[solrevdev]

Refs #3, covering the "CI" and "Packaging" items under its "Smaller issues". This PR is independent of the #8 → #12 stack and is based on master.

Changes

• Actions are pinned to commit SHAs with version comments, which addresses tag hijacking. The pins stay on the current majors: checkout v5.1.0, setup-dotnet v5.4.0 and NuGet/login v1.2.0. Dependabot can propose v6/v7 separately.
• Dependabot checks GitHub Actions and NuGet weekly, and groups the updates.
• CodeQL runs on PRs touching src/** and weekly. It uses build-mode: none, so it needs no SDK or build.
• Tests run on net8.0, net9.0 and net10.0. CI already installs all three SDKs.
• Package changes:
  • Adds an icon, assets/icon.svg, rendered to a 128px PNG. It shows JSON brackets around a play triangle, kept clear of YouTube's red-and-white branding.
  • Adds a .snupkg symbols package. dotnet nuget push uploads it alongside the .nupkg.
  • Sets PublishRepositoryUrl, and sets ContinuousIntegrationBuild on GitHub Actions for deterministic SourceLink.
• CHANGELOG.md in Keep a Changelog format, filled in back to 1.0.1.

Not changed

• The direct push to master in the publish job. A branch protection rule would break it. Fixing this needs a GitHub App or a PAT with bypass rights, or a release-PR flow, so the decision is yours.
• CI on pushes that don't release. PR validation already covers tests and docs. The master push trigger stays limited to release paths, so test-only pushes don't publish.

Verification

• actionlint and YAML parsing pass.
• dotnet pack produces both .nupkg and .snupkg. The nuspec has <icon> and <repository ... commit=...>.
• Tests pass on net8.0 and net10.0 locally. This machine has no .NET 9 runtime, but CI installs it.

Merging publishes a NuGet patch, because src/Ytx/Ytx.csproj changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.