feat!: migrate to .NET 10 (CRIT-001) - #465
Conversation
BREAKING CHANGE: requires .NET 10 Desktop Runtime to run.
📝 WalkthroughWalkthroughThis PR migrates the entire SystemManager project from .NET 9 to .NET 10. All project target frameworks are bumped to Changes.NET 9 to 10 Migration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 26-30: Replace the mutable tag for the GitHub Action
"actions/setup-dotnet@v5" with a full commit SHA (e.g.,
actions/setup-dotnet@<commit-sha>) in the workflow so the action is immutably
pinned; update both occurrences of that uses: entry and any other matching
"actions/setup-dotnet@v5", obtain the correct commit SHA from the
actions/setup-dotnet repository (or the exact released commit you trust) and
substitute it, then run a quick grep for any remaining uses: lines matching
uses: ...@vN or `@vN.N` and pin them similarly.
In @.github/workflows/codeql.yml:
- Around line 25-28: The workflow currently uses the mutable tag
actions/setup-dotnet@v5; replace this with the action pinned to a full commit
SHA (use the repository reference actions/setup-dotnet@<commit-sha>) so the
runner uses an immutable digest; find the step that names
actions/setup-dotnet@v5 and update that reference while keeping the existing
with: dotnet-version: 10.0.x intact, ensuring you copy the commit SHA from the
actions/setup-dotnet repository release commit to fully pin the action.
In @.github/workflows/release.yml:
- Around line 29-32: Replace the mutable tag reference "actions/setup-dotnet@v5"
with a pinned full commit SHA for the actions/setup-dotnet action; update the
"uses" line so the action is referenced by its commit SHA (e.g.,
actions/setup-dotnet@<full-commit-sha>) while keeping the existing
"dotnet-version: 10.0.x" input unchanged to ensure the workflow uses a fixed,
auditable action version.
In `@README.md`:
- Line 453: The README has inconsistent framework versions: the top badge shows
`.NET-9.0` while a later line reads `.NET 10 (WPF, C# 14)`; update the badge
text/value to match the document-wide target (.NET 10) so both the badge string
`.NET-9.0` and any badge image alt/title are changed to `.NET-10` (or `.NET 10`)
to keep the README consistent; locate and edit the badge markup near the top
(the `.NET-9.0` token) and ensure any other occurrences of `.NET-9.0` in the
file are updated to `.NET 10` to avoid version drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8cfff4d9-018b-4e7b-b853-42afe5c1ed32
📒 Files selected for processing (10)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/release.ymlCHANGELOG.mdREADME.mdSECURITY.mdSysManager/SysManager.IntegrationTests/SysManager.IntegrationTests.csprojSysManager/SysManager.Tests/SysManager.Tests.csprojSysManager/SysManager.UITests/SysManager.UITests.csprojSysManager/SysManager/SysManager.csproj
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Analyze (csharp)
- GitHub Check: Build & unit tests
🧰 Additional context used
🪛 zizmor (1.25.2)
.github/workflows/codeql.yml
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
.github/workflows/ci.yml
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 99-99: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
.github/workflows/release.yml
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (6)
CHANGELOG.md (1)
9-13: LGTM!SysManager/SysManager/SysManager.csproj (1)
5-5: LGTM!SysManager/SysManager.Tests/SysManager.Tests.csproj (1)
4-4: LGTM!SysManager/SysManager.IntegrationTests/SysManager.IntegrationTests.csproj (1)
4-4: LGTM!SysManager/SysManager.UITests/SysManager.UITests.csproj (1)
4-4: LGTM!SECURITY.md (1)
15-17: LGTM!
| - name: Setup .NET 10 SDK | ||
| uses: actions/setup-dotnet@v5 | ||
| with: | ||
| dotnet-version: 9.0.x | ||
| dotnet-version: 10.0.x | ||
|
|
There was a problem hiding this comment.
Pin actions/setup-dotnet to a full commit SHA.
Line 27 and Line 99 use a mutable tag (@v5). That violates the pinned-action policy and weakens workflow supply-chain guarantees.
🔧 Proposed fix
- - name: Setup .NET 10 SDK
- uses: actions/setup-dotnet@v5
+ - name: Setup .NET 10 SDK
+ uses: actions/setup-dotnet@<full-commit-sha> # v5
with:
dotnet-version: 10.0.x
...
- - name: Setup .NET 10 SDK
- uses: actions/setup-dotnet@v5
+ - name: Setup .NET 10 SDK
+ uses: actions/setup-dotnet@<full-commit-sha> # v5
with:
dotnet-version: 10.0.x#!/bin/bash
# Verify all workflows use SHA-pinned actions (no `@vN` or `@vN.N` tags).
rg -nP '^\s*uses:\s*[^@\s]+@v[0-9]+(\.[0-9]+)*\s*$' .github/workflows
# Expected after fix: no matchesAlso applies to: 98-102
🧰 Tools
🪛 zizmor (1.25.2)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 26 - 30, Replace the mutable tag for
the GitHub Action "actions/setup-dotnet@v5" with a full commit SHA (e.g.,
actions/setup-dotnet@<commit-sha>) in the workflow so the action is immutably
pinned; update both occurrences of that uses: entry and any other matching
"actions/setup-dotnet@v5", obtain the correct commit SHA from the
actions/setup-dotnet repository (or the exact released commit you trust) and
substitute it, then run a quick grep for any remaining uses: lines matching
uses: ...@vN or `@vN.N` and pin them similarly.
| - name: Setup .NET 10 SDK | ||
| uses: actions/setup-dotnet@v5 | ||
| with: | ||
| dotnet-version: 9.0.x | ||
| dotnet-version: 10.0.x |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/codeql.yml | head -40Repository: laurentiu021/SystemManager
Length of output: 1181
🏁 Script executed:
find .github/workflows -type f -name "*.yml" -o -name "*.yaml"Repository: laurentiu021/SystemManager
Length of output: 227
🏁 Script executed:
rg "uses:" .github/workflows/ -A 0 | head -30Repository: laurentiu021/SystemManager
Length of output: 1339
🏁 Script executed:
rg "@[a-z0-9.]+" .github/workflows/ --no-filename | sort | uniqRepository: laurentiu021/SystemManager
Length of output: 553
Pin actions/setup-dotnet to a full commit SHA.
Line 26 uses @v5 (mutable tag) instead of a commit digest, which breaks pinned-action hardening.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 25 - 28, The workflow currently
uses the mutable tag actions/setup-dotnet@v5; replace this with the action
pinned to a full commit SHA (use the repository reference
actions/setup-dotnet@<commit-sha>) so the runner uses an immutable digest; find
the step that names actions/setup-dotnet@v5 and update that reference while
keeping the existing with: dotnet-version: 10.0.x intact, ensuring you copy the
commit SHA from the actions/setup-dotnet repository release commit to fully pin
the action.
| - name: Setup .NET 10 SDK | ||
| uses: actions/setup-dotnet@v5 | ||
| with: | ||
| dotnet-version: 9.0.x | ||
| dotnet-version: 10.0.x |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's verify the exact content of the release.yml file at lines 29-32
cat -n .github/workflows/release.yml | sed -n '25,35p'Repository: laurentiu021/SystemManager
Length of output: 415
🏁 Script executed:
# Let's also check what other setup actions exist in this file and how they're pinned
rg 'uses:.*@' .github/workflows/release.yml -nRepository: laurentiu021/SystemManager
Length of output: 240
🏁 Script executed:
# Check for other workflow files and their action pinning patterns
fd -e yml -e yaml .github/workflows/ -x rg 'uses:.*setup-dotnet' -lRepository: laurentiu021/SystemManager
Length of output: 448
🏁 Script executed:
# Get a broader view of how GitHub actions are pinned across all workflows
rg 'uses:.*actions/' .github/workflows/ -n | head -30Repository: laurentiu021/SystemManager
Length of output: 943
Pin actions/setup-dotnet to a full commit SHA.
Line 30 uses a tag reference (@v5) instead of a pinned commit SHA, leaving the release pipeline exposed to mutable action references that could be silently updated or compromised.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 29 - 32, Replace the mutable tag
reference "actions/setup-dotnet@v5" with a pinned full commit SHA for the
actions/setup-dotnet action; update the "uses" line so the action is referenced
by its commit SHA (e.g., actions/setup-dotnet@<full-commit-sha>) while keeping
the existing "dotnet-version: 10.0.x" input unchanged to ensure the workflow
uses a fixed, auditable action version.
| ## Tech stack | ||
|
|
||
| - .NET 9 (WPF, C# 13) | ||
| - .NET 10 (WPF, C# 14) |
There was a problem hiding this comment.
Update the framework badge to avoid version drift in the same document.
Line 453 says .NET 10, but the badge near the top still displays .NET-9.0 (Line 18). Please update it so README has a single consistent framework version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 453, The README has inconsistent framework versions: the
top badge shows `.NET-9.0` while a later line reads `.NET 10 (WPF, C# 14)`;
update the badge text/value to match the document-wide target (.NET 10) so both
the badge string `.NET-9.0` and any badge image alt/title are changed to
`.NET-10` (or `.NET 10`) to keep the README consistent; locate and edit the
badge markup near the top (the `.NET-9.0` token) and ensure any other
occurrences of `.NET-9.0` in the file are updated to `.NET 10` to avoid version
drift.
BREAKING CHANGE: requires .NET 10 Desktop Runtime to run. Co-authored-by: laurentiu021 <laurentiu021@users.noreply.github.com>
1 participant
Summary
net9.0-windowstonet10.0-windowsci.yml,codeql.yml,release.yml) to use .NET 10 SDKPackage Compatibility
All packages verified compatible:
Test plan
Summary by CodeRabbit