CI CD

CI/CD

Three GitHub Actions workflows, plus Dependabot. All use least-privilege permissions, and every job that builds C# sets up the same pinned toolchain via jdx/mise-action, so CI matches local builds exactly.

ci.yml — build & test

• Triggers: push and pull_request to main.
• Permissions: contents: read. Concurrency-cancels superseded runs per ref.
• Steps (windows-latest): checkout → mise setup → just build → just test.
• The quality gate: just build is a Debug build, and Directory.Build.props makes Debug treat warnings as errors. So every analyzer and code-style warning is a hard CI failure. See Building & Tasks.

codeql.yml — security analysis

• Triggers: push to main and a weekly schedule (cron: '24 6 * * 1', Mondays 06:24 UTC). PRs are intentionally left to ci.yml to avoid double load.
• Matrix:
  • csharp — build-mode: manual on windows-latest, compiled with just build (the same mise .NET 10). This is the important bit: C# here targets a net*-windows TFM, which can't restore on Ubuntu / buildless, producing an empty database. Tracing a real Windows build yields a complete C# database (this is why the project moved to an advanced/manual setup).
  • actions — build-mode: none on ubuntu-latest (workflow analysis needs no build).
• Permissions: read-only except security-events: write for uploading results.

dependabot.yml — dependency updates

Two ecosystems, both weekly, up to 10 open PRs each:

Ecosystem	Covers	Commit prefix
nuget	WindowsAppSDK, CommunityToolkit, CsWin32, xunit, coverlet, …	chore(deps)
github-actions	checkout, mise-action, action-gh-release, …	chore(ci)

Dependabot PRs run through ci.yml (and merge under the same protected-main rules as any other PR — see Contributing).

Release

Release packaging is a separate, tag-driven workflow — see Release Process.

---

Related: Building & Tasks · Release Process · Contributing