From 9d7a9aad0e47bbd7c5ea00a22742a3f869410ea6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 4 Mar 2026 16:24:28 +0000 Subject: [PATCH 1/2] Initial plan From 5b9ed289feeb40e94537d5e9e484b7083638cdd6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 4 Mar 2026 16:34:33 +0000 Subject: [PATCH 2/2] Apply TemplateDotNetTool PR #52: staged pipelines, artifact consolidation, and OTS Software requirements Co-authored-by: Malcolmnixon <1863707+Malcolmnixon@users.noreply.github.com> --- .config/dotnet-tools.json | 2 +- .github/workflows/build.yaml | 223 +++++++++++++++++++++------------ .github/workflows/release.yaml | 2 +- requirements.yaml | 66 ++++++++++ 4 files changed, 211 insertions(+), 82 deletions(-) diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json index 366e649..6e9bd7b 100644 --- a/.config/dotnet-tools.json +++ b/.config/dotnet-tools.json @@ -27,7 +27,7 @@ ] }, "demaconsulting.reqstream": { - "version": "1.3.0", + "version": "1.4.0", "commands": [ "reqstream" ] diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c6ac065..9d361bf 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -10,13 +10,17 @@ on: required: true jobs: - # Run linting checks (markdown, spelling, YAML) to ensure code quality standards + # Performs quick quality checks for project formatting consistency including + # markdown linting, spell checking, and YAML validation. quality-checks: name: Quality Checks runs-on: ubuntu-latest permissions: contents: read steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies for quality checks. + - name: Checkout uses: actions/checkout@v6 @@ -26,20 +30,30 @@ jobs: dotnet-version: 10.x - name: Restore Tools - run: dotnet tool restore + run: > + dotnet tool restore + + # === CAPTURE TOOL VERSIONS === + # This section captures the versions of all tools used in the quality checks. - name: Capture tool versions shell: bash run: | + mkdir -p artifacts echo "Capturing tool versions..." - dotnet versionmark --capture --job-id "quality" -- dotnet git versionmark + dotnet versionmark --capture --job-id "quality" \ + --output "artifacts/versionmark-quality.json" -- \ + dotnet git versionmark echo "✓ Tool versions captured" - - name: Upload version capture - uses: actions/upload-artifact@v7 - with: - name: version-capture-quality - path: versionmark-quality.json + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section captures self-validation results from OTS tools. + + - name: Run VersionMark self-validation + run: dotnet versionmark --validate --results artifacts/versionmark-self-validation-quality.trx + + # === RUN QUALITY CHECKS === + # This section runs all quality checks for the project. - name: Run markdown linter uses: DavidAnson/markdownlint-cli2-action@v22 @@ -57,7 +71,16 @@ jobs: with: config_file: .yamllint.yaml - # Build and test on multiple operating systems with SonarCloud analysis + # === UPLOAD ARTIFACTS === + # This section uploads all quality artifacts. + + - name: Upload quality artifacts + uses: actions/upload-artifact@v7 + with: + name: artifacts-quality + path: artifacts/ + + # Builds and unit-tests the project on supported operating systems with SonarCloud analysis. build: name: Build ${{ matrix.os }} needs: quality-checks @@ -73,6 +96,9 @@ jobs: steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies for the build. + - name: Checkout uses: actions/checkout@v6 with: @@ -90,6 +116,31 @@ jobs: run: > dotnet tool restore + # === CAPTURE TOOL VERSIONS === + # This section captures the versions of all tools used in the build process. + + - name: Capture tool versions + shell: bash + run: | + mkdir -p artifacts + echo "Capturing tool versions..." + # Create short job ID: build-win, build-ubuntu + OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') + JOB_ID="build-${OS_SHORT}" + dotnet versionmark --capture --job-id "${JOB_ID}" \ + --output "artifacts/versionmark-${JOB_ID}.json" -- \ + dotnet git dotnet-sonarscanner versionmark + echo "✓ Tool versions captured" + + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section captures self-validation results from OTS tools. + + - name: Run VersionMark self-validation + run: dotnet versionmark --validate --results artifacts/versionmark-self-validation-${{ matrix.os }}.trx + + # === BUILD AND TEST === + # This section builds and tests the project. + - name: Restore Dependencies run: > dotnet restore @@ -122,7 +173,7 @@ jobs: --property:Version=${{ inputs.version }} --collect "XPlat Code Coverage;Format=opencover" --logger "trx;LogFilePrefix=${{ matrix.os }}" - --results-directory test-results + --results-directory artifacts - name: End Sonar Scanner env: @@ -139,38 +190,24 @@ jobs: --no-restore --property:PackageVersion=${{ inputs.version }} - - name: Capture tool versions - shell: bash - run: | - echo "Capturing tool versions..." - # Create short job ID: build-win, build-ubuntu - OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') - JOB_ID="build-${OS_SHORT}" - dotnet versionmark --capture --job-id "${JOB_ID}" -- \ - dotnet git dotnet-sonarscanner versionmark - echo "✓ Tool versions captured" - - - name: Upload version capture - uses: actions/upload-artifact@v7 - with: - name: version-capture-${{ matrix.os }} - path: versionmark-build-*.json + # === UPLOAD ARTIFACTS === + # This section uploads all build artifacts. - - name: Upload Test Results + - name: Upload build artifacts uses: actions/upload-artifact@v7 with: - name: test-results-${{ matrix.os }} - path: test-results/*.trx + name: artifacts-build-${{ matrix.os }} + path: artifacts/ - - name: Upload Artifacts + - name: Upload packages uses: actions/upload-artifact@v7 with: - name: artifacts-${{ matrix.os }} + name: packages-${{ matrix.os }} path: | src/DemaConsulting.SonarMark/bin/Release/*.nupkg src/DemaConsulting.SonarMark/bin/Release/*.snupkg - # Perform security analysis using CodeQL + # Performs security analysis using CodeQL. codeql: name: CodeQL Analysis runs-on: ubuntu-latest @@ -181,6 +218,9 @@ jobs: security-events: write steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies for CodeQL analysis. + - name: Checkout uses: actions/checkout@v6 with: @@ -209,6 +249,9 @@ jobs: run: > dotnet restore + # === BUILD AND ANALYZE === + # This section builds the project and runs CodeQL analysis. + - name: Build run: > dotnet build @@ -220,16 +263,19 @@ jobs: uses: github/codeql-action/analyze@v4 with: category: "/language:csharp" - output: sarif-results + output: artifacts upload: false - - name: Upload CodeQL SARIF + # === UPLOAD ARTIFACTS === + # This section uploads all CodeQL artifacts. + + - name: Upload CodeQL artifacts uses: actions/upload-artifact@v7 with: - name: codeql-sarif - path: sarif-results/csharp.sarif + name: artifacts-codeql + path: artifacts/ - # Test the packaged tool on multiple OS and .NET versions + # Tests the packaged tool on multiple OS and .NET versions. integration-test: name: Integration Test ${{ matrix.os }} .NET ${{ matrix.dotnet-version }} runs-on: ${{ matrix.os }} @@ -243,6 +289,9 @@ jobs: dotnet-version: ['8.x', '9.x', '10.x'] steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies and tools for integration testing. + - name: Checkout uses: actions/checkout@v6 with: @@ -253,7 +302,7 @@ jobs: - name: Download package uses: actions/download-artifact@v8 with: - name: artifacts-${{ matrix.os }} + name: packages-${{ matrix.os }} path: packages - name: Setup dotnet @@ -274,6 +323,26 @@ jobs: --version ${{ inputs.version }} \ DemaConsulting.SonarMark + # === CAPTURE TOOL VERSIONS === + # This section captures the versions of all tools used in the integration tests. + + - name: Capture tool versions + shell: bash + run: | + mkdir -p artifacts + echo "Capturing tool versions..." + # Create short job ID: int-win-8, int-win-9, int-ubuntu-8, etc. + OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') + DOTNET_SHORT=$(echo "${{ matrix.dotnet-version }}" | sed 's/\.x$//') + JOB_ID="int-${OS_SHORT}-${DOTNET_SHORT}" + dotnet versionmark --capture --job-id "${JOB_ID}" \ + --output "artifacts/versionmark-${JOB_ID}.json" -- \ + dotnet git versionmark + echo "✓ Tool versions captured" + + # === RUN INTEGRATION TESTS === + # This section runs the integration tests for the tool. + - name: Test version display shell: bash run: | @@ -318,35 +387,22 @@ jobs: shell: bash run: | echo "Running SonarMark self-validation..." - sonarmark --validate --results integration-test-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }}.trx \ + sonarmark --validate \ + --results artifacts/sonarmark-self-validation-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }}.trx \ || { echo "✗ Self-validation failed"; exit 1; } echo "✓ Self-validation succeeded" - - name: Capture tool versions - shell: bash - run: | - echo "Capturing tool versions..." - # Create short job ID: int-win-8, int-win-9, int-ubuntu-8, etc. - OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') - DOTNET_SHORT=$(echo "${{ matrix.dotnet-version }}" | sed 's/\.x$//') - JOB_ID="int-${OS_SHORT}-${DOTNET_SHORT}" - dotnet versionmark --capture --job-id "${JOB_ID}" -- dotnet git versionmark - echo "✓ Tool versions captured" - - - name: Upload version capture - uses: actions/upload-artifact@v7 - with: - name: version-capture-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }} - path: versionmark-int-*.json + # === UPLOAD ARTIFACTS === + # This section uploads all generated artifacts for use by downstream jobs. - - name: Upload integration test results + - name: Upload validation artifacts if: always() uses: actions/upload-artifact@v7 with: - name: integration-test-results-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }} - path: integration-test-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }}.trx + name: artifacts-validation-${{ matrix.os }}-dotnet${{ matrix.dotnet-version }} + path: artifacts/ - # Generate all documentation including requirements, trace matrix, and build notes + # Generates all documentation including requirements, trace matrix, and build notes. build-docs: name: Build Documentation runs-on: windows-latest @@ -361,32 +417,20 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Download all test results + - name: Download all job artifacts uses: actions/download-artifact@v8 with: - path: test-results - pattern: '*test-results*' + path: artifacts + pattern: 'artifacts-*' + merge-multiple: true continue-on-error: true - name: Download SonarMark package uses: actions/download-artifact@v8 with: - name: artifacts-windows-latest + name: packages-ubuntu-latest path: packages - - name: Download CodeQL SARIF - uses: actions/download-artifact@v8 - with: - name: codeql-sarif - path: codeql-results - - - name: Download all version captures - uses: actions/download-artifact@v8 - with: - path: version-captures - pattern: 'version-capture-*' - continue-on-error: true - # === INSTALL DEPENDENCIES === # This section installs all required dependencies and tools for document generation. @@ -422,10 +466,29 @@ jobs: shell: bash run: | echo "Capturing tool versions..." - dotnet versionmark --capture --job-id "build-docs" -- \ + dotnet versionmark --capture --job-id "build-docs" \ + --output "artifacts/versionmark-build-docs.json" -- \ dotnet git node npm pandoc weasyprint sarifmark sonarmark reqstream buildmark versionmark echo "✓ Tool versions captured" + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section captures self-validation results from OTS tools. + + - name: Run ReqStream self-validation + run: dotnet reqstream --validate --results artifacts/reqstream-self-validation.trx + + - name: Run BuildMark self-validation + run: dotnet buildmark --validate --results artifacts/buildmark-self-validation.trx + + - name: Run VersionMark self-validation + run: dotnet versionmark --validate --results artifacts/versionmark-self-validation.trx + + - name: Run SarifMark self-validation + run: dotnet sarifmark --validate --results artifacts/sarifmark-self-validation.trx + + - name: Run SonarMark self-validation + run: sonarmark --validate --results artifacts/sonarmark-self-validation.trx + # === GENERATE MARKDOWN REPORTS === # This section generates all markdown reports from various tools and sources. @@ -433,7 +496,7 @@ jobs: run: > dotnet reqstream --requirements requirements.yaml - --tests "test-results/**/*.trx" + --tests "artifacts/**/*.trx" --report docs/requirements/requirements.md --matrix docs/tracematrix/tracematrix.md --justifications docs/justifications/justifications.md @@ -443,7 +506,7 @@ jobs: shell: bash run: > dotnet sarifmark - --sarif codeql-results/csharp.sarif + --sarif artifacts/csharp.sarif --report docs/quality/codeql-quality.md --heading "SonarMark CodeQL Analysis" --report-depth 1 @@ -494,7 +557,7 @@ jobs: run: | echo "Publishing tool versions..." dotnet versionmark --publish --report docs/buildnotes/versions.md --report-depth 1 \ - -- "versionmark-*.json" "version-captures/**/versionmark-*.json" + -- "artifacts/**/versionmark-*.json" echo "✓ Tool versions published" - name: Display Tool Versions Report diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 821a753..9a81642 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -54,7 +54,7 @@ jobs: - name: Download package artifacts uses: actions/download-artifact@v8 with: - name: artifacts-ubuntu-latest + name: packages-ubuntu-latest path: artifacts - name: Download documents artifact diff --git a/requirements.yaml b/requirements.yaml index a801486..c6ff49a 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -352,3 +352,69 @@ sections: - dotnet10.x@SonarMark_IssuesRetrieval - dotnet10.x@SonarMark_HotSpotsRetrieval - dotnet10.x@SonarMark_MarkdownReportGeneration + + - title: OTS Software + requirements: + - id: SonarMark-OTS-MSTest + title: MSTest shall execute unit tests and report results. + justification: | + MSTest (MSTest.TestFramework and MSTest.TestAdapter) is the unit-testing framework used + by the project. It discovers and runs all test methods and writes TRX result files that + feed into coverage reporting and requirements traceability. Passing tests confirm the + framework is functioning correctly. + tags: [ots] + tests: + - Context_Create_WithLogFile_WritesToLogFile + - Context_Create_ResultsFile_SetsResultsProperty + - Context_Create_MissingResultsFilename_ThrowsException + - Context_Create_EnforceFlag_SetsEnforceProperty + - SonarQualityResult_ToMarkdown_Depth1_ProducesCorrectOutput + - SonarQualityResult_ToMarkdown_WithIssues_ProducesCompilerStyleOutput + - SonarQualityResult_ToMarkdown_WithHotSpots_ProducesCompilerStyleOutput + + - id: SonarMark-OTS-ReqStream + title: ReqStream shall enforce that every requirement is linked to passing test evidence. + justification: | + DemaConsulting.ReqStream processes requirements.yaml and the TRX test-result files to + produce a requirements report, justifications document, and traceability matrix. When + run with --enforce, it exits with a non-zero code if any requirement lacks test evidence, + making unproven requirements a build-breaking condition. A successful pipeline run with + --enforce proves all requirements are covered and that ReqStream is functioning. + tags: [ots] + tests: + - ReqStream_EnforcementMode + + - id: SonarMark-OTS-BuildMark + title: BuildMark shall generate build-notes documentation from GitHub Actions metadata. + justification: | + DemaConsulting.BuildMark queries the GitHub API to capture workflow run details and + renders them as a markdown build-notes document included in the release artifacts. + It runs as part of the same CI pipeline that produces the TRX test results, so a + successful pipeline run is evidence that BuildMark executed without error. + tags: [ots] + tests: + - BuildMark_MarkdownReportGeneration + + - id: SonarMark-OTS-VersionMark + title: VersionMark shall publish captured tool-version information. + justification: | + DemaConsulting.VersionMark reads version metadata for each dotnet tool used in the + pipeline and writes a versions markdown document included in the release artifacts. + It runs in the same CI pipeline that produces the TRX test results, so a successful + pipeline run is evidence that VersionMark executed without error. + tags: [ots] + tests: + - VersionMark_CapturesVersions + - VersionMark_GeneratesMarkdownReport + + - id: SonarMark-OTS-SarifMark + title: SarifMark shall convert CodeQL SARIF results into a markdown report. + justification: | + DemaConsulting.SarifMark reads the SARIF output produced by CodeQL code scanning and + renders it as a human-readable markdown document included in the release artifacts. + It runs in the same CI pipeline that produces the TRX test results, so a successful + pipeline run is evidence that SarifMark executed without error. + tags: [ots] + tests: + - SarifMark_SarifReading + - SarifMark_MarkdownReportGeneration