build: pin SDK 10.0.401, the version the committed lock files require #8

Merged
forge-recovery merged 1 commits from ci/sdk-pin-matches-locks into main 2026-11-01 23:27:45 +00:00
Owner

One-line change: global.json SDK 10.0.100 -> 10.0.401.

Why (existing build blocked)

The committed packages.lock.json files require Microsoft.NET.ILLink.Tasks 10.0.12, which is what SDK 10.0.401 resolves. The pin said 10.0.100, so the
existing dotnet restore Kof22App.slnx -p:Platform=x64 --locked-mode step fails with NU1004 under exactly 10.0.100 and under a newer 10.0.4xx (the native
Windows runner has 10.0.403). rollForward: latestFeature hid this on GitHub's windows-latest image. No other file in the repo carries the pin.
Same fix as KofTwentyTwo/MarkdownViewr.Windows#44.

Verified (real run, Windows host, central engine script dotnet-verify.ps1, exact SDK 10.0.401)

  • locked restore, -warnaserror build, dotnet format --verify-no-changes (WinUI app project built first via the existing format-projects input)
  • Kof22App.Core.Tests: 20 passed of 20, 0 skipped; Kof22App.Cli.Tests: 14 passed of 14, 0 skipped
  • line coverage: Kof22App.Core 100%, kof22-app 100%
  • legacy Node job commands (scripts.yml): npm ci --ignore-scripts, npm run lint, npm test (7 of 7, 0 skipped), npm audit signatures all pass

Not covered by that run (unchanged, not hidden)

UiTests and UpdateProbe (interactive desktop), the installed-updates job (Velopack vpk 1.2.161), the template job (pack, install, instantiate and smoke test
the template), and the powershell job in scripts.yml.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

One-line change: `global.json` SDK `10.0.100` -> `10.0.401`. ## Why (existing build blocked) The committed `packages.lock.json` files require `Microsoft.NET.ILLink.Tasks` 10.0.12, which is what SDK 10.0.401 resolves. The pin said 10.0.100, so the existing `dotnet restore Kof22App.slnx -p:Platform=x64 --locked-mode` step fails with NU1004 under exactly 10.0.100 and under a newer 10.0.4xx (the native Windows runner has 10.0.403). `rollForward: latestFeature` hid this on GitHub's `windows-latest` image. No other file in the repo carries the pin. Same fix as KofTwentyTwo/MarkdownViewr.Windows#44. ## Verified (real run, Windows host, central engine script `dotnet-verify.ps1`, exact SDK 10.0.401) - locked restore, `-warnaserror` build, `dotnet format --verify-no-changes` (WinUI app project built first via the existing `format-projects` input) - `Kof22App.Core.Tests`: 20 passed of 20, 0 skipped; `Kof22App.Cli.Tests`: 14 passed of 14, 0 skipped - line coverage: `Kof22App.Core` 100%, `kof22-app` 100% - legacy Node job commands (`scripts.yml`): `npm ci --ignore-scripts`, `npm run lint`, `npm test` (7 of 7, 0 skipped), `npm audit signatures` all pass ## Not covered by that run (unchanged, not hidden) UiTests and `UpdateProbe` (interactive desktop), the `installed-updates` job (Velopack vpk 1.2.161), the `template` job (pack, install, instantiate and smoke test the template), and the `powershell` job in `scripts.yml`. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
forge-recovery added 1 commit 2026-11-01 22:46:42 +00:00
build: pin the SDK that the committed lock files were generated with
KofTwentyTwo/ci-policy: ci / fork-guard (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / go-0 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / go-nix-1 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / gradle-2 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / gradle-3 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / java-docker-4 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / java-maven-5 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / manifests-6 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / nix-7 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / node-8 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / python-9 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / rust-10 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / rust-11 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / rust-12 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-0 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-1 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-2 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-3 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-4 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-5 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-6 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / image-build-7 (pull_request) Skipped
KofTwentyTwo/ci-policy: ci / not-enrolled (pull_request) Skipped
KofTwentyTwo/ci-policy: native / fork-deny (pull_request) Skipped
KofTwentyTwo/ci-policy: native / dotnet-1 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / dotnet-2 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / dotnet-3 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / swift-4 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / swift-5 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / swift-6 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / swift-7 (pull_request) Skipped
KofTwentyTwo/ci-policy: native / swift-8 (pull_request) Skipped
KofTwentyTwo/ci-policy: Shared source and config CI / verify (pull_request) Successful in 20s
KofTwentyTwo/ci-policy: Shared source and config CI / secrets (pull_request) Successful in 19s
KofTwentyTwo/ci-policy: Shared .NET CI / secrets (pull_request) Successful in 18s
KofTwentyTwo/ci-policy: Shared source and config CI / gate (pull_request) Successful in 17s
KofTwentyTwo/ci-policy: ci / source-config-13 (pull_request) Successful in 41s
KofTwentyTwo/ci-policy: ci / ci-result (pull_request) Successful in 9s
KofTwentyTwo/ci-policy: Shared .NET CI / verify (pull_request) Successful in 1m6s
KofTwentyTwo/ci-policy: Shared .NET CI / gate (pull_request) Successful in 15s
KofTwentyTwo/ci-policy: native / dotnet-0 (pull_request) Successful in 1m27s
KofTwentyTwo/ci-policy: native / native-result (pull_request) Successful in 7s
935b7be1c6
global.json pinned 10.0.100, but every packages.lock.json requires Microsoft.NET.ILLink.Tasks 10.0.12 (what SDK 10.0.401 resolves). Under exactly 10.0.100, or under a newer 10.0.4xx such as 10.0.403, locked restore fails NU1004 ('package reference ... has changed from [10.0.12, ) to ...'). rollForward latestFeature hid this on GitHub's windows-latest runner image. Pinning 10.0.401 makes the existing restore --locked-mode, build, format and test steps reproducible; no other file or setting changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
forge-recovery closed this pull request 2026-11-01 22:58:50 +00:00
forge-recovery reopened this pull request 2026-11-01 22:58:50 +00:00
forge-recovery merged commit 60f8c6856a into main 2026-11-01 23:27:45 +00:00
Sign in to join this conversation.