Skip to content

Pin .NET SDK floor to 10.0.204 via global.json#534

Merged
NikTilton merged 1 commit into
mainfrom
jschick/sfi-dotnet-sdk-bump
May 19, 2026
Merged

Pin .NET SDK floor to 10.0.204 via global.json#534
NikTilton merged 1 commit into
mainfrom
jschick/sfi-dotnet-sdk-bump

Conversation

@jschick04
Copy link
Copy Markdown
Collaborator

Why

SFI alert flagged that EventLogExpert ships a self-contained .NET application with an unpinned runtime version. The runtime baked into the published MSIX / EXE is whatever the active .NET SDK provides, and the repo had no global.json to enforce a secure minimum (the only build pipeline floated SDK via dotnet-version: 10.x). Alert recommendation: pin SDK floor to ≥ 10.0.204.

What

  • Add global.json at repo root pinning SDK floor to 10.0.204 with rollForward: latestFeature. This enforces the SFI floor on every build (local dev, PR CI, downstream release pipeline) while allowing newer 10.0.x patches without manual bumps and without silently jumping to .NET 11.
  • Update .github/workflows/PullRequest.yml to source the SDK from global.json (global-json-file: global.json) instead of the floating dotnet-version: 10.x.

The downstream Azure DevOps release pipeline will be updated in a separate PR to consume the same global.json.

Verification

  • Locally: dotnet --info confirms global.json is detected at repo root and resolves to SDK 10.0.300 (satisfies the 10.0.204 floor via latestFeature).
  • dotnet build EventLogExpert.slnx -c Release succeeds (41s, 0 warnings, 0 errors).
  • All 2,175 unit tests pass: EventDbTool (8), Eventing (288), Filtering (869), Runtime (860), UI (150).

@jschick04 jschick04 requested a review from a team as a code owner May 19, 2026 21:43
Copilot AI review requested due to automatic review settings May 19, 2026 21:43
@NikTilton NikTilton merged commit dce00c9 into main May 19, 2026
6 of 7 checks passed
@NikTilton NikTilton deleted the jschick/sfi-dotnet-sdk-bump branch May 19, 2026 21:51
@jschick04 jschick04 review requested due to automatic review settings May 19, 2026 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants