Skip to content

feat!: migrate to .NET 10 (CRIT-001) #465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
laurentiu021 merged 1 commit into from
May 20, 2026
Merged

feat!: migrate to .NET 10 (CRIT-001) #465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@ jobs:
- name: Checkout
uses: actions/checkout@v6

- name: Setup .NET 9 SDK
- name: Setup .NET 10 SDK
uses: actions/setup-dotnet@v5
with:
dotnet-version: 9.0.x
dotnet-version: 10.0.x

Comment on lines +26 to 30

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin actions/setup-dotnet to a full commit SHA.

Line 27 and Line 99 use a mutable tag (@v5). That violates the pinned-action policy and weakens workflow supply-chain guarantees.

🔧 Proposed fix 
-      - name: Setup .NET 10 SDK
-        uses: actions/setup-dotnet@v5
+      - name: Setup .NET 10 SDK
+        uses: actions/setup-dotnet@<full-commit-sha> # v5
         with:
           dotnet-version: 10.0.x
...
-      - name: Setup .NET 10 SDK
-        uses: actions/setup-dotnet@v5
+      - name: Setup .NET 10 SDK
+        uses: actions/setup-dotnet@<full-commit-sha> # v5
         with:
           dotnet-version: 10.0.x
#!/bin/bash
# Verify all workflows use SHA-pinned actions (no `@vN` or `@vN.N` tags).
rg -nP '^\s*uses:\s*[^@\s]+@v[0-9]+(\.[0-9]+)*\s*$' .github/workflows
# Expected after fix: no matches

Also applies to: 98-102

🧰 Tools
🪛 zizmor (1.25.2)

[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 26 - 30, Replace the mutable tag for
the GitHub Action "actions/setup-dotnet@v5" with a full commit SHA (e.g.,
actions/setup-dotnet@<commit-sha>) in the workflow so the action is immutably
pinned; update both occurrences of that uses: entry and any other matching
"actions/setup-dotnet@v5", obtain the correct commit SHA from the
actions/setup-dotnet repository (or the exact released commit you trust) and
substitute it, then run a quick grep for any remaining uses: lines matching
uses: ...@vN or `@vN.N` and pin them similarly.

- name: Cache NuGet packages
uses: actions/cache@v5
Expand Down Expand Up @@ -95,10 +95,10 @@ jobs:
- name: Checkout
uses: actions/checkout@v6

- name: Setup .NET 9 SDK
- name: Setup .NET 10 SDK
uses: actions/setup-dotnet@v5
with:
dotnet-version: 9.0.x
dotnet-version: 10.0.x

- name: Restore
run: dotnet restore SysManager/SysManager.UITests/SysManager.UITests.csproj
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ jobs:
- name: Checkout
uses: actions/checkout@v6

- name: Setup .NET 9 SDK
- name: Setup .NET 10 SDK
uses: actions/setup-dotnet@v5
with:
dotnet-version: 9.0.x
dotnet-version: 10.0.x
Comment on lines +25 to +28

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/codeql.yml | head -40

Repository: laurentiu021/SystemManager

Length of output: 1181

🏁 Script executed:

find .github/workflows -type f -name "*.yml" -o -name "*.yaml"

Repository: laurentiu021/SystemManager

Length of output: 227

🏁 Script executed:

rg "uses:" .github/workflows/ -A 0 | head -30

Repository: laurentiu021/SystemManager

Length of output: 1339

🏁 Script executed:

rg "@[a-z0-9.]+" .github/workflows/ --no-filename | sort | uniq

Repository: laurentiu021/SystemManager

Length of output: 553

Pin actions/setup-dotnet to a full commit SHA.

Line 26 uses @v5 (mutable tag) instead of a commit digest, which breaks pinned-action hardening.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml around lines 25 - 28, The workflow currently
uses the mutable tag actions/setup-dotnet@v5; replace this with the action
pinned to a full commit SHA (use the repository reference
actions/setup-dotnet@<commit-sha>) so the runner uses an immutable digest; find
the step that names actions/setup-dotnet@v5 and update that reference while
keeping the existing with: dotnet-version: 10.0.x intact, ensuring you copy the
commit SHA from the actions/setup-dotnet repository release commit to fully pin
the action.


- name: Initialize CodeQL
uses: github/codeql-action/init@v4
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,10 @@ jobs:
with:
ref: ${{ inputs.tag || github.ref }}

- name: Setup .NET 9 SDK
- name: Setup .NET 10 SDK
uses: actions/setup-dotnet@v5
with:
dotnet-version: 9.0.x
dotnet-version: 10.0.x
Comment on lines +29 to +32

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, let's verify the exact content of the release.yml file at lines 29-32
cat -n .github/workflows/release.yml | sed -n '25,35p'

Repository: laurentiu021/SystemManager

Length of output: 415

🏁 Script executed:

# Let's also check what other setup actions exist in this file and how they're pinned
rg 'uses:.*@' .github/workflows/release.yml -n

Repository: laurentiu021/SystemManager

Length of output: 240

🏁 Script executed:

# Check for other workflow files and their action pinning patterns
fd -e yml -e yaml .github/workflows/ -x rg 'uses:.*setup-dotnet' -l

Repository: laurentiu021/SystemManager

Length of output: 448

🏁 Script executed:

# Get a broader view of how GitHub actions are pinned across all workflows
rg 'uses:.*actions/' .github/workflows/ -n | head -30

Repository: laurentiu021/SystemManager

Length of output: 943

Pin actions/setup-dotnet to a full commit SHA.

Line 30 uses a tag reference (@v5) instead of a pinned commit SHA, leaving the release pipeline exposed to mutable action references that could be silently updated or compromised.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 29 - 32, Replace the mutable tag
reference "actions/setup-dotnet@v5" with a pinned full commit SHA for the
actions/setup-dotnet action; update the "uses" line so the action is referenced
by its commit SHA (e.g., actions/setup-dotnet@<full-commit-sha>) while keeping
the existing "dotnet-version: 10.0.x" input unchanged to ensure the workflow
uses a fixed, auditable action version.


- name: Extract tag version
id: version
Expand Down
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Changed
- **BREAKING:** migrated from .NET 9 to .NET 10 — requires .NET 10 Desktop Runtime
to run. All projects (main, tests, integration tests, UI tests) now target
`net10.0-windows`. CI workflows updated to use .NET 10 SDK.

## [0.48.39] - 2026-05-20

### Fixed
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,7 +383,7 @@ recommended mitigation — see [SECURITY.md](SECURITY.md) for details.

## Build from source

Prerequisites: Windows 10 or newer and the [.NET 9 SDK](https://dotnet.microsoft.com/download/dotnet/9.0).
Prerequisites: Windows 10 or newer and the [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0).

```powershell
git clone https://github.com/laurentiu021/SystemManager.git
Expand Down Expand Up @@ -450,7 +450,7 @@ and elevation state in a format ready to paste into a bug report.

## Tech stack

- .NET 9 (WPF, C# 13)
- .NET 10 (WPF, C# 14)

@coderabbitai coderabbitai Bot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Update the framework badge to avoid version drift in the same document.

Line 453 says .NET 10, but the badge near the top still displays .NET-9.0 (Line 18). Please update it so README has a single consistent framework version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 453, The README has inconsistent framework versions: the
top badge shows `.NET-9.0` while a later line reads `.NET 10 (WPF, C# 14)`;
update the badge text/value to match the document-wide target (.NET 10) so both
the badge string `.NET-9.0` and any badge image alt/title are changed to
`.NET-10` (or `.NET 10`) to keep the README consistent; locate and edit the
badge markup near the top (the `.NET-9.0` token) and ensure any other
occurrences of `.NET-9.0` in the file are updated to `.NET 10` to avoid version
drift.

- CommunityToolkit.Mvvm for MVVM plumbing
- Microsoft.Extensions.DependencyInjection for IoC
- ModernWpfUI for the modern title bar
Expand Down
6 changes: 3 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@ older build, the first step is usually to update.

| Version | Supported |
| ------- | ------------------ |
| 0.48.x | :white_check_mark: |
| 0.47.x | :x: |
| < 0.47 | :x: |
| 0.49.x | :white_check_mark: |
| 0.48.x | :x: |
| < 0.48 | :x: |

## Reporting a vulnerability

Expand Down
2 changes: 1 addition & 1 deletion SysManager/SysManager.IntegrationTests/SysManager.IntegrationTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net9.0-windows</TargetFramework>
<TargetFramework>net10.0-windows</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<UseWPF>true</UseWPF>
Expand Down
2 changes: 1 addition & 1 deletion SysManager/SysManager.Tests/SysManager.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net9.0-windows</TargetFramework>
<TargetFramework>net10.0-windows</TargetFramework>
<UseWPF>true</UseWPF>

<IsPackable>false</IsPackable>
Expand Down
2 changes: 1 addition & 1 deletion SysManager/SysManager.UITests/SysManager.UITests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
<TargetFramework>net9.0-windows</TargetFramework>
<TargetFramework>net10.0-windows</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<UseWPF>true</UseWPF>
Expand Down
2 changes: 1 addition & 1 deletion SysManager/SysManager/SysManager.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

<PropertyGroup>
<OutputType>WinExe</OutputType>
<TargetFramework>net9.0-windows</TargetFramework>
<TargetFramework>net10.0-windows</TargetFramework>
<UseWPF>true</UseWPF>
<ApplicationManifest>app.manifest</ApplicationManifest>
<ApplicationIcon>Resources\app.ico</ApplicationIcon>
Expand Down
Loading