Conversation
This PR updates the codegen files. Co-authored-by: ptr727-codegen[bot] <275599072+ptr727-codegen[bot]@users.noreply.github.com>
…up (#456) Bumps the actions-deps group with 1 update: [actions/setup-dotnet](https://github.com/actions/setup-dotnet). Updates `actions/setup-dotnet` from 5.3.0 to 5.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-dotnet/releases">actions/setup-dotnet's releases</a>.</em></p> <blockquote> <h2>v5.4.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Improve global.json SDK version validation for rollForward by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/742">actions/setup-dotnet#742</a></li> <li>Pin actions to commit SHAs in workflows by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/744">actions/setup-dotnet#744</a></li> <li>Expand the CSC problem matcher to light up more errors on GitHub. by <a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <h3>Documentation</h3> <ul> <li>Docs(action): Explicitly mark all optional inputs with required: false by <a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> </ul> <h3>Bug Fixes</h3> <ul> <li>Fix global.json creation command by <a href="https://github.com/michal2612"><code>@michal2612</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/746">actions/setup-dotnet#746</a></li> <li><a href="https://github.com/michal2612"><code>@michal2612</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/694">actions/setup-dotnet#694</a></li> <li><a href="https://github.com/kranthipoturaju"><code>@kranthipoturaju</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/737">actions/setup-dotnet#737</a></li> <li><a href="https://github.com/StephenCleary"><code>@StephenCleary</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-dotnet/pull/717">actions/setup-dotnet#717</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-dotnet/compare/v5...v5.4.0">https://github.com/actions/setup-dotnet/compare/v5...v5.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-dotnet/commit/26b0ec14cb23fa6904739307f278c14f94c95bf1"><code>26b0ec1</code></a> Expand the CSC problem matcher to light up more errors on GitHub. (<a href="https://redirect.github.com/actions/setup-dotnet/issues/717">#717</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/da5e5482f2d0700168cff080da45b50da8b60f0e"><code>da5e548</code></a> docs(action): explicitly mark all optional inputs with required: false (<a href="https://redirect.github.com/actions/setup-dotnet/issues/737">#737</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/9bd3b44355ba7c500f3d2e029636c6d29ac5caab"><code>9bd3b44</code></a> Improve readability of global.json creation command (<a href="https://redirect.github.com/actions/setup-dotnet/issues/694">#694</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/4406a635cd2be9c92689ea22b2f74ea57297088c"><code>4406a63</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied (<a href="https://redirect.github.com/actions/setup-dotnet/issues/746">#746</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/dc3262dda80e97f1c7865b3b122e99240e30b738"><code>dc3262d</code></a> pin actions to commit SHAs in workflows (<a href="https://redirect.github.com/actions/setup-dotnet/issues/744">#744</a>)</li> <li><a href="https://github.com/actions/setup-dotnet/commit/95a3f8b067437dc9b2027a437f5dc3b4569ddd49"><code>95a3f8b</code></a> Validate global.json SDK version before rollForward optimization (<a href="https://redirect.github.com/actions/setup-dotnet/issues/742">#742</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-dotnet/compare/9a946fdbd5fb07b82b2f5a4466058b876ab72bb2...26b0ec14cb23fa6904739307f278c14f94c95bf1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This PR updates the codegen files. Co-authored-by: ptr727-codegen[bot] <275599072+ptr727-codegen[bot]@users.noreply.github.com>
Migrate NxWitness to the branch-scoped, triggered-Docker one-run-one-branch CI/CD model, converging it with the sibling repos while keeping the repo-specific codegen + multi-product Docker matrix. ## Release model (triggered-Docker, one run = one branch) - **publish-release.yml**: `workflow_dispatch` + weekly `schedule` (main) **+ path-scoped `push` on main when `Make/Matrix.json` changes** (codegen commits a new matrix -> publish the new product versions at once). Single `get-version` threaded as `semver2` to every product leg (no nested NBGV -> no `:SemVer2` collision); main-only `build-base` (develop dispatch reuses it via `build_base: false`); a `validate` job re-runs lint + `dotnet test` before building; `github-release` + folded `docker-readme` are main-only. The old two-leg build-main/build-develop run is removed (one-branch = native NBGV classification, no `IGNORE_GITHUB_REF`). The D2.2 main-version backstop stays. - **test-pull-request.yml**: `push: ['**']` + dispatch (drop `pull_request`/`dorny`); inline `git diff` change-gate; deletion guards; aggregator renamed to `Check pull request workflow status job`. ## Convergence New `WORKFLOW.md` (D0-D10 incl. the codegen + multi-image D-guarantees), `repo-config/` (5D audit), folded `docker-readme` (manifest-jq over `Make/Matrix.json`), merge-bot `--delete-branch`, `dotnet/nbgv@master` (the WORKFLOW.md D9.1 exception), `.slnx` rebuilt to the real file set, version floor `2.14 -> 2.15`. Codegen + Dependabot stay dual-target main+develop. No NuGet publish (the .NET is the matrix generator only). `configure.sh apply` will run in lockstep so the renamed required check resolves. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Owner
Author
|
Superseded by the reconciliation PR: develop->main could not merge cleanly (main had a straggler change to test-release-task.yml, which the migration renamed to validate-task.yml - a modify/delete conflict). Replaced by a branch that merges main into the migration with that conflict resolved (file deleted; validate-task.yml supersedes it). |
There was a problem hiding this comment.
Pull request overview
Promotes the branch-scoped, triggered-Docker CI/CD migration to main, aligning publishing, validation, version threading, and repo configuration-as-code with the new one-run-one-branch release model.
Changes:
- Added a canonical CI/CD contract and operational audit guide (
WORKFLOW.md) and codified repository admin configuration inrepo-config/(rulesets, settings, audit/apply script). - Updated GitHub Actions to the triggered-Docker publisher model (schedule + Matrix.json pin-push + dispatch), threaded a single NBGV SemVer2 to build legs, and refactored validation into a reusable
validate-task. - Updated version floor and regenerated matrix/version pins (including DWSpectrum RC tags and WisenetWAVE
latesttag adjustments), and removed legacy badge/readme/datebadge workflows.
Reviewed changes
Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| WORKFLOW.md | New canonical workflow contract, guarantees, and audit methodology for CI/CD. |
| version.json | Bumps NBGV version floor to 2.15. |
| repo-config/settings.json | Adds repository settings as code (merge methods, auto-merge, branch delete behavior). |
| repo-config/ruleset-main.json | Adds main ruleset config-as-code (merge method, status check, signatures, Copilot review rule). |
| repo-config/ruleset-develop.json | Adds develop ruleset config-as-code (linear history + squash merge, status check, signatures, Copilot review rule). |
| repo-config/README.md | Documents repo-config purpose, usage, and required-check lockstep behavior. |
| repo-config/configure.sh | Adds idempotent apply/check script to audit/apply settings, rulesets, and required secret names. |
| README.md | Removes “Last Build” BYOB badge references and adjusts related text. |
| NxWitness.slnx | Updates solution items to include new workflows/docs and repo-config files; removes dropped workflows. |
| Make/Version.json | Updates upstream product version pins (adds DWSpectrum RC; WisenetWAVE label adjustments). |
| Make/Matrix.json | Updates image tag matrix (adds DWSpectrum RC tags; updates WisenetWAVE latest; keeps branch rows). |
| AGENTS.md | Updates canonical pointers (WORKFLOW.md, repo-config, CODESTYLE.md) and documents doc/comment conventions. |
| .github/workflows/validate-task.yml | New reusable validation task (Husky lint + dotnet test). |
| .github/workflows/test-release-task.yml | Removes legacy validation workflow superseded by validate-task. |
| .github/workflows/test-pull-request.yml | Switches CI to push-based runs with inline change-gate, new validate task, and updated required-check aggregator. |
| .github/workflows/run-codegen-pull-request-task.yml | Updates setup-dotnet action pin. |
| .github/workflows/publish-release.yml | Refactors publisher to one-branch-per-run (schedule/main Matrix pin-push/dispatch), adds validate-before-build, folds Docker Hub readme publishing, removes badge. |
| .github/workflows/publish-docker-readme-task.yml | Removes standalone reusable docker-readme task (folded into publisher). |
| .github/workflows/merge-bot-pull-request.yml | Enables --delete-branch on auto-merge for bot/codegen branches. |
| .github/workflows/get-version-task.yml | Updates setup-dotnet action pin. |
| .github/workflows/build-docker-task.yml | Removes nested get-version job, adds semver2 input, and updates login/label behavior. |
| .github/workflows/build-datebadge-task.yml | Removes legacy BYOB date badge workflow. |
Comment on lines
+240
to
+242
| - **D1.4 Smoke never publishes and never uploads a release asset.** Output: a smoke build compiles the image | ||
| subset but makes no GitHub release and no Docker push (`push: false`, `smoke: true`). The Docker login step | ||
| is gated on `push`, so smoke needs no Docker Hub secrets (forked-PR-safe). |
Comment on lines
+95
to
+98
| # Validate the rows for the branch this push targets: main pushes check main's rows; develop and any | ||
| # feature branch (which targets develop) check develop's rows. github.ref_name alone would be a feature | ||
| # branch name that matches no Matrix.json .Branch row, yielding an empty smoke matrix. | ||
| branch: ${{ github.ref_name == 'main' && 'main' || 'develop' }} |
Comment on lines
+139
to
+141
| assert "Dependabot vulnerability alerts enabled" gh_ok "repos/$REPO/vulnerability-alerts" | ||
| assert "Dependabot automated security updates enabled" \ | ||
| jq_has '.enabled == true' < <(gh api "repos/$REPO/automated-security-fixes" 2>/dev/null) |
ptr727
added a commit
that referenced
this pull request
Jun 29, 2026
Promote the branch-scoped triggered-Docker CI/CD migration to `main` (replaces #464, which could not merge cleanly). The only conflict was `test-release-task.yml`: the migration renamed it to `validate-task.yml` (deleted on develop) while main carried a straggler change to it - a modify/delete. This branch merges `main` into the migration and resolves it by taking the deletion (`validate-task.yml` supersedes it with the same lint + `dotnet test` content). Everything else merged cleanly (the trees were otherwise identical). Carries the full migration: one-branch publisher (dispatch + weekly schedule(main) + push-on-`Make/Matrix.json`), single threaded NBGV across all 12 product legs, validate-before-build, main-only base reused on develop, folded docker-readme, `repo-config/` 5D audit, `WORKFLOW.md`, merge-bot `--delete-branch`, login-always, `dotnet/nbgv@master`, version floor `2.15`. Codegen + Dependabot stay dual-target. `configure.sh apply` was run in lockstep ("Configuration matches"). No-bypass merge-commit promotion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the branch-scoped triggered-Docker migration (#461) to main: one-branch publisher (dispatch + weekly schedule(main) + push-on-Make/Matrix.json), single threaded NBGV across all 12 product legs, validate-before-build, main-only base reused on develop, folded docker-readme, repo-config 5D audit, WORKFLOW.md, merge-bot --delete-branch, login-always, dotnet/nbgv@master, version floor 2.15. Codegen + dependabot stay dual-target. No-bypass merge-commit promotion.