Skip to content

Feature/ci cd modernization #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Jul 15, 2025

Conversation

Blind-Striker
Copy link
Contributor

No description provided.

✨ Phase 1: Infrastructure Modernization Complete

## 🚀 New Features
- **Modern CI/CD Pipeline**: Consolidated 3 separate OS workflows into unified matrix-based ci.yml
- **Automated GitHub Packages**: Daily development builds for immediate testing feedback
- **Enhanced Security**: CodeQL analysis + Dependabot automation
- **GitHub Test Reporter**: Native test result visualization (replaces Testspace)

## 🔄 Workflow Changes
- ✅ **ci.yml**: Cross-platform matrix testing (Windows/Linux/macOS) with modern actions
- ✅ **publish-dev-github.yml**: Automated GitHub Packages publishing for development
- ✅ **publish-nuget.yml**: Enhanced manual workflow supporting both GitHub Packages & NuGet.org
- ✅ **security.yml**: CodeQL security scanning + dependency review
- ✅ **dependabot.yml**: Automated dependency management with smart grouping

## 🏗️ Infrastructure Updates
- **GitHub Actions**: Updated to v4 (checkout, setup-dotnet, cache, upload-artifact)
- **Runners**: Migrated from ubuntu-20.04 to ubuntu-latest
- **Test Reporting**: Native GitHub integration via dorny/test-reporter@v1
- **Package Caching**: Optimized NuGet package caching for faster builds
- **Build System**: Added GitHub Packages support to Cake Frosting build

## 🗑️ Removed Deprecated Components
- ❌ **Old Workflows**: build-ubuntu.yml, build-windows.yml, build-macos.yml
- ❌ **Testspace**: External test reporting service dependency
- ❌ **Old Actions**: checkout@v2, setup-dotnet@v1, setup-nuget@v1.0.5

## 📦 Release Strategy
- **Development**: Auto-publish to GitHub Packages on every master/v2-preview1 commit
- **Preview/Stable**: Manual NuGet.org publishing with enhanced dropdown workflow
- **Version Format**: 2.0.0-preview1.20240715.a1b2c3d for development builds

Ready for Phase 2: Enhanced automation & community features! 🎯
✨ Enhanced Documentation

## 📖 Updated Content
- **CI/CD Badges**: Modern GitHub Actions workflow status badges
- **Package Installation**: Dual-source strategy (NuGet.org + GitHub Packages)
- **Development Builds**: Instructions for GitHub Packages authentication
- **CI Status**: Matrix testing status across Windows/Linux/macOS

## 🔄 Badge Updates
- ✅ **CI/CD Pipeline**: Cross-platform matrix testing status
- ✅ **Security Analysis**: CodeQL scanning and dependency review
- ✅ **Automated Publishing**: GitHub Packages development builds
- ❌ **Removed**: Deprecated Testspace badge

Ready for community testing with development packages! 🚀
@Blind-Striker Blind-Striker requested a review from Copilot July 15, 2025 11:27
@Blind-Striker Blind-Striker self-assigned this Jul 15, 2025
@Blind-Striker Blind-Striker added the enhancement New feature or request label Jul 15, 2025
Copy link

github-actions bot commented Jul 15, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/cache 4.*.* 🟢 6.1
Details
CheckScoreReason
Maintained⚠️ 22 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v1): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 82 existing vulnerabilities detected
actions/actions/checkout 4.*.* 🟢 5.2
Details
CheckScoreReason
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 8SAST tool detected but not run on all commits
Vulnerabilities⚠️ 010 existing vulnerabilities detected
actions/actions/setup-dotnet 4.*.* 🟢 5.1
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
Vulnerabilities🟢 55 existing vulnerabilities detected
actions/actions/upload-artifact 4.*.* 🟢 4.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities⚠️ 28 existing vulnerabilities detected
actions/dorny/test-reporter 1.*.* 🟢 4.3
Details
CheckScoreReason
Code-Review🟢 4Found 4/10 approved changesets -- score normalized to 4
Maintained🟢 1030 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 022 existing vulnerabilities detected
actions/actions/checkout 4.*.* 🟢 5.2
Details
CheckScoreReason
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 8SAST tool detected but not run on all commits
Vulnerabilities⚠️ 010 existing vulnerabilities detected
actions/actions/dependency-review-action 4.*.* 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1021 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities🟢 73 existing vulnerabilities detected
actions/actions/cache 4.*.* 🟢 6.1
Details
CheckScoreReason
Maintained⚠️ 22 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v1): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 82 existing vulnerabilities detected
actions/actions/checkout 4.*.* 🟢 5.2
Details
CheckScoreReason
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 8SAST tool detected but not run on all commits
Vulnerabilities⚠️ 010 existing vulnerabilities detected
actions/actions/setup-dotnet 4.*.* 🟢 5.1
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
Vulnerabilities🟢 55 existing vulnerabilities detected
actions/actions/upload-artifact 4.*.* 🟢 4.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities⚠️ 28 existing vulnerabilities detected

Scanned Files

  • .github/workflows/ci.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/publish-dev-github.yml

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR modernizes the CI/CD setup by consolidating workflows, adding GitHub Packages support, and updating documentation.

  • Unified build, test, security analysis, and publishing into streamlined GitHub Actions workflows
  • Enabled GitHub Packages as a distribution source and updated version validation logic
  • Updated READMEs to include new CI/CD badges and installation instructions for stable and development builds

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/LocalStack.Client/README.md Updated badges and added package installation instructions
src/LocalStack.Client.Extensions/README.md Updated badges and added package installation instructions
build/LocalStack.Build/Program.cs Expanded version regex and added skip logic for GitHub source
build/LocalStack.Build/BuildContext.cs Added GitHub package source mapping
README.md Updated badges and added installation instructions
.github/workflows/security.yml Added CodeQL and dependency review for security analysis
.github/workflows/publish-nuget.yml Refactored manual publishing workflow to support GitHub Packages
.github/workflows/publish-dev-github.yml Introduced auto-publish workflow for development builds
.github/workflows/ci.yml Consolidated CI pipeline with cross-platform matrix strategy
.github/workflows/build-windows.yml Removed legacy Windows build workflow
.github/workflows/build-ubuntu.yml Removed legacy Ubuntu build workflow
.github/workflows/build-macos.yml Removed legacy macOS build workflow
.github/dependabot.yml Configured Dependabot for NuGet/GitHub Actions updates
Comments suppressed due to low confidence (5)

.github/workflows/security.yml:6

  • Include 'feature/ci-cd-modernization' in the push and pull_request branch lists so that security analysis runs on this branch as well.
      - master

build/LocalStack.Build/Program.cs:154

  • Add unit tests for the new GitHub package source branch in ValidatePackageVersion, covering both the skip behavior and acceptance of pre-release formats.
        if (context.PackageSource == "github")

src/LocalStack.Client/README.md:41

  • [nitpick] Add entries for '📦 Package Installation' and 'Development Builds' to the Table of Contents so readers can find the new installation instructions.
## Table of Contents

🔧 **Workflow Trigger Improvements**

## ✅ **Removed Hard-coded Feature Branches**
- **CI Pipeline**: Only master branch + PRs (no temporary feature branches)
- **Auto Publishing**: Only master branch (stable development builds)
- **Manual Publishing**: Available from any branch when needed

## 🎯 **Benefits**
- **Maintainable**: No need to update workflows for every feature branch
- **Scalable**: Works for any future feature branches automatically
- **Clean**: CI only runs at integration points (master + PRs)
- **Efficient**: Eliminates duplicate workflow runs

## 🚀 **Result**
- ✅ Follows GitHub Actions best practices
- ✅ Reduced maintenance overhead
- ✅ Clean separation of concerns
- ✅ Ready for production use

CI/CD modernization is now production-ready! 🎉
…k support

🎯 **Mono Runtime Modernization**

## 📰 **Context**: Microsoft Mono Project Transition
- Original Mono Project → Moving to WineHQ stewardship
- Microsoft's modern Mono fork → Integrated into dotnet/runtime
- .NET 8+ includes built-in Mono runtime for cross-platform .NET Framework support

## ✅ **Cross-Platform .NET Framework Support**
- **Linux**: Now runs net472 tests using built-in Mono runtime
- **macOS**: Unified test execution (no more custom XUnit/Mono logic)
- **Windows**: Unchanged (native .NET Framework support)

## 🔧 **Build System Improvements**
- **Simplified Logic**: Removed platform-specific workarounds
- **Unified Execution**: Same \`dotnet test\` command across all platforms
- **Dependency Elimination**: No external Mono installation required
- **Better Coverage**: Full framework testing on all platforms

## 🚀 **CI/CD Enhancements**
- **Matrix Testing**: Added net472 to Linux/macOS matrix
- **Trigger Fix**: Added feature/* pattern for testing
- **Modern Runtime**: Leverages .NET 9.0.200 built-in Mono

## 📈 **Result**
- ✅ True cross-platform .NET Framework support
- ✅ Simplified, maintainable build system
- ✅ Zero external runtime dependencies
- ✅ Enhanced test coverage across all platforms
@github-advanced-security
Copy link
Contributor

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@Blind-Striker Blind-Striker merged commit f09bf0c into feature/v2-preview1 Jul 15, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant