Sync with TemplateDotNetLibrary: macOS, Continuous Compliance, agent selection guide, CodeQL build-mode

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,82 @@
+---
+name: ❓ Question / Help
+description: Ask a usage question or get help with the SpdxModel
+title: "[Question]: "
+labels: ["question"]
+assignees: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reaching out! Please fill out the sections below so we can help you as quickly as possible.
+        For general discussion, you can also use
+        [GitHub Discussions](https://github.com/demaconsulting/SpdxModel/discussions).
+
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+      description: A clear and concise description of what you need help with.
+      placeholder: What would you like to know or understand?
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-tried
+    attributes:
+      label: What Have You Tried?
+      description: Describe what you have already attempted, including any code or configuration you have used.
+      placeholder: |
+        ```csharp
+        // Your code here
+        ```
+      render: csharp
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Outcome
+      description: A clear and concise description of what you expected to happen or what you are trying to achieve.
+      placeholder: Describe the outcome you are looking for...
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Library Version
+      description: What version of DemaConsulting.SpdxModel are you using?
+      placeholder: e.g., 1.0.0
+    validations:
+      required: true
+
+  - type: dropdown
+    id: dotnet-version
+    attributes:
+      label: .NET Version
+      description: What version of .NET are you using?
+      options:
+        - ".NET 8"
+        - ".NET 9"
+        - ".NET 10"
+        - Other (please specify in additional context)
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional Context
+      description: Add any other context, screenshots, or links that may help answer your question.
+      placeholder: Any additional information...
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      description: Please confirm the following
+      options:
+        - label: I have searched existing issues and discussions to ensure this has not been answered before
+          required: true
+        - label: I have provided a clear description of my question
+          required: true

.github/workflows/build.yaml

@@ -101,7 +101,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [windows-latest, ubuntu-latest]
+        os: [windows-latest, ubuntu-latest, macos-latest]
 
     runs-on: ${{ matrix.os }}
 
@@ -137,8 +137,8 @@ jobs:
         run: |
           mkdir -p artifacts
           echo "Capturing tool versions..."
-          # Create short job ID: build-win, build-ubuntu
-          OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/')
+          # Create short job ID: build-windows, build-ubuntu, build-macos
+          OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/-latest//')
           JOB_ID="build-${OS_SHORT}"
           dotnet versionmark --capture --job-id "${JOB_ID}" \
             --output "artifacts/versionmark-${JOB_ID}.json" -- \
@@ -252,6 +252,7 @@ jobs:
         uses: github/codeql-action/init@v4
         with:
           languages: csharp
+          build-mode: manual
           queries: security-and-quality
           config-file: ./.github/codeql-config.yml
 

AGENTS.md

@@ -13,6 +13,18 @@ and deserializing SPDX SBOMs into an in-memory representation.
 - **Repo Consistency Agent** - Ensures SpdxModel remains consistent with the
   [TemplateDotNetLibrary](https://github.com/demaconsulting/TemplateDotNetLibrary) template patterns
 
+## Agent Selection Guide
+
+- Fix a bug → **Software Developer**
+- Add a new feature → **Requirements Agent** → **Software Developer** → **Test Developer**
+- Write a test → **Test Developer**
+- Fix linting or static analysis issues → **Code Quality Agent**
+- Update documentation → **Technical Writer**
+- Add or update requirements → **Requirements Agent**
+- Ensure test coverage linkage in `requirements.yaml` → **Requirements Agent**
+- Run security scanning or address CodeQL alerts → **Code Quality Agent**
+- Propagate template changes → **Repo Consistency Agent**
+
 ## Tech Stack
 
 - C# 12, .NET 8.0/9.0/10.0, dotnet CLI, NuGet
@@ -38,6 +50,7 @@ evidence. This is critical for platform and framework requirements - **do not re
 
 - `windows@TestName` - proves the test passed on a Windows platform
 - `ubuntu@TestName` - proves the test passed on a Linux (Ubuntu) platform
+- `macos@TestName` - proves the test passed on a macOS platform
 - `net8.0@TestName` - proves the test passed under the .NET 8 runtime
 - `net9.0@TestName` - proves the test passed under the .NET 9 runtime
 - `net10.0@TestName` - proves the test passed under the .NET 10 runtime
@@ -91,7 +104,7 @@ dotnet test --configuration Release
 ## CI/CD
 
 - **Quality Checks**: Markdown lint, spell check, YAML lint
-- **Build**: Multi-platform .NET 8/9/10
+- **Build**: Multi-platform (Windows/Linux/macOS) .NET 8/9/10
 - **CodeQL**: Security scanning
 - **SonarCloud**: Code quality analysis
 

README.md

@@ -20,8 +20,11 @@ comprehensive in-memory model for reading, manipulating, and writing SPDX Softwa
 - 🎯 **Type-Safe** - Strongly-typed C# API with nullable reference types
 - 🔍 **Transform Support** - Built-in utilities for manipulating SPDX relationships
 - ⚡ **Multi-Target** - Supports .NET 8, 9, and 10
+- 🖥️ **Multi-Platform** - Builds and runs on Windows, Linux, and macOS
 - 🧪 **Well-Tested** - Comprehensive test suite with high code coverage
 - 📚 **Well-Documented** - XML documentation for all public APIs
+- 🔒 **Continuous Compliance** - Compliance evidence generated automatically on every CI run, following
+  the [Continuous Compliance](https://github.com/demaconsulting/ContinuousCompliance) methodology
 
 ## Installation
 

docs/guide/guide.md

@@ -36,6 +36,20 @@ The library fully supports the following SPDX specifications:
 - **SPDX 2.2**: Full support for SPDX 2.2 specification
 - **SPDX 2.3**: Full support for SPDX 2.3 specification
 
+# Continuous Compliance
+
+This library follows the [Continuous Compliance][continuous-compliance] methodology, which ensures
+compliance evidence is generated automatically on every CI run.
+
+## Key Practices
+
+- **Requirements Traceability**: Every requirement is linked to passing tests, and a trace matrix is
+  auto-generated on each release
+- **Linting Enforcement**: markdownlint, cspell, and yamllint are enforced before any build proceeds
+- **Automated Audit Documentation**: Each release ships with generated requirements, justifications,
+  trace matrix, and quality reports
+- **CodeQL and SonarCloud**: Security and quality analysis runs on every build
+
 # Installation
 
 ## Prerequisites
@@ -668,3 +682,4 @@ Made with ❤️ by [DEMA Consulting][dema-consulting]
 [github-issues]: https://github.com/demaconsulting/SpdxModel/issues
 [github-discussions]: https://github.com/demaconsulting/SpdxModel/discussions
 [dema-consulting]: https://github.com/demaconsulting
+[continuous-compliance]: https://github.com/demaconsulting/ContinuousCompliance

requirements.yaml

@@ -279,6 +279,16 @@ sections:
 
       - title: Platform Requirements
         requirements:
+          - id: SpdxModel-Plt-MacOS
+            title: The library shall build and run on macOS platforms.
+            tags:
+              - platform
+            justification: |
+              DEMA Consulting libraries must support macOS for developers using Apple platforms.
+            tests:
+              # Tests link to "macos" to ensure results come from macOS platform
+              - "macos@Spdx2JsonDeserializer_Deserialize_ValidSpdx22JsonReturnsExpectedDocument"
+
           - id: SpdxModel-Plt-Net8
             title: The library shall support .NET 8 runtime.
             tags: