⭐ CI and Tooling

.github/workflows/* (checkout v4→v5, setup-dotnet v3/v4→v5, setup-node v4→v6, upload-artifact v4→v6, dotnet-quality: 'preview' dropped now that .NET 10 is GA) plus .github/dependabot.yml, extended to watch npm and github-actions ecosystems alongside the existing NuGet grouping. Already working as designed: Dependabot opened 4 real PRs against those exact action versions within hours of them landing, and now tracks Microsoft.Testing.Extensions.HtmlReport individually for exactly the same reason — see Testing.

Deliberately excluded, not overlooked — Microsoft-internal and non-functional outside their org: root ci.yml (an internal Azure DevOps pipeline referencing an internal-only agent pool), .config/CredScanSuppressions.json/.config/tsaoptions.json (internal security-scan config), .devcenter/imagedefinition.yaml (literal placeholder text, broken even upstream), es-metadata.yml (internal DevOps routing metadata).

Every workflow is green — by tolerating gaps honestly, not by hiding them. eShop.slnx/eShop.Web.slnf originally listed all 19 upstream projects while only 1 existed on disk — that failed every build/test workflow and GitHub's own auto-injected dependency-submission check. Fixed by trimming the solution files to only the projects that actually exist, adding each one the moment it lands. The MAUI build and Playwright e2e workflows don't just sit red waiting for ClientApp/eShop.AppHost either — the specific steps that structurally can't pass yet are commented out with the exact re-enable trigger documented in todo.md's "Still to do" table, while every step that can still catch a real regression (workload installs, corepack setup, dev-cert handling) keeps running. CodeQL was also upgraded from GitHub's Default build-mode: none setup (flagged for low C# analysis quality — can't resolve NuGet types without a real build) to an Advanced setup that runs dotnet build first.

pr-validation.yml's Test step also collects code coverage and publishes TRX results via dorny/test-reporter now that a real test project exists — see Testing for why the coverage/reporting flags needed real verification, not assumption, against .NET's newer testing runner.

Local safety net, added 2026-08-20: a Claude Code PreToolUse hook (.claude/settings.json + .claude/hooks/pre-commit-build-check.js, committed to the repo) runs dotnet build eShop.Web.slnf before every git commit and blocks it on failure — a direct response to a project scaffold getting committed before it could actually compile. Filtering had to move inside the script itself rather than using the documented if hook filter, which never fired even with the exact pattern from Claude Code's own docs.