diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json index d6b5cd8..f3d6b4c 100644 --- a/.config/dotnet-tools.json +++ b/.config/dotnet-tools.json @@ -33,7 +33,7 @@ ] }, "demaconsulting.reqstream": { - "version": "1.3.0", + "version": "1.4.0", "commands": [ "reqstream" ] diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 0d94e19..b9312f4 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -18,6 +18,10 @@ jobs: permissions: contents: read steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies and tools for quality checks. + # Downstream projects: Add any additional dependency installations here. + - name: Checkout uses: actions/checkout@v6 @@ -30,18 +34,34 @@ jobs: run: > dotnet tool restore + # === CAPTURE TOOL VERSIONS === + # This section captures the versions of all tools used in the build process. + # Downstream projects: Add any additional tools to capture here. + - name: Capture tool versions shell: bash run: | + mkdir -p artifacts echo "Capturing tool versions..." - dotnet versionmark --capture --job-id "quality" -- dotnet git versionmark + dotnet versionmark --capture --job-id "quality" \ + --output "artifacts/versionmark-quality.json" -- \ + dotnet git versionmark echo "✓ Tool versions captured" - - name: Upload version capture - uses: actions/upload-artifact@v7 - with: - name: version-capture-quality - path: versionmark-quality.json + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section runs the self-validation of each OTS tool and saves TRX results + # so that OTS Software Requirements in requirements.yaml can be satisfied. + # Downstream projects: Add any additional OTS tool self-validation steps here. + + - name: Run VersionMark self-validation + run: > + dotnet versionmark + --validate + --results artifacts/versionmark-self-validation-quality.trx + + # === RUN QUALITY CHECKS === + # This section runs the linting and quality checks for the project. + # Downstream projects: Add any additional quality check steps here. - name: Run markdown linter uses: DavidAnson/markdownlint-cli2-action@v22 @@ -59,6 +79,16 @@ jobs: with: config_file: .yamllint.yaml + # === UPLOAD ARTIFACTS === + # This section uploads all generated artifacts for use by downstream jobs. + # Downstream projects: Add any additional artifact uploads here. + + - name: Upload quality artifacts + uses: actions/upload-artifact@v7 + with: + name: artifacts-quality + path: artifacts/ + # Builds and unit-tests the project on supported operating systems to ensure # unit-tests operate on all platforms and to run SonarScanner for generating # the code quality report. @@ -77,6 +107,10 @@ jobs: steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies and tools for building the project. + # Downstream projects: Add any additional dependency installations here. + - name: Checkout uses: actions/checkout@v6 with: @@ -94,6 +128,38 @@ jobs: run: > dotnet tool restore + # === CAPTURE TOOL VERSIONS === + # This section captures the versions of all tools used in the build process. + # Downstream projects: Add any additional tools to capture here. + + - name: Capture tool versions + shell: bash + run: | + mkdir -p artifacts + echo "Capturing tool versions..." + # Create short job ID: build-win, build-ubuntu + OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') + JOB_ID="build-${OS_SHORT}" + dotnet versionmark --capture --job-id "${JOB_ID}" \ + --output "artifacts/versionmark-${JOB_ID}.json" -- \ + dotnet git dotnet-sonarscanner versionmark + echo "✓ Tool versions captured" + + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section runs the self-validation of each OTS tool and saves TRX results + # so that OTS Software Requirements in requirements.yaml can be satisfied. + # Downstream projects: Add any additional OTS tool self-validation steps here. + + - name: Run VersionMark self-validation + run: > + dotnet versionmark + --validate + --results artifacts/versionmark-self-validation-${{ matrix.os }}.trx + + # === BUILD AND TEST === + # This section builds and tests the project. + # Downstream projects: Add any additional build or test steps here. + - name: Restore Dependencies run: > dotnet restore @@ -126,7 +192,7 @@ jobs: --property:Version=${{ inputs.version }} --collect "XPlat Code Coverage;Format=opencover" --logger "trx;LogFilePrefix=${{ matrix.os }}" - --results-directory test-results + --results-directory artifacts - name: End Sonar Scanner env: @@ -143,33 +209,20 @@ jobs: --no-restore --property:PackageVersion=${{ inputs.version }} - - name: Capture tool versions - shell: bash - run: | - echo "Capturing tool versions..." - # Create short job ID: build-win, build-ubuntu - OS_SHORT=$(echo "${{ matrix.os }}" | sed 's/windows-latest/win/;s/ubuntu-latest/ubuntu/') - JOB_ID="build-${OS_SHORT}" - dotnet versionmark --capture --job-id "${JOB_ID}" -- \ - dotnet git dotnet-sonarscanner versionmark - echo "✓ Tool versions captured" - - - name: Upload version capture - uses: actions/upload-artifact@v7 - with: - name: version-capture-${{ matrix.os }} - path: versionmark-build-*.json + # === UPLOAD ARTIFACTS === + # This section uploads all generated artifacts for use by downstream jobs. + # Downstream projects: Add any additional artifact uploads here. - - name: Upload Test Results + - name: Upload build artifacts uses: actions/upload-artifact@v7 with: - name: test-results-${{ matrix.os }} - path: test-results/*.trx + name: artifacts-build-${{ matrix.os }} + path: artifacts/ - - name: Upload Artifacts + - name: Upload packages uses: actions/upload-artifact@v7 with: - name: artifacts-${{ matrix.os }} + name: packages-${{ matrix.os }} path: | src/TemplateDotNetLibrary/bin/Release/*.nupkg src/TemplateDotNetLibrary/bin/Release/*.snupkg @@ -186,6 +239,10 @@ jobs: security-events: write steps: + # === INSTALL DEPENDENCIES === + # This section installs all required dependencies and tools for CodeQL analysis. + # Downstream projects: Add any additional dependency installations here. + - name: Checkout uses: actions/checkout@v6 with: @@ -214,6 +271,10 @@ jobs: run: > dotnet restore + # === BUILD AND ANALYZE === + # This section builds the project and performs CodeQL analysis. + # Downstream projects: Add any additional analysis steps here. + - name: Build run: > dotnet build @@ -225,14 +286,18 @@ jobs: uses: github/codeql-action/analyze@v4 with: category: "/language:csharp" - output: sarif-results + output: artifacts upload: false - - name: Upload CodeQL SARIF + # === UPLOAD ARTIFACTS === + # This section uploads all generated artifacts for use by downstream jobs. + # Downstream projects: Add any additional artifact uploads here. + + - name: Upload CodeQL artifacts uses: actions/upload-artifact@v7 with: - name: codeql-sarif - path: sarif-results/csharp.sarif + name: artifacts-codeql + path: artifacts/ # Builds the supporting documentation including user guides, requirements, # trace matrices, code quality reports, and build notes. @@ -251,24 +316,12 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Download all test results + - name: Download all job artifacts uses: actions/download-artifact@v8 with: - path: test-results - pattern: '*test-results*' - continue-on-error: true - - - name: Download CodeQL SARIF - uses: actions/download-artifact@v8 - with: - name: codeql-sarif - path: codeql-results - - - name: Download all version captures - uses: actions/download-artifact@v8 - with: - path: version-captures - pattern: 'version-capture-*' + path: artifacts + pattern: 'artifacts-*' + merge-multiple: true continue-on-error: true # === INSTALL DEPENDENCIES === @@ -299,10 +352,46 @@ jobs: shell: bash run: | echo "Capturing tool versions..." - dotnet versionmark --capture --job-id "build-docs" -- \ + dotnet versionmark --capture --job-id "build-docs" \ + --output "artifacts/versionmark-build-docs.json" -- \ dotnet git node npm pandoc weasyprint sarifmark sonarmark reqstream buildmark versionmark echo "✓ Tool versions captured" + # === CAPTURE OTS SELF-VALIDATION RESULTS === + # This section runs the self-validation of each OTS tool and saves TRX results + # so that OTS Software Requirements in requirements.yaml can be satisfied. + # Downstream projects: Add any additional OTS tool self-validation steps here. + + - name: Run ReqStream self-validation + run: > + dotnet reqstream + --validate + --results artifacts/reqstream-self-validation.trx + + - name: Run BuildMark self-validation + run: > + dotnet buildmark + --validate + --results artifacts/buildmark-self-validation.trx + + - name: Run VersionMark self-validation + run: > + dotnet versionmark + --validate + --results artifacts/versionmark-self-validation.trx + + - name: Run SarifMark self-validation + run: > + dotnet sarifmark + --validate + --results artifacts/sarifmark-self-validation.trx + + - name: Run SonarMark self-validation + run: > + dotnet sonarmark + --validate + --results artifacts/sonarmark-self-validation.trx + # === GENERATE MARKDOWN REPORTS === # This section generates all markdown reports from various tools and sources. # Downstream projects: Add any additional markdown report generation steps here. @@ -311,7 +400,7 @@ jobs: run: > dotnet reqstream --requirements requirements.yaml - --tests "test-results/**/*.trx" + --tests "artifacts/**/*.trx" --report docs/requirements/requirements.md --justifications docs/justifications/justifications.md --matrix docs/tracematrix/tracematrix.md @@ -320,7 +409,7 @@ jobs: - name: Generate CodeQL Quality Report with SarifMark run: > dotnet sarifmark - --sarif codeql-results/csharp.sarif + --sarif artifacts/csharp.sarif --report docs/quality/codeql-quality.md --heading "Template DotNet Library CodeQL Analysis" --report-depth 1 @@ -371,7 +460,7 @@ jobs: run: | echo "Publishing tool versions..." dotnet versionmark --publish --report docs/buildnotes/versions.md --report-depth 1 \ - -- "versionmark-*.json" "version-captures/**/versionmark-*.json" + -- "artifacts/**/versionmark-*.json" echo "✓ Tool versions published" - name: Display Tool Versions Report diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 821a753..9a81642 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -54,7 +54,7 @@ jobs: - name: Download package artifacts uses: actions/download-artifact@v8 with: - name: artifacts-ubuntu-latest + name: packages-ubuntu-latest path: artifacts - name: Download documents artifact diff --git a/requirements.yaml b/requirements.yaml index 23c28cb..f8e66a2 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -94,3 +94,85 @@ sections: range of .NET projects, including those targeting .NET Framework and older .NET Core versions. tests: - "net481@DemoMethod_ReturnsGreeting_WithDefaultPrefix" + + - title: OTS Software + requirements: + - id: Template-OTS-MSTest + title: MSTest shall execute unit tests and report results. + justification: | + MSTest (MSTest.TestFramework and MSTest.TestAdapter) is the unit-testing framework used + by the project. It discovers and runs all test methods and writes TRX result files that + feed into coverage reporting and requirements traceability. Passing tests confirm the + framework is functioning correctly. + tags: [ots] + tests: + - DemoMethod_ReturnsGreeting_WithDefaultPrefix + - DemoMethod_ReturnsGreeting_WithCustomPrefix + - DemoMethod_ThrowsArgumentNullException_ForNullInput + - DemoMethod_ThrowsArgumentException_ForEmptyInput + - Constructor_ThrowsArgumentNullException_ForNullPrefix + - Constructor_ThrowsArgumentException_ForEmptyPrefix + - DemoClass_DefaultPrefix_IsHello + - DemoClass_Prefix_ReturnsCustomPrefix + - DemoClass_DefaultConstructor_SetsDefaultPrefix + + - id: Template-OTS-ReqStream + title: ReqStream shall enforce that every requirement is linked to passing test evidence. + justification: | + DemaConsulting.ReqStream processes requirements.yaml and the TRX test-result files to + produce a requirements report, justifications document, and traceability matrix. When + run with --enforce, it exits with a non-zero code if any requirement lacks test evidence, + making unproven requirements a build-breaking condition. A successful pipeline run with + --enforce proves all requirements are covered and that ReqStream is functioning. + tags: [ots] + tests: + - ReqStream_EnforcementMode + + - id: Template-OTS-BuildMark + title: BuildMark shall generate build-notes documentation from GitHub Actions metadata. + justification: | + DemaConsulting.BuildMark queries the GitHub API to capture workflow run details and + renders them as a markdown build-notes document included in the release artifacts. + It runs as part of the same CI pipeline that produces the TRX test results, so a + successful pipeline run is evidence that BuildMark executed without error. + tags: [ots] + tests: + - BuildMark_MarkdownReportGeneration + + - id: Template-OTS-VersionMark + title: VersionMark shall publish captured tool-version information. + justification: | + DemaConsulting.VersionMark reads version metadata for each dotnet tool used in the + pipeline and writes a versions markdown document included in the release artifacts. + It runs in the same CI pipeline that produces the TRX test results, so a successful + pipeline run is evidence that VersionMark executed without error. + tags: [ots] + tests: + - VersionMark_CapturesVersions + - VersionMark_GeneratesMarkdownReport + + - id: Template-OTS-SarifMark + title: SarifMark shall convert CodeQL SARIF results into a markdown report. + justification: | + DemaConsulting.SarifMark reads the SARIF output produced by CodeQL code scanning and + renders it as a human-readable markdown document included in the release artifacts. + It runs in the same CI pipeline that produces the TRX test results, so a successful + pipeline run is evidence that SarifMark executed without error. + tags: [ots] + tests: + - SarifMark_SarifReading + - SarifMark_MarkdownReportGeneration + + - id: Template-OTS-SonarMark + title: SonarMark shall generate a SonarCloud quality report. + justification: | + DemaConsulting.SonarMark retrieves quality-gate and metrics data from SonarCloud and + renders it as a markdown document included in the release artifacts. It runs in the + same CI pipeline that produces the TRX test results, so a successful pipeline run is + evidence that SonarMark executed without error. + tags: [ots] + tests: + - SonarMark_QualityGateRetrieval + - SonarMark_IssuesRetrieval + - SonarMark_HotSpotsRetrieval + - SonarMark_MarkdownReportGeneration