james.maesandClaude Opus 5.5
839fb72bec
## What Brings AppKit into conformance with [KofTwentyTwo/standards](https://github.com/KofTwentyTwo/standards). Reviewable commit by commit: | Commit | Change | | --- | --- | | build | Quality gate from `configs/dotnet` (analyzers incl. Meziantou, warnings as errors), `packages.lock.json` per project, locked-mode restore | | style | Kingsrook layout and LF line endings, produced mechanically by `dotnet format` (formatting only) | | docs | SPDX license header on every C# file | | refactor | Real code changes: analyzer findings fixed (one type per file, regex timeouts, async void, …) and header comments on every type and member | | ci | Old workflows replaced by callers of the shared standards workflows (PR gates, security, CodeQL, .NET CI, NuGet release with SBOM + attestation + trusted publishing), Scorecard | | docs | README, CONTRIBUTING (GitHub Flow, DCO, signing), SECURITY, CODEOWNERS, templates, Dependabot, threat model, ADRs, RELEASING | Also includes `dev`'s CI fix, so it supersedes #1; the `dev` branch goes away under GitHub Flow. ## Why AppKit is the first Product repository to adopt the standards. Static conformance before: 16 FAIL; after: 0 FAIL, 0 WARN (the remaining UNKNOWN rows are GitHub settings and rulesets, applied separately). ## How tested Locally with `CI=true` (lock files enforced): locked restore x64 and ARM64; zero-warning x64 build; 115 unit tests with 100% line coverage of `KofTwentyTwo.AppKit` and `KofTwentyTwo.AppKit.Updates`; 12 FlaUI UI tests (WinUI + WPF samples); `dotnet format --verify-no-changes --severity warn` clean; pack produces 4 packages + symbols; actionlint, zizmor (pedantic), gitleaks clean. The UI tests caught a regression introduced while fixing MA0147 (the WPF splash stopped dismissing because no UI context existed yet); fixed by starting the countdown through the dispatcher in both packages. ## Notes - `ci.yml` and `release.yml` are pinned to KofTwentyTwo/standards#3's head commit; they are repinned after that PR merges. - This pull request's new check names become required checks once the repository's rulesets are updated. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: James Maes <james@kof22.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
82 lines
3.0 KiB
YAML
82 lines
3.0 KiB
YAML
# NuGet package release for a KofTwentyTwo repository (K22-CI-30, K22-REL-*).
|
|
# Copy to .github/workflows/release.yml. Pushing a protected v* tag builds, tests,
|
|
# packs, generates SBOMs, attests, and publishes the GitHub release through the shared
|
|
# reusable workflow, then pushes the packages to nuget.org.
|
|
#
|
|
# nuget.org trusted publishing (one-time owner setup, no API key stored anywhere):
|
|
# nuget.org → your profile → Trusted Publishing → Add policy:
|
|
# Repository Owner: KofTwentyTwo
|
|
# Repository: AppKit
|
|
# Workflow File: release.yml (THIS file's name, not the reusable workflow's)
|
|
# Environment: release
|
|
# then set the repository variable NUGET_USER to your nuget.org profile name.
|
|
# The publish job must stay in this file: nuget.org checks that the OIDC token's
|
|
# job_workflow_ref belongs to this repository, which a job inside the reusable
|
|
# workflow (in KofTwentyTwo/standards) can never satisfy.
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions: {}
|
|
|
|
# One release at a time, and never cancel one halfway through publishing.
|
|
concurrency:
|
|
group: release
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
release:
|
|
uses: KofTwentyTwo/standards/.github/workflows/release-nuget.yml@ae3df7af77e5a97df231a9f53be9d8ed785ddce5 # main (pre-release)
|
|
permissions:
|
|
contents: write # create and publish the GitHub release
|
|
id-token: write # sign attestations
|
|
attestations: write # store attestations
|
|
with:
|
|
solution: AppKit.slnx
|
|
platform: x64
|
|
coverage-packages: KofTwentyTwo.AppKit,KofTwentyTwo.AppKit.Updates
|
|
test-projects: |
|
|
tests/KofTwentyTwo.AppKit.Tests
|
|
|
|
publish:
|
|
name: publish (nuget.org)
|
|
needs: release
|
|
if: vars.NUGET_USER != ''
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 15
|
|
environment: release
|
|
permissions:
|
|
contents: read
|
|
attestations: read # verify the attestations before pushing
|
|
id-token: write # trusted publishing token exchange
|
|
steps:
|
|
- name: Download packages
|
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: packages
|
|
path: packages
|
|
|
|
# Push only bytes that the shared release workflow built and attested.
|
|
- name: Verify attestations
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
for package in packages/*.nupkg; do
|
|
gh attestation verify "$package" --repo "$REPOSITORY" --signer-repo KofTwentyTwo/standards
|
|
done
|
|
|
|
- name: NuGet login (OIDC to a one-hour API key)
|
|
id: login
|
|
uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
|
|
with:
|
|
user: ${{ vars.NUGET_USER }}
|
|
|
|
- name: Push to nuget.org
|
|
env:
|
|
NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
|
|
run: dotnet nuget push "packages/*.nupkg" --api-key "$NUGET_API_KEY" --source https://api.nuget.org/v3/index.json --skip-duplicate
|