erenken · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "gitversion.tool": {
+      "version": "6.8.2",
+      "commands": ["dotnet-gitversion"]
+    },
+    "sourcelink": {
+      "version": "3.1.1",
+      "commands": ["sourcelink"]
+    }
+  }
+}
diff --git a/.gitattributes b/.gitattributes
@@ -61,3 +61,9 @@
 #*.PDF   diff=astextplain
 #*.rtf   diff=astextplain
 #*.RTF   diff=astextplain
+
+*.yml text eol=lf
+*.json text eol=lf
+*.props text eol=lf
+*.ps1 text eol=lf
+*.md text eol=lf
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      test-tooling:
+        patterns: [Microsoft.NET.Test.Sdk, MSTest.*, coverlet.collector, NSubstitute]
+    ignore:
+      - dependency-name: Microsoft.EntityFrameworkCore*
+        update-types: [version-update:semver-major]
+      - dependency-name: Microsoft.Extensions.*
+        update-types: [version-update:semver-major]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/build-tests.yml b/.github/workflows/build-tests.yml
@@ -2,35 +2,112 @@ name: Build and Test
 
 on:
   pull_request:
-    branches:
-      - main
+    branches: [main]
+  push:
+    branches-ignore: [main]
+  workflow_call:
+    outputs:
+      version:
+        value: ${{ jobs.build-test.outputs.version }}
+      sha:
+        value: ${{ jobs.build-test.outputs.sha }}
+      artifact-name:
+        value: ${{ jobs.build-test.outputs.artifact-name }}
+
+permissions:
+  contents: read
 
 jobs:
+  workflow-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - name: Validate workflow syntax and shell scripts
+        shell: bash
+        run: |
+          set -euo pipefail
+          tool_dir="$RUNNER_TEMP/actionlint"
+          mkdir -p "$tool_dir"
+          cd "$tool_dir"
+          base=https://github.com/rhysd/actionlint/releases/download/v1.7.12
+          curl -fsSLO "$base/actionlint_1.7.12_linux_amd64.tar.gz"
+          curl -fsSLO "$base/actionlint_1.7.12_checksums.txt"
+          sha256sum --check --ignore-missing actionlint_1.7.12_checksums.txt
+          tar -xzf actionlint_1.7.12_linux_amd64.tar.gz
+          cd "$GITHUB_WORKSPACE"
+          "$tool_dir/actionlint"
+          git diff --check
   build-test:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      sha: ${{ steps.version.outputs.sha }}
+      artifact-name: ${{ steps.version.outputs.artifact-name }}
+    env:
+      VersionPropsFile: ${{ github.workspace }}/artifacts/Version.props
+      DOTNET_NOLOGO: true
+      DOTNET_CLI_TELEMETRY_OPTOUT: true
     steps:
-    - uses: actions/checkout@v2
-
-    - name: Setup .NET Core 8
-      uses: actions/setup-dotnet@v1
-      with:
-        dotnet-version: 8.x
-
-    - name: Setup .NET Core 9
-      uses: actions/setup-dotnet@v1
-      with:
-        dotnet-version: 9.x
-
-    - name: Install dependencies
-      run: dotnet restore
-
-    - name: Build
-      run: dotnet build --no-restore
-
-    - name: Test
-      run: dotnet test --no-restore --verbosity normal --logger trx --collect:"XPlat Code Coverage" --no-build
-
-    - name: Test Pack nuget
-      run: |
-         dotnet pack --no-build --no-restore --include-symbols --verbosity normal --configuration Debug
-
+      - uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/[email protected]
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.401
+      - name: Restore validation tools
+        run: dotnet tool restore
+      - name: Validate version scenarios
+        shell: pwsh
+        run: ./scripts/Test-Versioning.ps1
+      - name: Calculate and stamp versions
+        id: version
+        shell: pwsh
+        run: ./scripts/Set-BuildVersion.ps1 -RequireStable:($env:GITHUB_REF -eq 'refs/heads/main')
+      - name: Restore (warnings are errors)
+        run: dotnet restore -warnaserror
+      - name: Build every framework (warnings are errors)
+        run: dotnet build --configuration Release --no-restore -warnaserror
+      - name: Test every framework and collect coverage
+        run: dotnet test --configuration Release --no-build --no-restore --logger trx --collect:"XPlat Code Coverage" --results-directory artifacts/test-results
+      - name: Upload test results and coverage
+        if: always()
+        uses: actions/[email protected]
+        with:
+          name: test-results-${{ github.run_id }}-${{ github.run_attempt }}
+          path: artifacts/test-results
+          if-no-files-found: error
+      - name: Pack (warnings are errors)
+        run: dotnet pack src/myNOC.EntityFramework.Query --configuration Release --no-build --no-restore -warnaserror --output artifacts/packages
+      - name: Validate packaged Source Link, symbols and versions
+        shell: pwsh
+        env:
+          PACKAGE_VERSION: ${{ steps.version.outputs.version }}
+          BUILD_COMMIT: ${{ steps.version.outputs.sha }}
+        run: ./scripts/Test-Packages.ps1 -Version $env:PACKAGE_VERSION -Commit $env:BUILD_COMMIT
+      - name: Audit dependencies
+        run: |
+          dotnet list package --vulnerable --include-transitive --format json > artifacts/vulnerabilities.json
+          dotnet list package --outdated --include-transitive --format json > artifacts/outdated.json
+      - name: Reject known vulnerabilities
+        shell: pwsh
+        run: |
+          $report = Get-Content artifacts/vulnerabilities.json -Raw | ConvertFrom-Json
+          $packages = @($report.projects.frameworks.topLevelPackages) + @($report.projects.frameworks.transitivePackages)
+          if (@($packages | Where-Object { $_.vulnerabilities.Count -gt 0 }).Count -gt 0) { throw 'Known vulnerable dependencies found.' }
+      - name: Upload dependency reports
+        uses: actions/[email protected]
+        with:
+          name: dependency-reports-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            artifacts/vulnerabilities.json
+            artifacts/outdated.json
+          if-no-files-found: error
+      - name: Upload validated packages
+        uses: actions/[email protected]
+        with:
+          name: packages-${{ github.run_id }}-${{ github.run_attempt }}
+          path: artifacts/packages/*
+          if-no-files-found: error
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -2,59 +2,81 @@ name: Release
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-main
+  cancel-in-progress: false
 
 jobs:
-  release:
+  validate:
+    if: github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/build-tests.yml
+  publish:
+    needs: validate
     runs-on: ubuntu-latest
+    environment: nuget
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      PACKAGE_VERSION: ${{ needs.validate.outputs.version }}
+      BUILD_COMMIT: ${{ needs.validate.outputs.sha }}
     steps:
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-
-    - name: Install GitVersion
-      uses: gittools/actions/gitversion/[email protected]
-      with:
-        versionSpec: '5.x'
-
-    - name: Determine Version
-      id: gitversion
-      uses: gittools/actions/gitversion/[email protected]
-      with:
-        useConfigFile: true        
-
-    - name: Setup .NET Core 8
-      uses: actions/setup-dotnet@v1
-      with:
-        dotnet-version: 8.x
-
-    - name: Setup .NET Core 9
-      uses: actions/setup-dotnet@v1
-      with:
-        dotnet-version: 9.x
-
-    - name: Install dependencies
-      run: dotnet restore
-
-    - name: Build
-      run: |
-        dotnet build ./src/myNOC.EntityFramework.Query/myNOC.EntityFramework.Query.csproj --configuration Release --no-restore /p:Version="${{ steps.gitversion.outputs.assemblySemVer }}" /p:AssemblyVersion="${{ steps.gitversion.outputs.assemblySemVer }}" /p:FileVersion="${{ steps.gitversion.outputs.assemblySemFileVer }}" /p:InformationalVersion="${{ steps.gitversion.outputs.informationalVersion }}" /p:PackageVersion="${{ steps.gitversion.outputs.nuGetVersion }}" /p:ContinuousIntegrationBuild=true
-
-    - name: Pack nuget
-      run: |
-         dotnet pack ./src/myNOC.EntityFramework.Query/myNOC.EntityFramework.Query.csproj --configuration Release --no-build --no-restore --include-symbols --output ./.pack --verbosity normal -p:PackageVersion="${{ steps.gitversion.outputs.nuGetVersion }}"
-
-    - name: Nuget Push
-      run: |
-         dotnet nuget push "**/*.nupkg" --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_PUBLISH }} --skip-duplicate
-
-    - name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: v${{ steps.gitversion.outputs.nuGetVersion }}
-        release_name: v${{ steps.gitversion.outputs.nuGetVersion }}
-        draft: false
-        prerelease: true
+      - uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.validate.outputs.sha }}
+      - uses: actions/[email protected]
+        with:
+          dotnet-version: 10.0.401
+      - uses: actions/[email protected]
+        with:
+          name: ${{ needs.validate.outputs.artifact-name }}
+          path: artifacts/packages
+      - name: Guard stable version and immutable tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$GITHUB_REF" == refs/heads/main ]]
+          [[ "$PACKAGE_VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          tag="v$PACKAGE_VERSION"
+          if git show-ref --verify --quiet "refs/tags/$tag"; then
+            [[ "$(git rev-list -n 1 "$tag")" == "$BUILD_COMMIT" ]]
+          fi
+      - name: Verify existing package provenance before duplicate skipping
+        shell: pwsh
+        run: ./scripts/Test-PublishedPackage.ps1 -Version $env:PACKAGE_VERSION -Commit $env:BUILD_COMMIT -AllowMissing
+      - name: Authenticate to NuGet using GitHub OIDC
+        uses: NuGet/[email protected]
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - name: Publish package and symbols (safe to rerun)
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          dotnet nuget push "artifacts/packages/*.nupkg" --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY" --no-symbols --skip-duplicate
+          dotnet nuget push "artifacts/packages/*.snupkg" --source https://api.nuget.org/v3/index.json --api-key "$NUGET_API_KEY" --skip-duplicate
+      - name: Verify published package matches this commit
+        shell: pwsh
+        run: ./scripts/Test-PublishedPackage.ps1 -Version $env:PACKAGE_VERSION -Commit $env:BUILD_COMMIT -Attempts 60
+      - name: Create matching stable GitHub release and tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag="v$PACKAGE_VERSION"
+          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release edit "$tag" --repo "$GITHUB_REPOSITORY" --draft=false --prerelease=false
+          else
+            gh release create "$tag" --repo "$GITHUB_REPOSITORY" --target "$BUILD_COMMIT" --title "$tag" --generate-notes --draft=false --prerelease=false
+          fi
+          gh release upload "$tag" artifacts/packages/* --repo "$GITHUB_REPOSITORY" --clobber
diff --git a/.gitignore b/.gitignore
@@ -348,3 +348,11 @@ MigrationBackup/
 
 # Ionide (cross platform F# VS Code tools) working folder
 .ionide/
+
+# Local validation tools, reports, and package output
+.tools/
+.validation/
+.pack/
+artifacts/
+*.nupkg
+*.snupkg
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -0,0 +1,21 @@
+<Project>
+  <PropertyGroup>
+    <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
+    <LangVersion>14.0</LangVersion>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <NuGetAudit>true</NuGetAudit>
+    <NuGetAuditMode>all</NuGetAuditMode>
+    <IsPackable>false</IsPackable>
+    <DebugType>portable</DebugType>
+    <DebugSymbols>true</DebugSymbols>
+    <Deterministic>true</Deterministic>
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
+    <EntityFrameworkVersion Condition="'$(TargetFramework)' == 'net8.0'">8.0.31</EntityFrameworkVersion>
+    <EntityFrameworkVersion Condition="'$(TargetFramework)' == 'net10.0'">10.0.12</EntityFrameworkVersion>
+    <DependencyInjectionVersion Condition="'$(TargetFramework)' == 'net8.0'">8.0.1</DependencyInjectionVersion>
+    <DependencyInjectionVersion Condition="'$(TargetFramework)' == 'net10.0'">10.0.12</DependencyInjectionVersion>
+  </PropertyGroup>
+  <Import Project="$(VersionPropsFile)" Condition="'$(VersionPropsFile)' != '' and Exists('$(VersionPropsFile)')" />
+</Project>