up

ops/devops/sync-preview-nuget.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Sync preview NuGet packages into the local offline feed.
+# Reads package metadata from ops/devops/nuget-preview-packages.csv
+# and ensures ./local-nuget holds the expected artefacts (with SHA-256 verification).
+
+set -euo pipefail
+
+repo_root="$(git -C "${BASH_SOURCE%/*}/.." rev-parse --show-toplevel 2>/dev/null || pwd)"
+manifest="${repo_root}/ops/devops/nuget-preview-packages.csv"
+dest="${repo_root}/local-nuget"
+
+if [[ ! -f "$manifest" ]]; then
+  echo "Manifest not found: $manifest" >&2
+  exit 1
+fi
+
+mkdir -p "$dest"
+
+fetch_package() {
+  local package="$1"
+  local version="$2"
+  local expected_sha="$3"
+  local target="$dest/${package}.${version}.nupkg"
+  local url="https://www.nuget.org/api/v2/package/${package}/${version}"
+
+  echo "[sync-nuget] Fetching ${package} ${version}"
+  local tmp
+  tmp="$(mktemp)"
+  trap 'rm -f "$tmp"' RETURN
+  curl -fsSL --retry 3 --retry-delay 1 "$url" -o "$tmp"
+  local actual_sha
+  actual_sha="$(sha256sum "$tmp" | awk '{print $1}')"
+  if [[ "$actual_sha" != "$expected_sha" ]]; then
+    echo "Checksum mismatch for ${package} ${version}" >&2
+    echo "  expected: $expected_sha" >&2
+    echo "  actual:   $actual_sha" >&2
+    exit 1
+  fi
+  mv "$tmp" "$target"
+  trap - RETURN
+}
+
+while IFS=',' read -r package version sha; do
+  [[ -z "$package" || "$package" == \#* ]] && continue
+
+  local_path="$dest/${package}.${version}.nupkg"
+  if [[ -f "$local_path" ]]; then
+    current_sha="$(sha256sum "$local_path" | awk '{print $1}')"
+    if [[ "$current_sha" == "$sha" ]]; then
+      echo "[sync-nuget] OK ${package} ${version}"
+      continue
+    fi
+    echo "[sync-nuget] SHA mismatch for ${package} ${version}, refreshing"
+  else
+    echo "[sync-nuget] Missing ${package} ${version}"
+  fi
+
+  fetch_package "$package" "$version" "$sha"
+done < "$manifest"