Skip to content

build: add FluentValidation host guard to prevent type-identity issues#347

Closed
RicherTunes wants to merge 2 commits intomainfrom
fix/fluentvalidation-build-guard
Closed

build: add FluentValidation host guard to prevent type-identity issues#347
RicherTunes wants to merge 2 commits intomainfrom
fix/fluentvalidation-build-guard

Conversation

@RicherTunes
Copy link
Owner

Summary

Adds build-time validation that FluentValidation.dll exists in the Lidarr host assemblies path. This prevents accidental builds where Directory.Packages.props pulls FV 11.x from NuGet instead of using the host's FluentValidation.

Problem (Contributor Footgun)

The current csproj has a conditional PackageReference:

<PackageReference Include="FluentValidation" 
                  Condition="!Exists('$(LidarrPath)\FluentValidation.dll')" />

If someone builds without proper host assemblies, NuGet silently provides FluentValidation 11.x. The build succeeds but the plugin fails at runtime with:

Method 'Test' in type 'Lidarr.Plugin.Brainarr.BrainarrImportList' does not have an implementation.

Solution

New MSBuild target ValidateFluentValidationFromHost:

Build Error Example

error : CRITICAL: FluentValidation.dll not found in ..\ext\Lidarr-docker\_output\net8.0. 
        Brainarr MUST use host's FluentValidation to avoid type-identity mismatch 
        (override signature for Test method). Extract Lidarr assemblies with 
        './build.ps1 -ExtractAssemblies' or use a complete Lidarr installation.

Related

🤖 Generated with Claude Code

RicherTunes and others added 2 commits December 27, 2025 16:30
Adds build-time validation that FluentValidation.dll exists in the
Lidarr host assemblies path. This prevents accidental builds where
Directory.Packages.props pulls FV 11.x from NuGet instead of using
the host's FluentValidation.

The guard fails fast with a clear error message explaining:
- Why host FV is required (type-identity for Test override)
- How to fix it (extract assemblies or use complete installation)
- Link to PR #346 for context

This closes the "contributor footgun" risk identified during the
FluentValidation exclusion fix review.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@github-actions
Copy link
Contributor

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@RicherTunes
Copy link
Owner Author

Stale — superseded by packaging-gates adoption (#397) and ecosystem standardization.

@RicherTunes RicherTunes closed this Feb 6, 2026
RicherTunes added a commit that referenced this pull request Feb 13, 2026
Bumps ext/Lidarr.Plugin.Common from da58f3e to 805af9f (7 commits):
- fix(ci): include JSON files in Docker host assembly extraction (#350)
- feat(scripts): ext-common-sha.txt format guard + bulk repin tool (#349)
- fix(scripts): improve stale workflow pin warnings (#348)
- docs(scripts): mark --update-pins as manual-only (#347)
- fix(tests): replace Progress<T> with synchronous IProgress<T> (#346)
- fix(scripts): prevent ((UPDATED++)) exit under set -e (#345)
- feat(scripts): single source of truth for Common SHA pins (#344)

Also updates packaging-gates.yml SHA pin to 805af9f — this includes
the JSON extraction fix that should unblock the packaging-gates CI job.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
RicherTunes added a commit that referenced this pull request Feb 13, 2026
Bumps ext/Lidarr.Plugin.Common from da58f3e to 805af9f (7 commits):
- fix(ci): include JSON files in Docker host assembly extraction (#350)
- feat(scripts): ext-common-sha.txt format guard + bulk repin tool (#349)
- fix(scripts): improve stale workflow pin warnings (#348)
- docs(scripts): mark --update-pins as manual-only (#347)
- fix(tests): replace Progress<T> with synchronous IProgress<T> (#346)
- fix(scripts): prevent ((UPDATED++)) exit under set -e (#345)
- feat(scripts): single source of truth for Common SHA pins (#344)

Also updates packaging-gates.yml SHA pin to 805af9f — this includes
the JSON extraction fix that should unblock the packaging-gates CI job.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
RicherTunes added a commit that referenced this pull request Feb 13, 2026
Bumps ext/Lidarr.Plugin.Common from da58f3e to 805af9f (7 commits):
- fix(ci): include JSON files in Docker host assembly extraction (#350)
- feat(scripts): ext-common-sha.txt format guard + bulk repin tool (#349)
- fix(scripts): improve stale workflow pin warnings (#348)
- docs(scripts): mark --update-pins as manual-only (#347)
- fix(tests): replace Progress<T> with synchronous IProgress<T> (#346)
- fix(scripts): prevent ((UPDATED++)) exit under set -e (#345)
- feat(scripts): single source of truth for Common SHA pins (#344)

Also updates packaging-gates.yml SHA pin to 805af9f — this includes
the JSON extraction fix that should unblock the packaging-gates CI job.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant