From 0038d46c9a1f62baf744e2dc4a58820a135a9be6 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sat, 15 Aug 2026 03:36:48 -0400 Subject: [PATCH] fix(build): push.sh must pack ITSELF, not the caller's working directory dotnet pack with no project argument packs whatever solution sits in the caller's CWD, so invoking this script by absolute path from another repo's checkout packed and published 25 unrelated packages to the live Gitea feed under its name. Now it cds to its own repo root and names the solution and an absolute output path. --- ZB.MOM.WW.LocalDb/build/push.sh | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/ZB.MOM.WW.LocalDb/build/push.sh b/ZB.MOM.WW.LocalDb/build/push.sh index 17fde8a..dd1a3c7 100755 --- a/ZB.MOM.WW.LocalDb/build/push.sh +++ b/ZB.MOM.WW.LocalDb/build/push.sh @@ -16,9 +16,19 @@ set -euo pipefail : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}" : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}" -dotnet pack -c Release -o ./artifacts +# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack` +# with neither a project argument nor a fixed working directory packs whatever solution +# happens to sit in the CALLER's directory — and then pushes it to a live feed under this +# script's name. Invoked as `bash /path/to/ZB.MOM.WW.LocalDb/build/push.sh` from another +# repo's checkout, the relative form packed and published 25 unrelated packages (recovered +# with `dotnet nuget delete`, but only because the token happened to carry delete rights). +# A publish script must be unambiguous about WHAT it publishes no matter where it is run. +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "$REPO_ROOT" -dotnet nuget push "./artifacts/*.nupkg" \ +dotnet pack ZB.MOM.WW.LocalDb.slnx -c Release -o "$REPO_ROOT/artifacts" + +dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \ --source "$GITEA_NUGET_SOURCE" \ --api-key "$GITEA_NUGET_KEY" \ --skip-duplicate