaGen + Tests are IsPackable=false).
-      - name: Pack
-        run: dotnet pack -c Release -o artifacts
+      # Exchange the OIDC token for a short-lived (1h) nuget.org API key.
+      - name: NuGet login (OIDC → temporary API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
 
-      - name: Push to GitHub Packages
-        run: >
-          dotnet nuget push "artifacts/*.nupkg"
-          --source "https://nuget.pkg.github.com/chrison-dev/index.json"
-          --api-key "${{ secrets.GITHUB_TOKEN }}"
-          --skip-duplicate --no-symbols
+      # Fallout Pack + Publish. GITHUB_PACKAGES_PAT authenticates the Fallout-build
+      # feed (build/ project restore); the push uses the short-lived nuget.org key.
+      - name: Publish (Fallout → nuget.org)
+        env:
+          GITHUB_PACKAGES_PAT: ${{ secrets.PACKAGES_PAT }}
+        run: |
+          ARGS=(Publish --nuget-api-key "${{ steps.login.outputs.NUGET_API_KEY }}")
+          if [[ -n "${{ steps.ver.outputs.suffix }}" ]]; then
+            ARGS+=(--version-suffix "${{ steps.ver.outputs.suffix }}")
+          fi
+          ./build.sh "${ARGS[@]}"

README.md

@@ -24,8 +24,12 @@ this is a hand-written **read-API client** (now) + an **SSH-runner** for mutatio
 
 ## Build / use
 
+Built with [Fallout](https://github.com/Fallout-build/Fallout) (Chris's C#/.NET
+build system, a NUKE successor). Requires the .NET 10 SDK and `GITHUB_PACKAGES_PAT`
+(a PAT with `read:packages` on the Fallout-build org — restores `Fallout.*`, see `nuget.config`).
+
 ```bash
-dotnet build && dotnet test
+./build.sh              # default: Test (Compile + Test); ./build.sh Pack → Chrison.* nupkgs
 export SYNOLOGY_BASE_URL=https://nas:5001 SYNOLOGY_USER=… SYNOLOGY_PASSWORD=… SYNOLOGY_VERIFY_TLS=false
 synosharp discover     # JSON snapshot: model, serial, DSM version, shares, users
 synosharp ssh-check    # prove the SSH-runner: login + sudo-to-root + read-only `synoshare --enum`
@@ -38,8 +42,10 @@ direct root SSH, so the runner logs in as an admin user and `sudo -S` (password
 stdin, never in the command line), running tools through `env PATH=/usr/syno/sbin:…`
 since sudo's `secure_path` excludes the syno dirs.
 
-Packages publish to GitHub Packages (chrison-dev) like the siblings: prerelease
-on push to `main`, stable on `v*` tag.
+Packages publish to **nuget.org** (public) under the `Chrison.*` prefix
+(`Chrison.SynoSharp`, `Chrison.SynoSharp.Cli`) via **Trusted Publishing** (OIDC — no
+stored key), like the siblings: prerelease on push to `main`, stable on `v*` tag.
+Assembly name/namespace stay `SynoSharp`, so `using SynoSharp;` is unchanged.
 
 ## Status
 

build.ps1

@@ -0,0 +1,12 @@
+#!/usr/bin/env pwsh
+# SynoSharp build entrypoint (Fallout build). Requires the .NET 10 SDK on PATH
+# (see global.json) and, for restoring the Fallout.* build packages, GITHUB_PACKAGES_PAT
+# in the environment (a PAT with read:packages on the Fallout-build org; see nuget.config).
+#
+#   ./build.ps1                              # default target: Test
+#   ./build.ps1 Pack --version-suffix preview.42
+#   ./build.ps1 Publish --nuget-api-key <key>
+$ErrorActionPreference = 'Stop'
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+& dotnet run --project "$ScriptDir/build/_build.csproj" -- $args
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

build.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# SynoSharp build entrypoint (Fallout build). Requires the .NET 10 SDK on PATH
+# (see global.json) and, for restoring the Fallout.* build packages, GITHUB_PACKAGES_PAT
+# in the environment (a PAT with read:packages on the Fallout-build org; see nuget.config).
+#
+#   ./build.sh                              # default target: Test
+#   ./build.sh Pack --version-suffix preview.42
+#   ./build.sh Publish --nuget-api-key <key>
+set -eo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+exec dotnet run --project "$SCRIPT_DIR/build/_build.csproj" -- "$@"