release: prep 0.10.1

CHANGELOG.md

@@ -19,6 +19,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [0.10.1] - 2026-07-24
+
+Maintenance release: the deferred "thorough-review" hardening tier plus the
+`Wolfgang.Etl.Abstractions` 0.16.0 bump. **No public API or behaviour change** to
+either shipped package — the test doubles and contract-test base classes are
+unchanged.
+
+### Changed
+
+- Built against `Wolfgang.Etl.Abstractions` 0.16.0 (was 0.15.0).
+
+### Security
+
+- Release now publishes via **OIDC / NuGet Trusted Publishing** (`NuGet/login`), removing
+  the long-lived `NUGET_API_KEY` from the release path.
+- Added supply-chain / security CI: transitive-dependency **license audit**, **CycloneDX SBOM**,
+  **OSSF Scorecard**, **Semgrep** SAST, GitHub **Actions audit** (actionlint + zizmor, all
+  actions SHA-pinned), and **build-reproducibility** verification with a per-release
+  reproducible-build manifest attached to each GitHub Release.
+- Documented the release path and compromise scope in `SECURITY.md`, and added a
+  consumer-side reproducible-build verification guide (`docs/REPRODUCIBLE-BUILD.md`).
+
 ## [0.10.0] - 2026-06-29
 
 Adds an opt-in contract-test base for the `ISupportDryRun` interface introduced in

docfx_project/docfx.json

@@ -1,65 +1,65 @@
-{
-  "$schema": "https://raw.githubusercontent.com/dotnet/docfx/main/schemas/docfx.schema.json",
-  "metadata": [
-    {
-      "src": [
-        {
-          "files": [
-            "src/**/*.csproj"
-          ],
-          "src": "../"
-        }
-      ],
-      "dest": "api",
-      "properties": {
-        "TargetFramework": "net8.0"
-      },
-      "disableGitFeatures": false,
-      "disableDefaultFilter": false
-    }
-  ],
-  "build": {
-    "content": [
-      {
-        "files": [
-          "**/*.{md,yml}"
-        ],
-        "exclude": [
-          "_site/**"
-        ]
-      }
-    ],
-    "resource": [
-      {
-        "files": [
-          "logo.svg",
-          "apple-touch-icon.png",
-          "favicon.svg",
-          "favicon.ico",
-          "images/**",
-          "public/**",
-          "versions.json"
-        ]
-      }
-    ],
-    "output": "_site",
-    "template": [
-      "default",
-      "modern"
-    ],
-    "globalMetadata": {
-      "_appName": "Wolfgang.Etl.TestKit",
-      "_appTitle": "Wolfgang.Etl.TestKit Documentation",
-      "_appLogoPath": "logo.svg",
-      "_appFaviconPath": "favicon.svg",
-      "_enableSearch": true,
-      "_appFooter": "Made with DocFX <script>(function(){var r='/';if(window.location.hostname.endsWith('.github.io')){var s=window.location.pathname.split('/').filter(Boolean);if(s.length)r='/'+s[0]+'/';}var t=document.createElement('script');t.src=r+'public/version-picker.js';t.async=true;document.head.appendChild(t);})();</script>",
-      "_disableSidebar": false,
-      "_disableTocFilter": false,
-      "_enableDarkMode": true,
-      "colorMode": "dark",
-      "_baseUrl": "https://Chris-Wolfgang.github.io/ETL-Test-Kit/",
-      "pdf": true
-    }
-  }
-}
+{
+  "$schema": "https://raw.githubusercontent.com/dotnet/docfx/main/schemas/docfx.schema.json",
+  "metadata": [
+    {
+      "src": [
+        {
+          "files": [
+            "src/**/*.csproj"
+          ],
+          "src": "../"
+        }
+      ],
+      "dest": "api",
+      "properties": {
+        "TargetFramework": "net8.0"
+      },
+      "disableGitFeatures": false,
+      "disableDefaultFilter": false
+    }
+  ],
+  "build": {
+    "content": [
+      {
+        "files": [
+          "**/*.{md,yml}"
+        ],
+        "exclude": [
+          "_site/**"
+        ]
+      }
+    ],
+    "resource": [
+      {
+        "files": [
+          "logo.svg",
+          "apple-touch-icon.png",
+          "favicon.svg",
+          "favicon.ico",
+          "images/**",
+          "public/**",
+          "versions.json"
+        ]
+      }
+    ],
+    "output": "_site",
+    "template": [
+      "default",
+      "modern"
+    ],
+    "globalMetadata": {
+      "_appName": "Wolfgang.Etl.TestKit",
+      "_appTitle": "Wolfgang.Etl.TestKit Documentation",
+      "_appLogoPath": "logo.svg",
+      "_appFaviconPath": "favicon.svg",
+      "_enableSearch": true,
+      "_appFooter": "Made with DocFX <script>(function(){var r='/';if(window.location.hostname.endsWith('.github.io')){var s=window.location.pathname.split('/').filter(Boolean);if(s.length)r='/'+s[0]+'/';}var t=document.createElement('script');t.src=r+'public/version-picker.js';t.async=true;document.head.appendChild(t);})();</script>",
+      "_disableSidebar": false,
+      "_disableTocFilter": false,
+      "_enableDarkMode": true,
+      "colorMode": "dark",
+      "_baseUrl": "https://Chris-Wolfgang.github.io/ETL-Test-Kit/",
+      "pdf": true
+    }
+  }
+}

src/Wolfgang.Etl.TestKit.Xunit/Wolfgang.Etl.TestKit.Xunit.csproj

@@ -4,7 +4,7 @@
     <TargetFrameworks>net462;net481;netstandard2.0;net8.0;net10.0</TargetFrameworks>
     <LangVersion>latest</LangVersion>
     <ImplicitUsings>disable</ImplicitUsings>
-    <Version>0.10.0</Version>
+    <Version>0.10.1</Version>
     <!-- Pin AssemblyVersion to a fixed binding-stability baseline so consumers
          do not need to recompile / add binding redirects on every minor/patch
          bump. Bump only on a deliberate breaking API change. FileVersion +

src/Wolfgang.Etl.TestKit/Wolfgang.Etl.TestKit.csproj

@@ -4,7 +4,7 @@
     <TargetFrameworks>net462;net481;netstandard2.0;net8.0;net10.0</TargetFrameworks>
     <LangVersion>latest</LangVersion>
     <ImplicitUsings>disable</ImplicitUsings>
-    <Version>0.10.0</Version>
+    <Version>0.10.1</Version>
     <!-- Pin AssemblyVersion to a fixed binding-stability baseline so consumers
          do not need to recompile / add binding redirects on every minor/patch
          bump. Bump only on a deliberate breaking API change. FileVersion +