release: 0.10.1 (thorough-review maintenance tier + Abstractions 0.16.0) - #246
Merged
Conversation
…to Try-Pattern PR #248 canonical)
Bumps Meziantou.Analyzer from 3.0.119 to 3.0.123 Bumps Microsoft.Bcl.AsyncInterfaces from 10.0.9 to 10.0.10 Bumps Microsoft.Bcl.Memory from 10.0.9 to 10.0.10 Bumps Microsoft.SourceLink.GitHub from 10.0.300 to 10.0.301 Bumps SonarAnalyzer.CSharp from 10.28.0.143324 to 10.29.0.143774 --- updated-dependencies: - dependency-name: Meziantou.Analyzer dependency-version: 3.0.123 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Bcl.AsyncInterfaces dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.Bcl.Memory dependency-version: 10.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.301 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dotnet-dependencies - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.29.0.143774 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dotnet-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Adds sourcelink-stepinto.yaml + fixtures — a scheduled/manual workflow that drives netcoredbg to step into TestExtractor's constructor from a scratch consumer and asserts the debugger resolves the library's real SourceLink-mapped source, not a decompiled placeholder. Complements sourcelink.yaml (PR #208, the static `dotnet sourcelink test` gate); together they satisfy #133. Ported from ETL-Transformers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds aot-smoke.yaml + a tiny console consumer that references Wolfgang.Etl.TestKit, exercises the async-enumerable pipeline (TestExtractor -> TestTransformer -> TestLoader) end-to-end, publishes it with PublishAot on windows-latest, and runs the native binary. Fails the PR if the library ever stops being AOT/trim-safe. Consumer is isolated via empty Directory.Build.props/.targets stubs so the throwaway fixture does not inherit library analyzer/multi-TFM policy. Ported from D20-Dice, adapted for the async pipeline surface. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ependencies-ca9ebd494a Bump the dotnet-dependencies group with 5 updates
ci: add SourceLink verification workflow
ci: add SourceLink step-into (F11) verification (#133)
Addresses Copilot review on #203: - Install the same SDK list as the test stages (3.1.x-10.0.x) so the solution's older-TFM projects restore/build under InspectCode instead of failing or tripping out-of-support-TFM warnings-as-errors on a 10.0-only SDK. - Select the solution (.slnx/.sln) BEFORE restore/build and target it explicitly, so restore, build, and InspectCode all use the same solution and the no-solution case fails with the intended message. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fleet SHA-pin migration across every workflow: - Convert tag-pinned actions (checkout@v7, setup-dotnet@v6, upload-artifact@v7, download-artifact@v8.0.1, codeql-action init/analyze@v4) to full-commit-SHA pins with # vX comments. - Correct the D20-ported files' stale/behind SHAs: checkout v7.0.0 -> current v7 (3d3c42e5), and bump setup-dotnet v5 -> v6 to match the rest of the repo. - Add .zizmor.yml with an unpinned-uses hash-pin policy so any future tag-pin is flagged (must be passed via --config; wired into actions-audit.yaml). Resolves the zizmor 'mismatched/missing version comment' findings on the CI PRs at the source. Third-party actions (peaceiris, benchmark-action, softprops) were already SHA-pinned. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chore(deps): bump Wolfgang.Etl.Abstractions to 0.16.0
) Aligns with the fleet SHA-pin migration (#219): checkout v7.0.0 -> v7, setup-dotnet v5 -> v6, upload-artifact v4 -> v7, upload-sarif v3/v4 -> v4. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(pr): add ReSharper InspectCode job (canonical)
The Directory.Build.props stub blocks the repo's MSBuild analyzer policy, but .editorconfig is discovered by directory walk-up independently, so the root .editorconfig's CA2007 severity still applied to the throwaway consumer and surfaced as PR check-annotation warnings on the async awaits. Add a root=true .editorconfig so the fixture is fully exempt from repo lint. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
actionlint gates workflow YAML + embedded shell (via shellcheck); zizmor audits for injection / over-broad permissions / unpinned actions and uploads SARIF to Code Scanning (report-only, promote to gate once baseline clean). Runs on every PR. Ported from D20-Dice. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds license-audit.yaml + .github/license-audit/ config. Runs nuget-license over both packable projects (TestKit + TestKit.Xunit) on PR + push + schedule, gating on an OSI-permissive allow-list and uploading a JSON inventory. xunit.abstractions 2.0.3 exposes a license URL rather than an SPDX expression; mapped to its actual license (Apache-2.0) in url-license-mappings.json. Both projects audit clean locally. Ported from D20-Dice; matrix'd for two projects. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds scorecard.yaml (weekly + push-to-main + branch-protection-rule) that scores the repo against supply-chain best practices and uploads SARIF to Code Scanning. Adds the Scorecard badge to README. Ported from D20-Dice. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
) Aligns with the fleet SHA-pin migration (#219): checkout v7.0.0 -> v7, setup-dotnet v5 -> v6, upload-artifact v4 -> v7, upload-sarif v3/v4 -> v4. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds semgrep.yaml running the free public registry packs (p/csharp, p/security-audit, p/secrets) on PR + push. A different engine/ruleset from CodeQL; uploads SARIF to Code Scanning, report-only for now. Ported from D20-Dice. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Aligns with the fleet SHA-pin migration (#219): checkout v7.0.0 -> v7, setup-dotnet v5 -> v6, upload-artifact v4 -> v7, upload-sarif v3/v4 -> v4. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds reproducible-build.yaml — checks the commit out to two directories, builds both TestKit assemblies with ContinuousIntegrationBuild=true, and fails if the .dll hashes differ (path-independent reproducibility). Adds REPRODUCIBLE-BUILD.md documenting the guarantee + third-party verification steps. Ported from D20-Dice, extended to both packable projects. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Generates a CycloneDX SBOM of each shipped project's dependency graph on PR + push, uploaded as an artifact (per-PR complement to release.yaml's release-time SBOMs). Matrix'd over both packable projects. Actions SHA-pinned to current major tags (#143). Verified locally (26 packages). Ported from D20-Dice. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci: add Native-AOT publish+run smoke test (#132)
test: add Coyote systematic concurrency tests (#126)
Replaces secrets.NUGET_API_KEY with NuGet Trusted Publishing: the publish-nuget job now adds id-token: write, exchanges the GitHub OIDC token for an ephemeral push key via NuGet/login@v1 (SHA-pinned), and publishes with that step-output key. No long-lived API key on GitHub or NuGet. REQUIRES (manual, before the next release runs): a Trusted Publishing policy on nuget.org for BOTH Wolfgang.Etl.TestKit and Wolfgang.Etl.TestKit.Xunit (owner Chris-Wolfgang, repo ETL-Test-Kit, workflow release.yaml). Unblocks the #140 SECURITY.md OIDC release-path appendix. Canonical shape from Etl-DbClient. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci(release): migrate NuGet publish to Trusted Publishing / OIDC (#207)
Appends the canonical SECURITY.md appendix now that the release path is OIDC / NuGet Trusted Publishing (#207/#239). Records the load-bearing per-repo facts a maintainer needs during an incident: OIDC release path (no long-lived key), no fallback, owner, known Wolfgang.* downstream consumers, and both packages' nuget.org coordinates for unlisting. Generic incident-response steps are intentionally not duplicated. Shape matches Etl-DbClient #240. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bumps both packages 0.10.0 -> 0.10.1 (PATCH) and adds the CHANGELOG entry. This is the thorough-review maintenance/hardening tier + the Abstractions 0.16.0 bump; no public API or behaviour change to the shipped code. PackageValidation baseline stays at 0.10.0 (last published) — bump it after 0.10.1 is live on NuGet. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
docs(security): add Release path & compromise scope appendix (#140)
docs: add Architecture Decision Records (#139)
The committed blob had CRLF line endings while .gitattributes declares
'* text=auto eol=lf', so every checkout left docfx_project/docfx.json dirty.
On CI this aborted github-action-benchmark's 'git switch gh-pages' ('local
changes would be overwritten'), failing the perf-regression check on #244.
git add --renormalize rewrites the blob to LF so checkouts are clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
release: prep 0.10.1
Chris-Wolfgang
added a commit
that referenced
this pull request
Jul 26, 2026
main is ahead of vNext on Directory.Build.props (Meziantou 3.0.123→ 3.0.125, SonarAnalyzer 10.29→10.30 via dependabot group bump #243). The bundle carried vNext's older copy, which would have downgraded those analyzers on main. Restore Directory.Build.props to main's version so the bundle introduces zero reversions; vNext's copy is reconciled by the main→vNext merge that clears #246's guard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
main advanced to Wolfgang.Etl.Abstractions 0.17.0 + two analyzer bumps (Meziantou 3.0.125, SonarAnalyzer 10.30.0.144632) via dependabot group bump #243, merged after vNext branched. Bump vNext to match so the vNext→main release merge (#246) neither downgrades main nor ships 0.10.1 against a stale 0.16.0. Still a PATCH: no public API/behaviour change, PackageValidation baseline stays 0.10.0. CHANGELOG updated accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…njection
zizmor / code-scanning flagged the InspectCode job's restore, build, and
inspect steps for expanding ${{ steps.select-solution.outputs.sln }}
directly inside run: shell blocks (template-injection). Bind the step
output to an env var and reference $SLN in the script so the value is
never spliced into the command line. No behaviour change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Chris-Wolfgang
added a commit
that referenced
this pull request
Jul 26, 2026
Keeps the bundle's pr.yaml identical to vNext's so it stays out of #246's protected diff after this merges. See vNext commit for rationale. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 29, 2026
This was referenced Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 0.10.1 — the deferred "thorough-review" maintenance/hardening tier plus the
Wolfgang.Etl.Abstractions0.16.0 bump.PATCH: no public API or behaviour change to either shipped package — the test doubles and contract-test base classes are unchanged. Only the Abstractions dependency floor (0.15.0 → 0.16.0) is consumer-visible. PackageValidation confirms no ABI break vs 0.10.0.
What's in it
docfx.jsonrenormalized to LF (.gitattributes eol=lf).Closes (auto-close on merge to main)
Closes #115
Closes #116
Closes #117
Closes #124
Closes #125
Closes #126
Closes #127
Closes #128
Closes #130
Closes #132
Closes #133
Closes #134
Closes #135
Closes #136
Closes #137
Closes #138
Closes #139
Closes #140
Closes #142
Closes #143
Closes #144
Closes #145
Closes #207
Deliberately left open (N/A)
🤖 Generated with Claude Code