Skip to content

Release v1.1.1: canonical maintenance round + AssemblyVersion fix#129

Merged
Chris-Wolfgang merged 145 commits into
mainfrom
vNext
Jun 3, 2026
Merged

Release v1.1.1: canonical maintenance round + AssemblyVersion fix#129
Chris-Wolfgang merged 145 commits into
mainfrom
vNext

Conversation

@Chris-Wolfgang
Copy link
Copy Markdown
Owner

@Chris-Wolfgang Chris-Wolfgang commented Jun 1, 2026

Summary

Cuts v1.1.1. Supersedes the stacked canonical PRs (canonical-protected, canonical-unprotected, protected/d8-verify-docs-build-fleet, fix/restore-assemblyversion, chore/remove-post-setup-bootstrap-files) — all folded into this vNext → main merge.

Library public API and runtime behavior are unchanged from the previous release. This is canonical CI/docs/metadata work plus the C4 binding-stability fix.

Scope folded into v1.1.1

Added

  • D8 verify-docs-build job in release.yaml (deduplicated)
  • A1 PublicApiAnalyzers scaffolding (baseline file deferred to IDE-fix pass)
  • CI3 canonical NuGet metadata (Authors/Copyright/SourceLink/snupkg)
  • T3 Stryker mutation-testing workflow
  • T1 coverage report published to docs
  • S1 CodeQL security-extended query pack
  • D6 versions.json preservation guard
  • D7 docs build cache hygiene
  • P2 BenchmarkDotNet → gh-pages chart workflow (if benchmarks/ exists)
  • docs/DOCFX-VERSION-PICKER.md (the D8 bulk fanout dropped this file on some repos; added directly)

Changed

  • C1 fleet template-drift sync
  • <Nullable>enable</Nullable> consolidated into Directory.Build.props
  • CI2 Dependabot github-actions ecosystem
  • D3 script hardening
  • Analyzer PackageReferences centralized in Directory.Build.props
  • Removed post-setup bootstrap files (REPO-INSTRUCTIONS.md, scripts/setup.ps1, Setup-BranchRuleset.ps1, Setup-GitHubPages.ps1) — template carry-overs

Fixed

  • C4 restored explicit <AssemblyVersion>1.0.0.0</AssemblyVersion> + prerelease-safe <FileVersion> — binding stability for .NET Framework consumers
  • Duplicate verify-docs-build: job key in release.yaml
  • .gitattributes merge conflict resolved by keeping the canonical documented variant

Post-merge

  1. Tag v1.1.1 and publish GitHub Release → release.yaml fires
  2. Verify NuGet indexing
  3. Delete vNext + close any remaining superseded PRs

Closes (canonical work delivered, including stacked PRs)

Canonical vNext content (this PR)

Stacked-PR content (rolled in here so default-branch Closes semantics fire)

Chris-Wolfgang and others added 30 commits May 22, 2026 11:20
Template-drift resolution for IComparable-Extensions — the non-protected half.
16 template-tracked infrastructure files re-synced to canonical repo-template:
scripts, docs process files, .github issue/PR templates, .gitattributes,
CONTRIBUTING.md.

Excluded: docfx_project/* (repo-specific docs — docs initiatives), protected
config/workflow files (separate PR), .gitkeep / expected-noise files.

Part of #86.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Template-drift resolution for IComparable-Extensions — the protected half.
Files that trip the pr.yaml guard, isolated for admin-bypass merge:
.editorconfig, BannedSymbols.txt, .github/workflows/{build-all-versions,pr,codeql,docfx}.yaml.

Part of #86.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ions.IComparable)

The C1 drift re-sync brought the canonical CONTRIBUTING.md but left the
template's {{PROJECT_NAME}} placeholder literal. Replace it with this repo's
project name so the synced CONTRIBUTING.md is correct, not a raw template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fold-down of the repo-template fix (PR #389): Replace-Placeholders now
writes with -Encoding utf8NoBOM -NoNewline. Rolled to every repo so the
campaign stays consistent with the updated canonical.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Propagates the three files folded into repo-template during drift Phase 0:
tests/Directory.Build.props + benchmarks/Directory.Build.props
(TreatWarningsAsErrors=false) and tests/.editorconfig (test-project analyzer
relaxations). Excluded from the initial C1 sync; rolled out now so every repo
matches the canonical template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Removes the TreatWarningsAsErrors=false override on test projects. The
genuinely test-inappropriate analyzer rules are already silenced per-rule in
tests/.editorconfig; test code now inherits the root Directory.Build.props
(TreatWarningsAsErrors in Release, like src/examples). benchmarks remain
exempt for now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add <Nullable>enable</Nullable> to the root Directory.Build.props and
remove the now-redundant per-project <Nullable> lines from every
SDK-style csproj. Nullable reference types are configured in one place;
a newly added project inherits the setting automatically.

Both halves ride this protected branch so they merge atomically — the
Directory.Build.props addition and the csproj removals land together,
so there is never a window where nullable reference types are off.

Legacy non-SDK project files do not import Directory.Build.props and
are left untouched with their explicit settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Legacy non-SDK .csproj files explicitly import Microsoft.Common.props,
so they DO inherit Directory.Build.props — the earlier unconditional
<Nullable>enable</Nullable> reached projects it should not have:

  * F# (.fsproj) / VB (.vbproj) projects — now excluded by conditioning
    the property on '$(MSBuildProjectExtension)' == '.csproj'.
  * legacy non-SDK C# example projects (C# 7.3, no nullable support) —
    given an explicit <Nullable>disable</Nullable> opt-out, restoring
    their pre-hoist state. These are the documented C5 carve-outs.

SDK-style C# projects are unaffected — they still inherit enable from
the single Directory.Build.props.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds queries: security-extended to the CodeQL init step so the broader
security query pack runs on top of the default queries. Slightly longer
scans, materially more security coverage.

Initiative S1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New .github/workflows/stryker.yaml runs Stryker.NET against the repo's
test projects on workflow_dispatch and a weekly schedule. The workflow
is a no-op until a stryker-config.json is added at repo root or under
tests/<project>/ — this commit is the canonical infrastructure;
per-repo Stryker config is the follow-up.

Initiative T3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a verify-docs-build job to release.yaml that runs DocFX without
deploying (metadata + build + output check). publish-nuget now needs
[pack-and-validate, verify-docs-build] so a broken docs build blocks
the release before the NuGet package goes live.

If a repo has no docfx_project/docfx.json, the job no-ops with a
notice; this is the canonical infrastructure, with per-repo docs
coverage tracked separately.

Initiative D8.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Append a github-actions package-ecosystem to .github/dependabot.yml so
Dependabot opens weekly PRs to bump pinned action versions in the repo's
GitHub workflows. Grouped under a single PR per week. Existing nuget
ecosystems are left unchanged.

Initiative CI2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Keep-a-Changelog skeleton with an [Unreleased] section so release
notes can accumulate here between releases instead of being lost.
Follows the canonical format used across the fleet.

Initiative D3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a guard step to docfx.yaml that fetches the currently-deployed
versions.json from gh-pages and confirms the newly-generated one has
at least as many entries AND retains every previously-published version
label. Aborts the deploy if the version selector would shrink or lose
entries.

If no existing versions.json is found (first deploy), the step no-ops
with a notice.

Initiative D6.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add the Microsoft.CodeAnalysis.PublicApiAnalyzers package plus opt-in
AdditionalFiles globbing for PublicAPI.Shipped.txt / Unshipped.txt to
the root Directory.Build.props.

The AdditionalFiles use Exists() conditions, so the analyzer activates
per-project only when those files are present. Library projects opt in
by dropping the two text files into the src directory; test, example,
and benchmark projects stay dormant.

Per-repo enablement (populate Unshipped.txt with the current public API
surface) is tracked as a separate follow-up maintenance issue.

Initiative A1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add fleet-canonical defaults to root Directory.Build.props:

- Authors / Company / Copyright (uniform across the fleet; per-csproj
  values still win where set explicitly).
- RepositoryType=git, PublishRepositoryUrl=true.
- IncludeSymbols=true + SymbolPackageFormat=snupkg so .snupkg ships
  with every .nupkg.
- EmbedUntrackedSources=true to capture generated sources in PDBs.
- ContinuousIntegrationBuild=true under $(CI)=true (deterministic
  build flag, set by GitHub Actions).
- Microsoft.SourceLink.GitHub package so debuggers can step from
  NuGet-installed code straight to GitHub source.

Repo-specific NuGet fields (Description, PackageTags, PackageProjectUrl,
RepositoryUrl, PackageLicenseExpression, PackageReadmeFile) stay in
per-src csproj where they belong and are tracked as per-repo follow-up
maintenance issues.

Initiative CI3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add a docfx.yaml step that runs the test suite with Cobertura coverage
collection and generates a ReportGenerator HTML report into
docfx_project/_site/coverage/ before the deploy step. The published
docs site gains a /coverage/ subpath alongside the existing /api/.

continue-on-error keeps a coverage failure from blocking the docs
deploy; if no test projects are present the step no-ops.

Initiative T1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- BannedSymbols.txt: replace {{PROJECT_NAME}} placeholder with the repo's
  package name (skipped on repo-template where the placeholder is the
  intended template artifact).
- docfx.yaml: 'exit 1' inside the deploy try-block changed to 'throw' so
  the outer finally always unsets the global http.extraheader token; added
  $LASTEXITCODE checks after git fetch / git worktree add / git init /
  git remote add so a setup failure surfaces a clear error.

Fan-out of the round-2 Copilot fixes verified against DateTime-Extensions
(#178 / #179 pilot).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- scripts/Setup-BranchRuleset.ps1: jq filter wrapped in '[ .[] | select() ]'
  so the output is always valid JSON even with multiple matches; gh stderr
  redirected to a temp file so it can't poison stdout.
- scripts/Fix-BranchRuleset.ps1: same stderr-isolation fix on the rulesets
  fetch (no more '2>&1' merge).
- scripts/Validate-DocsDeploy.sh: distinguish 'versions.json never created'
  from 'versions.json failed validation' in step 4 so the skip message
  reflects reality.
- .github/dependabot.yml: drop the stale 'dotnet' label (no longer in the
  Setup-Labels.ps1 taxonomy).
- REPO-INSTRUCTIONS.md: replace the stale label list (dependabot-*, dotnet)
  with the current Maintenance-framework labels Setup-Labels.ps1 actually
  creates.

IAsyncEnumerable-Extensions also gets README.md / CONTRIBUTING.md updated
to point at docs/README-FORMATTING.md since the root copy was removed by
the earlier D7 cleanup.

Fan-out of the round-2 Copilot fixes verified against DateTime-Extensions
(#178 pilot).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- .github/workflows/stryker.yaml: replace literal-in-array config detection
  with explicit [ -f ] checks. nullglob only drops words that look like
  globs (contain *, ?, [); the bare literal 'stryker-config.json' was
  preserved unconditionally, so the workflow would mark found=true and
  attempt to install Stryker even on repos with no config.
- actions/checkout@v4 -> @v6 and setup-dotnet@v4 -> @v5 for consistency
  with the rest of the fleet's workflows.

Fan-out of the round-2 Copilot fixes verified against DateTime-Extensions
(#181 pilot).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
stryker.yaml lives under .github/workflows/*, which means it trips the
pr.yaml "Detect .NET Projects" guard the same way the rest of
canonical-protected does. Keeping T3 on its own branch would have meant
two admin-bypass merges per repo (canonical-protected -> main, then
t3-stryker -> main). Folding T3 in here collapses that to one bypass on
the way to release.

Merges origin/t3-stryker-mutation-testing into canonical-protected. The
existing per-repo T3 PR will be closed as superseded once this lands.
These scripts were run once when this repo was bootstrapped from
repo-template and are not needed afterward:

- scripts/setup.ps1                              (orchestrator for the others)
- scripts/Setup-Maintenance.ps1                  (created the Maintenance issues)
- scripts/Setup-BranchRuleset.ps1                (created the main branch ruleset)
- scripts/Setup-GitHubPages.ps1                  (bootstrapped gh-pages branch)
- scripts/templates/maintenance-parent-body.md   (template used by Setup-Maintenance)

repo-template keeps these files — they remain available there so any new
repo created from the template can still run them at bootstrap.

Recurring utilities are intentionally kept: Setup-Labels.ps1 (idempotent),
Fix-BranchRuleset.ps1, format.ps1, Validate-DocsDeploy.sh, build-pr.ps1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add '$(UsingMicrosoftNETSdk)' == 'true' to the existing .csproj-only
condition so the property only applies to SDK-style projects. Legacy
non-SDK csproj files no longer pick up <Nullable>enable</Nullable> by
inheritance; they would have to opt in explicitly.

Verified safe by piloting on IComparable-Extensions — full Release
build + 540-test run (54 tests x 10 TFMs) passed cleanly with the
tightened condition. Resolves the PR-#390 review thread that asked for
this addition.

The per-repo explicit <Nullable>disable</Nullable> opt-outs already in
place on Try-Pattern (examples/CSharp.DotNet462.Example) and D20-Dice
(examples/Net4.8/Example1-Console) become redundant but harmless under
this condition — they can be cleaned up later, or left as belt-and-
suspenders documentation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Brings the canonical Directory.Build.props in line with repo-template and
D20-Dice, which carry an explanatory comment above the <Nullable> line
describing what the .csproj + $(UsingMicrosoftNETSdk) condition excludes
and where the remaining opt-out path lives.

No behavior change — comment only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
T3's stryker.yaml was cherry-picked carrying actions/upload-artifact@v4,
while pr.yaml/release.yaml/codeql.yaml all use @v7. Bumping for
consistency with the fleet's canonical action versions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The flag is a Windows-PowerShell-5.1-only switch; pwsh (PowerShell 7+)
treats it as unsupported and errors. The step runs under shell: pwsh, so
the call must omit it. (Already correct in the alternate path elsewhere
in this workflow — bringing this one in line.)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`dotnet tool install -g` errors with a non-zero exit code if the tool is
already installed (common on self-hosted runners and after prior steps).
Even with stderr redirected, the exit code can break subsequent invocations.

Switch to update-or-install: try update first (succeeds if installed),
fall back to install if not. The step runs under shell: pwsh so the
pwsh 7 || operator is available.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Get-ChildItem -Filter '*.sln' missed .slnx solutions, causing the
restore/build warm-up to silently skip in repos using the newer
solution format (e.g. IComparable-Extensions). Switching to a filter
that accepts both extensions so DocFX gets a compiled solution to
extract metadata from.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
build-all-versions.yaml built versions.json from every SemVer tag in the
repo, regardless of whether the per-tag build succeeded. A failed worktree
add or empty DocFX output would silently leave the version-picker linking
to /versions/<tag>/ paths that never existed on gh-pages.

Now filter $orderedTags against the directories actually present under
$outDir/versions/. Missing tags get a ::notice:: log entry so the skip is
visible in workflow output, but versions.json only references real paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The catch block was treating ANY Invoke-WebRequest failure as "first
deploy, skipping preservation check" — transient network/DNS/Pages
outages, auth issues, redirect loops, etc. all silently bypassed the
safety check, defeating its purpose. A deploy that drops versions
from the picker could slip through any of those scenarios.

Now inspect $_.Exception.Response.StatusCode:
  - 404 → genuine "first deploy" case, skip preservation check (exit 0)
  - anything else → abort the deploy (exit 1) so a real issue surfaces
    instead of silently weakening the guard.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings June 3, 2026 00:54
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 44 out of 45 changed files in this pull request and generated no new comments.

Chris-Wolfgang and others added 4 commits June 2, 2026 21:09
Two Copilot findings on the canonical Fix-BranchRuleset.ps1 script —
both valid.

1. L40 (Repository parameter) — accepted arbitrary strings, including
   full GitHub URLs, with no validation. A bad input would produce a
   confusing 404 from a downstream 'gh api /repos/...' call instead of
   failing fast at parameter binding. Added the same ValidatePattern
   used by Setup-Labels.ps1 — accepts empty (use current repo), the
   '{{GITHUB_USERNAME}}/{{REPO_NAME}}' template placeholder, or
   'owner/repo' with no slashes / '@' / whitespace in either segment.

2. L4 synopsis claimed the script 'recreates' rulesets. It doesn't —
   it disables and renames existing rulesets so a follow-up
   Setup-BranchRuleset.ps1 invocation can create a fresh one without
   collisions. Reworded the synopsis + description to be honest about
   the two-step model, and added a sentence pointing at
   Setup-BranchRuleset.ps1 (canonical, lives in repo-template) as the
   actual recreation step.

These fixes also apply fleet-wide — the same script ships from
repo-template, so the canonical version should pick up the same
edits next sync (tracked as follow-up on repo-template).
---
updated-dependencies:
- dependency-name: Meziantou.Analyzer
  dependency-version: 3.0.98
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
main got PR #142 (drop 'dotnet' label) merged. vNext's dependabot.yml
is the canonical superset — no 'dotnet', no '/benchmarks' entry, and
adds the github-actions ecosystem group with grouped patterns (the
CI2 work). Resolution keeps vNext's version, which is what v1.1.1
should ship.
---
updated-dependencies:
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.27.0.140913
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI review requested due to automatic review settings June 3, 2026 01:35
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 37 out of 38 changed files in this pull request and generated no new comments.

Meziantou.Analyzer 3.0.85→3.0.98, SonarAnalyzer.CSharp 10.25→10.27,
coverlet.collector 10.0→10.0.1. All three were Dependabot PRs
(#119/#126/#127) retargeted to canonical-protected and now folded
through canonical-protected → vNext → v1.1.1.
@Chris-Wolfgang Chris-Wolfgang merged commit 41ecd7b into main Jun 3, 2026
8 checks passed
@Chris-Wolfgang Chris-Wolfgang deleted the vNext branch June 3, 2026 02:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment