⭐ CI and Tooling

.github/workflows/* (checkout v4→v5, setup-dotnet v3/v4→v5, setup-node v4→v6, upload-artifact v4→v6, dotnet-quality: 'preview' dropped now that .NET 10 is GA) plus .github/dependabot.yml, extended to watch npm and github-actions ecosystems alongside the existing NuGet grouping. Already working as designed: Dependabot opened 4 real PRs against those exact action versions within hours of them landing.

Deliberately excluded, not overlooked — Microsoft-internal and non-functional outside their org: root ci.yml (an internal Azure DevOps pipeline referencing an internal-only agent pool), .config/CredScanSuppressions.json/.config/tsaoptions.json (internal security-scan config), .devcenter/imagedefinition.yaml (literal placeholder text, broken even upstream), es-metadata.yml (internal DevOps routing metadata).

The red CI checks right now are honest signals, not bugs. eShop.slnx/eShop.Web.slnf originally listed all 19 projects upfront while only 1 existed on disk — that failed every build/test workflow and GitHub's own auto-injected dependency-submission check. Fixed by trimming the solution files to only the projects that actually exist, adding each one the moment it lands — a practice decided to keep going forward rather than list everything upfront again. With that fixed, PR validation/CodeQL/dependency-submission are all green; the MAUI build and Playwright e2e workflows stay red correctly, since ClientApp and eShop.AppHost (which each depends on) don't exist yet. They'll go green naturally once those projects land, not from a config change.