Skip to content

Canonical sync (protected files) ahead of v0.3.2#202

Merged
Chris-Wolfgang merged 1 commit into
mainfrom
protected/canonical-try-pattern-v0.3.2
Jun 19, 2026
Merged

Canonical sync (protected files) ahead of v0.3.2#202
Chris-Wolfgang merged 1 commit into
mainfrom
protected/canonical-try-pattern-v0.3.2

Conversation

@Chris-Wolfgang

Copy link
Copy Markdown
Owner

Why this PR exists

The Release v0.3.2 PR (#166) has 34 files in its diff, 8 of which are "protected" under pr.yaml's Detect .NET Projects guard. Merging #166 as-is would require admin-bypass on the whole 34-file diff — and the bypass waives every ruleset rule at once, including required_review_thread_resolution on the 26 non-protected files.

This split-out PR carries only the 8 protected files so the bypass surface is small and easy to eyeball. #166 then merges through the standard ruleset with full review-thread enforcement.

What's in here

File Why it's protected
.editorconfig Root .editorconfig is exact-match protected — controls analyzer rules and code style
BannedSymbols.txt Banned API list — protected so a malicious PR can't allow Process.Start("rm") past CI
Directory.Build.props MSBuild defaults — protected so analyzer/SDK pins can't be silently disabled
.github/workflows/benchmarks.yaml Workflow files glob-protected — CI behavior
.github/workflows/codeql.yaml Same
.github/workflows/pr.yaml Same — this is the file that defines the guard
.github/workflows/release.yaml Same
.github/workflows/stryker.yaml Same

These are verbatim copies of vNext's content. No edits applied during extraction — git diff from origin/main shows exactly the deltas already on vNext.

Expected CI behaviour

  • Detect .NET Projects → ❌ FAIL (expected — that's why we're splitting)
  • Stages 1/2/3 → SKIPPED (gated on detect-projects.outputs.has-projects)
  • Secrets Scan (gitleaks), Security Scan (DevSkim), Security Scan (CodeQL) → ✅ should pass

Merge plan

  1. Maintainer admin-bypass-merges this PR (one click, 8-file diff, easy to review).
  2. I merge origin/main back into vNext — the protected-file delta on #166 vanishes.
  3. #166 flips from "needs admin bypass" to MERGEABLE with full ruleset enforcement.
  4. #166 merges via the normal merge button.

Same shape as

This is the standard split done previously for DateTime-Extensions v0.X via protected/add-benchmarks-yaml and the same pattern lined up for ETL-Test-Kit #112 / ETL-Abstractions #192 / ETL-FixedWidth #134.

Extracts the protected-file deltas from vNext (Release v0.3.2 PR #166)
so that PR can merge through the standard ruleset rather than admin-
bypassing the entire 34-file diff (which would also waive
required_review_thread_resolution on every non-protected file).

Files in this PR (matching the `Detect .NET Projects` guard patterns):
- .editorconfig
- BannedSymbols.txt
- Directory.Build.props
- .github/workflows/benchmarks.yaml
- .github/workflows/codeql.yaml
- .github/workflows/pr.yaml
- .github/workflows/release.yaml
- .github/workflows/stryker.yaml

These carry the canonical CI/analyzer/banned-API updates folded into
v0.3.2 (C1 fleet template-drift sync, CI2 github-actions ecosystem,
A1 PublicApiAnalyzers scaffolding, T3 Stryker workflow, D6 versions
preservation guard, D8 inline root redirect, etc.). They are
verbatim copies of vNext's content at the time of extraction; no
new edits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant