james.maesandClaude Opus 5.5
839fb72bec
## What Brings AppKit into conformance with [KofTwentyTwo/standards](https://github.com/KofTwentyTwo/standards). Reviewable commit by commit: | Commit | Change | | --- | --- | | build | Quality gate from `configs/dotnet` (analyzers incl. Meziantou, warnings as errors), `packages.lock.json` per project, locked-mode restore | | style | Kingsrook layout and LF line endings, produced mechanically by `dotnet format` (formatting only) | | docs | SPDX license header on every C# file | | refactor | Real code changes: analyzer findings fixed (one type per file, regex timeouts, async void, …) and header comments on every type and member | | ci | Old workflows replaced by callers of the shared standards workflows (PR gates, security, CodeQL, .NET CI, NuGet release with SBOM + attestation + trusted publishing), Scorecard | | docs | README, CONTRIBUTING (GitHub Flow, DCO, signing), SECURITY, CODEOWNERS, templates, Dependabot, threat model, ADRs, RELEASING | Also includes `dev`'s CI fix, so it supersedes #1; the `dev` branch goes away under GitHub Flow. ## Why AppKit is the first Product repository to adopt the standards. Static conformance before: 16 FAIL; after: 0 FAIL, 0 WARN (the remaining UNKNOWN rows are GitHub settings and rulesets, applied separately). ## How tested Locally with `CI=true` (lock files enforced): locked restore x64 and ARM64; zero-warning x64 build; 115 unit tests with 100% line coverage of `KofTwentyTwo.AppKit` and `KofTwentyTwo.AppKit.Updates`; 12 FlaUI UI tests (WinUI + WPF samples); `dotnet format --verify-no-changes --severity warn` clean; pack produces 4 packages + symbols; actionlint, zizmor (pedantic), gitleaks clean. The UI tests caught a regression introduced while fixing MA0147 (the WPF splash stopped dismissing because no UI context existed yet); fixed by starting the countdown through the dispatcher in both packages. ## Notes - `ci.yml` and `release.yml` are pinned to KofTwentyTwo/standards#3's head commit; they are repinned after that PR merges. - This pull request's new check names become required checks once the repository's rulesets are updated. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.1 KiB
YAML
38 lines
1.1 KiB
YAML
# Dependabot for a KofTwentyTwo repository: copy to .github/dependabot.yml and keep
|
|
# the ecosystems the repository uses. Updates are grouped weekly. A 7-day cooldown
|
|
# lets the community catch a compromised release before it reaches us; security
|
|
# updates are not delayed by the cooldown.
|
|
version: 2
|
|
updates:
|
|
# Always: keeps SHA-pinned actions and reusable workflows current (K22-CI-11).
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
commit-message:
|
|
prefix: ci
|
|
|
|
# .NET: NuGet, including Directory.Packages.props and packages.lock.json.
|
|
- package-ecosystem: nuget
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
day: monday
|
|
cooldown:
|
|
default-days: 7
|
|
semver-major-days: 14
|
|
groups:
|
|
minor-and-patch:
|
|
update-types: [minor, patch]
|
|
commit-message:
|
|
prefix: build
|
|
|
|
# Other ecosystems (npm, pip/uv, cargo, gomod, swift, maven, gradle, terraform,
|
|
# docker): copy the block above and change package-ecosystem and directory.
|