Adding Microsoft SECURITY.MD#3
Merged
parthopdas merged 1 commit intoJul 26, 2026
Merged
Conversation
parthopdas
added a commit
that referenced
this pull request
Jul 26, 2026
Faithful port of crap4java SourceFileFinder: resolve projectRoot/src, empty on
missing, recursive walk, EndsWith(".cs") not a glob (mirrors Java endsWith,
dodges Windows 8.3 quirk), absolute paths. Two approved C# adaptations per the
T7 plan: ordinal sort (StringComparer.Ordinal) for cross-OS determinism, and
segment-exact bin/obj build-output exclusion (any depth; keeps Robin lookalike).
5 tests: faithful port + missing-src + bin/obj-exclusion + ordinal-order +
only-.cs. 21/21 green, 0/0 Release.
Design docs (Anders): decisions.md departure #3 extended (ordinal sort), new
departure #5 (bin/obj exclusion, load-bearing since T12 repopulates bin/obj),
C2 clarification (CA1707 scope = externally-visible + test methods; private
fields use _camelCase). Feature file watch-items W12/W13/W14.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
parthopdas
added a commit
that referenced
this pull request
Jul 26, 2026
Faithful port of crap4java ChangedFileDetector: ChangedCSharpFiles runs git -C <root> status --porcelain, parses each porcelain line (substring(3).Trim -> RenameTarget -> .cs filter -> absolute normalized path), ordinal-sorts, and returns IReadOnlyList<string>. ChangedCSharpFilesUnderSrc applies a segment-aware under-<root>/src filter (Path.startsWith semantics, not a naive prefix). Public IsCandidateLine / RenameTarget helpers unit-tested. Non-zero git exit -> InvalidOperationException (Java IllegalStateException) whose message carries git's stderr (e.g. "not a git repository"). All 5 Java tests ported faithfully with a cross-platform RunGit setup helper (invokes git directly instead of Java's sh -c). Uses its OWN Process, not ICommandExecutor (W15: this is an exit-code-only seam; git needs captured stdout). Applies the W15 deadlock fix in prod + test: both StandardOutput/StandardError ReadToEndAsync start BEFORE WaitForExit, so pipes drain concurrently and cannot wedge -- deliberately NOT Java's waitFor()-then-readAllBytes() ordering. Adaptations (all confirmed by Anders as below-threshold / covered): ordinal sort under decisions.md departure #3 (now extended to name ChangedFileDetector); redirectErrorStream -> stdout+stderr merge for the error message; sh -c -> direct-git test-infra swap. Anders added W16 (T14 ChangedSrc must call the UnderSrc variant) and logged D-T8 (integration-trait / build-test.md doc-reality gap) as an OPEN decision for Mr. Das. 27/27 tests green (deterministic x2), 0 warnings / 0 errors in Release. Also backfills the task table: T6 da02028; T8 Done. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
parthopdas
added a commit
that referenced
this pull request
Jul 27, 2026
Faithful 1:1 port of crap4java CrapAnalyzer — the flat S4 composition layer that reads the changed files and drives both parsers (T9 CSharpMethodParser, T10 CoberturaCoverageParser), composing CrapScore + MethodMetrics. - Exact->nearest-line->N/A coverage lookup keyed on the FROZEN reciprocal TypeName#method:line form (byte-for-byte aligned with T10; trailing ":" is load-bearing). InvariantCulture line formatting (departure #3); Ordinal comparisons throughout. - N/A discipline (W4 / departure #1): a missing lookup yields null, never 0.0; 0%-present vs absent preserved end-to-end. - Stable OrderBy(...).ThenByDescending(...), N/A last (not List.Sort). - Resolve-once (departure #7): flat — no module-grouping loop (a T14 concern). - Public tested helpers LookupCoverage/NearestCoverage/ParseTrailingLine (internal banned, C1); ExactCoverage private (least privilege). - Drops Java classNameFromSource + dead projectRoot param (D-T9; behaviour migrated to T9). 17 tests: P1-P9 faithful ports + C1-C8 C#-specific. Build 0/0 Release (warnings-as-errors); 85/85 tests green, deterministic x2. docs/decisions.md: add T11 register (frozen-consumer discharged, D-T11a/b, W-T11a/b/c). Backfill T10 SHA 87488ce; flip T11 -> Done. Verified by Bhaskar (PASS); design-reviewed by Anders (GREEN). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
parthopdas
added a commit
that referenced
this pull request
Jul 27, 2026
… tests
Faithful port of crap4java CoverageRunner (delete-stale -> run-once ->
throw-on-nonzero) re-hosted on coverlet, plus a C#-specific
CoverageReportLocator (JaCoCo's report path was a fixed constant; coverlet
writes coverage.cobertura.xml into a random GUID subdir, so a locator is new).
- CoverageRunner: public sealed; ctor takes ICommandExecutor (T6 seam reused);
const ResultsDirectoryName="coverage"; GenerateCoverage(projectRoot) deletes
the stale coverage/ dir, runs ["dotnet","test","--collect:XPlat Code
Coverage","--results-directory","coverage"] once at projectRoot (verbatim
cwd, no normalization), throws InvalidOperationException("Coverage command
failed with exit N") on non-zero exit (byte-identical to Java).
- CoverageReportLocator: public static; Locate(projectRoot) does an ordinal-
first single-pick of one coverage.cobertura.xml (departure #8), null when
absent. No mtime logic (deterministic, departure #3).
- Resolve-once (#7): both take a pre-resolved projectRoot; neither calls
ModuleRootResolver (load-bearing S5/T17 swap seam, D-T12b).
- Fail-fast gate stays in T14: runner throws; locator returns null.
- 10 tests (RecordingExecutor fake; no real dotnet test): 5 runner + 5 locator.
Build 0/0 Release (warnings-as-errors); 95/95 tests green, deterministic x2.
docs/decisions.md: add approved departure #8 (single-pick coverage report,
Mr. Das-ruled; aggregation deferred to S5/T17) + T12 register (D-T12b/e/f
load-bearing invariants). docs/features: expand S5/T17 scope to include
multi-report coverage aggregation; backfill T11 SHA debf9de; flip T12 -> Done.
Verified by Bhaskar (PASS); design-reviewed by Anders (GREEN).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please accept this contribution adding the standard Microsoft SECURITY.MD 🔒 file to help the community understand the security policy and how to safely report security issues. GitHub uses the presence of this file to light-up security reminders and a link to the file. This pull request commits the latest official SECURITY.MD file from https://github.com/microsoft/repo-templates/blob/main/shared/SECURITY.md.
Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.