Skip to content

v0.2.1 — debuggable packages

Choose a tag to compare

View all tags
@peopleworks peopleworks released this 02 Aug 01:09
· 156 commits to main since this release
v0.2.1
7098a95
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nothing in this release changes what the tool does. No rule changed, no analysis changed, no public API changed — the output for a given text is byte-identical to 0.2.0. What changed is what you can do with the packages once they are on your machine.

You can now step into the code

SignsOfAI.Core ships with Source Link and a symbol package. Put a breakpoint inside a call to the analyzer and the debugger will fetch the exact source for the commit the package was built from, rather than showing you decompiled approximations or nothing at all. This is the sort of thing a library should have had from the first release; it did not, because nothing had ever configured it.

  • Source Link on every packed project, resolving to the tagged commit.
  • .snupkg symbol packages published to the NuGet symbol server alongside each package.
  • Reproducible build settings, so two builds of this commit produce identical binaries. Path normalization is scoped to CI on purpose — it is what makes builds comparable, and also what would break step-through debugging for anyone building locally.

The release pipeline checks itself now

The publish workflow refuses to push if any package is missing its symbols. A gap there is invisible until somebody tries to debug into the library months later, which is exactly the kind of failure that should be caught by a machine and not by a disappointed user.

The Windows desktop app is now built by CI as well, from the tagged commit on a clean runner, with a published SHA-256 — rather than being uploaded from a developer's laptop. Nothing about the app changes; you can just now verify that what you downloaded is what the repository says it is.

Why

The project is applying to the .NET Foundation, and Source Link, reproducible builds and symbol packages are three of its eligibility criteria. They turned out not to be decisions anyone had made — there was simply no Directory.Build.props, so nothing set them. Docs/dotnet-foundation.md records the project against every criterion, with evidence for each, including the one still unmet: nothing here is code signed.

Versions

SignsOfAI.Core, SignsOfAI.Cli and SignsOfAI.Mcp all move to 0.2.1. A patch, because nothing you can call or observe is different.

Assets 2
Loading