Merge pull request #278 from Vulthil/chore/release-pipeline-hardening

Author: Vulthil

.github/workflows/backport.yml

@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
 
       - name: Create backport PRs
-        uses: korthout/backport-action@v4
+        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4
         with:
           # AUTOMATION_TOKEN (a PAT/App token) lets the required `build` check
           # run on the created PR; pushes made with the default GITHUB_TOKEN do

.github/workflows/ci.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-dotnet@v5
 
@@ -56,19 +56,24 @@ jobs:
           name: coverage-report
           path: ./CoverageReport
 
+      # Uses gh api directly instead of a third-party gist-deploy action -- one
+      # less individual-maintainer action holding a token in its supply chain.
       - name: Publish coverage badge to Gist
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: exuanbo/actions-deploy-gist@v1
-        with:
-          token: ${{ secrets.GIST_TOKEN }}
-          gist_id: 2852f1400e27493b185559c76b38e9b7
-          file_path: ./CoverageReport/badge_combined.svg
-          file_type: binary
+        env:
+          GH_TOKEN: ${{ secrets.GIST_TOKEN }}
+        run: |
+          jq -n --rawfile content ./CoverageReport/badge_combined.svg \
+            '{files: {"badge_combined.svg": {content: $content}}}' \
+          | gh api --method PATCH /gists/2852f1400e27493b185559c76b38e9b7 --input -
 
       # Preview (prerelease) packages. main is not a public release ref
       # (version.json), so every CI build carries a prerelease suffix. PRs pack
       # and upload a downloadable artifact for testing; only merges to main are
       # published to the shared feed, so transient PR commits don't pollute it.
+      # Package validation (APICompat vs. PackageValidationBaselineVersion) also
+      # runs here, i.e. AFTER build+test -- a baseline diff stays latent on any
+      # commit where tests already failed and this step didn't run.
       - name: Pack preview
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
         run: dotnet pack -c Release -o ./artifacts
@@ -80,8 +85,41 @@ jobs:
           name: nuget-packages
           path: ./artifacts/*
 
-      - name: Publish preview to GitHub Packages
+      # Hands packages to the publish-preview job below, which carries
+      # packages: write instead of this job -- keeps that credential out of the
+      # job that runs untrusted PR code (dotnet build/test run arbitrary MSBuild
+      # targets from the PR).
+      - name: Upload preview packages
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v7
+        with:
+          name: preview-packages
+          path: ./artifacts/*
+
+  # Split from `build` so the packages: write token is never present while
+  # building/testing PR code. Only runs for pushes to main, never for PRs
+  # (including same-repo ones), so a compromised dependency can't use this
+  # token from its own PR build.
+  publish-preview:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v5
+
+      - uses: actions/download-artifact@v7
+        with:
+          name: preview-packages
+          path: ./artifacts
+
+      - name: Publish preview to GitHub Packages
         run: |
           dotnet nuget push "./artifacts/*.nupkg" \
             --api-key ${{ secrets.GITHUB_TOKEN }} \

.github/workflows/claude-code-review.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@01872ccc02bf66740207fb338a783ce028216758 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

.github/workflows/claude.yml

@@ -32,7 +32,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@01872ccc02bf66740207fb338a783ce028216758 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/dependabot-approve-and-automerge.yml

@@ -1,4 +1,14 @@
 name: Dependabot Auto-Approve and Auto-Merge
+
+# Auto-merges Dependabot patch/minor updates, narrowed by blast radius:
+# github-actions bumps (CI-only, and SHA-pinned per T10) and NuGet packages
+# NOT referenced by any shipped src/ project still auto-merge once CI (build)
+# passes. NuGet's own dependency-type classification has no test-project
+# detection (every NuGet requirement reports as "direct:production" -- see
+# Dependabot::Dependency.register_production_check in dependabot-core), so the
+# src/ check below is done directly against src/**/*.csproj instead of trusted
+# from Dependabot metadata. Majors, dotnet-sdk bumps, docker bumps, and any
+# NuGet package referenced by src/ always require a human review and merge.
 on: pull_request
 
 permissions:
@@ -12,20 +22,54 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3.1.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
       # Only auto-approve/merge patch and minor updates. A major bump can carry
       # breaking changes that still compile and pass tests, then ship to consumers
-      # unnoticed -- leave majors for a human to review and merge.
-      - name: Approve a PR
+      # unnoticed -- leave majors for a human to review and merge. Within
+      # patch/minor, narrow further by dependency risk (see file header).
+      - name: Decide auto-merge eligibility
+        id: eligibility
         if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        env:
+          ECOSYSTEM: ${{ steps.metadata.outputs.package-ecosystem }}
+          UPDATED_DEPENDENCIES_JSON: ${{ steps.metadata.outputs.updated-dependencies-json }}
+        run: |
+          case "$ECOSYSTEM" in
+            github_actions)
+              echo "eligible=true" >> "$GITHUB_OUTPUT"
+              ;;
+            nuget)
+              production_found=false
+              while IFS= read -r name; do
+                [ -z "$name" ] && continue
+                if grep -rqiF "Include=\"$name\"" src/ --include="*.csproj"; then
+                  production_found=true
+                  echo "::notice::src/ references $name -- not auto-merging"
+                fi
+              done < <(echo "$UPDATED_DEPENDENCIES_JSON" | jq -r '.[].dependencyName' | sort -u)
+              echo "eligible=$([ "$production_found" = true ] && echo false || echo true)" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "eligible=false" >> "$GITHUB_OUTPUT"
+              echo "::notice::Not auto-merging -- $ECOSYSTEM ecosystem requires human review"
+              ;;
+          esac
+
+      - name: Approve a PR
+        if: steps.eligibility.outputs.eligible == 'true'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
       - name: Enable auto-merge for Dependabot PRs
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        if: steps.eligibility.outputs.eligible == 'true'
         run: gh pr merge --auto --merge "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}

.github/workflows/release.yml

@@ -53,26 +53,37 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "::notice::Publishing version $VERSION"
 
+      - name: Check version not already released
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if gh release view "v$VERSION" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+            echo "::error::v$VERSION is already released. Bump version.json before dispatching Release again."
+            exit 1
+          fi
+
       - name: Generate release notes
         id: changelog
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
         with:
           config: cliff.toml
           args: --unreleased --tag v${{ steps.version.outputs.version }} --strip header
         env:
           OUTPUT: CHANGES.md
 
+      # Uses gh release create directly instead of a third-party release action
+      # -- one less individual-maintainer action holding contents: write.
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
-        with:
-          name: v${{ steps.version.outputs.version }}
-          tag_name: v${{ steps.version.outputs.version }}
-          body_path: CHANGES.md
-          files: |
-            ./artifacts/*.nupkg
-            ./artifacts/*.snupkg
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "v${{ steps.version.outputs.version }}" \
+            ./artifacts/*.nupkg ./artifacts/*.snupkg \
+            --repo "${{ github.repository }}" \
+            --title "v${{ steps.version.outputs.version }}" \
+            --notes-file CHANGES.md \
+            --target "${{ github.sha }}"
 
       - name: Publish to GitHub Packages
         run: |
@@ -88,7 +99,7 @@ jobs:
       # https://learn.microsoft.com/nuget/nuget-org/trusted-publishing
       - name: NuGet login (trusted publishing)
         id: nuget-login
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
         with:
           user: ${{ secrets.NUGET_USER }}
 
@@ -125,25 +136,37 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Promote unshipped public API
-        run: python3 eng/mark_api_shipped.py
+        run: python3 eng/mark_api_shipped.py --version ${{ needs.release.outputs.version }}
+
+      - name: Require automation token
+        env:
+          AUTOMATION_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
+        run: |
+          if [ -z "$AUTOMATION_TOKEN" ]; then
+            echo "::error::AUTOMATION_TOKEN is not set. The default GITHUB_TOKEN cannot open this PR: pushes made with it do not trigger the required 'build' check, so auto-merge would stall silently."
+            exit 1
+          fi
 
       - name: Open public API promotion PR
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           # AUTOMATION_TOKEN lets the required `build` check run on the PR; with
           # the default GITHUB_TOKEN, pushes from a workflow do not trigger CI.
-          token: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-          add-paths: src/**/PublicAPI.*.txt
-          branch: chore/mark-api-shipped
+          # Enforced by the "Require automation token" step above -- no fallback.
+          token: ${{ secrets.AUTOMATION_TOKEN }}
+          add-paths: |
+            src/**/PublicAPI.*.txt
+            Directory.Build.props
+          branch: chore/mark-api-shipped-${{ needs.release.outputs.version }}
           delete-branch: true
           commit-message: "chore: mark public API shipped for v${{ needs.release.outputs.version }}"
           title: "chore: mark public API shipped for v${{ needs.release.outputs.version }}"
           labels: automated
           body: |
-            Promotes the unshipped public API surface to shipped for **v${{ needs.release.outputs.version }}**.
+            Promotes the unshipped public API surface to shipped for **v${{ needs.release.outputs.version }}** and bumps `PackageValidationBaselineVersion` to match.
 
-            Each `PublicAPI.Unshipped.txt` was folded into its sibling `PublicAPI.Shipped.txt` and reset to the `#nullable enable` header. Merge this so the next development cycle starts from a clean unshipped surface.
+            Each `PublicAPI.Unshipped.txt` was folded into its sibling `PublicAPI.Shipped.txt` and reset to the `#nullable enable` header. Merge this so the next development cycle starts from a clean unshipped surface and package validation compares against the release that just shipped.
 
       # Hands-off promotion, mirroring the dependabot auto-approve-and-merge flow.
       # Approve with GITHUB_TOKEN (the github-actions[bot] identity) so the review

.github/workflows/version-bump.yml

@@ -30,15 +30,25 @@ jobs:
         id: bump
         run: python3 eng/bump_version.py "${{ github.event.inputs.bump_type }}"
 
+      - name: Require automation token
+        env:
+          AUTOMATION_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
+        run: |
+          if [ -z "$AUTOMATION_TOKEN" ]; then
+            echo "::error::AUTOMATION_TOKEN is not set. The default GITHUB_TOKEN cannot open this PR: pushes made with it do not trigger the required 'build' check, so an admin would have to bypass the ruleset to merge."
+            exit 1
+          fi
+
       - name: Open version bump PR
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           # A PAT or GitHub App token (AUTOMATION_TOKEN) lets the required `build`
           # check run on the PR. With the default GITHUB_TOKEN, pushes from this
           # workflow do not trigger CI, so an admin must bypass the ruleset to merge.
-          token: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
+          # Enforced by the "Require automation token" step above -- no fallback.
+          token: ${{ secrets.AUTOMATION_TOKEN }}
           add-paths: version.json
-          branch: chore/version-bump
+          branch: chore/version-bump-${{ steps.bump.outputs.version }}
           delete-branch: true
           commit-message: "chore: bump version to ${{ steps.bump.outputs.version }}"
           title: "chore: bump version to ${{ steps.bump.outputs.version }}"

Directory.Build.props

@@ -22,8 +22,8 @@
 	<!-- NuGet package validation -->
 	<PropertyGroup Condition="'$(IsPackable)' != 'false'">
 		<EnablePackageValidation>true</EnablePackageValidation>
-		<!-- Set this after shipping the first stable release:
-		<PackageValidationBaselineVersion>1.0.0</PackageValidationBaselineVersion> -->
+		<!-- Bumped by eng/mark_api_shipped.py to the version just released. -->
+		<PackageValidationBaselineVersion>1.0.1</PackageValidationBaselineVersion>
 	</PropertyGroup>
 
 	<PropertyGroup Condition="'$(IsPackable)' != 'false' and Exists('README.md')">

eng/mark_api_shipped.py

@@ -13,16 +13,25 @@
 Existing line order is preserved (the analyzer emits entries in declaration
 order, not sorted), so promotion adds no reordering churn. The count of
 promoted files is written to the GITHUB_OUTPUT "promoted" key for the caller.
+
+When --version is given, this also bumps Directory.Build.props'
+PackageValidationBaselineVersion to that version, so the next pack validates
+against the release that just shipped instead of going stale.
 """
 import argparse
 import glob
 import os
+import re
 import sys
 
 NULLABLE_HEADER = "#nullable enable"
 REMOVED_PREFIX = "*REMOVED*"
 UNSHIPPED_NAME = "PublicAPI.Unshipped.txt"
 SHIPPED_NAME = "PublicAPI.Shipped.txt"
+BASELINE_FILE = "Directory.Build.props"
+BASELINE_PATTERN = re.compile(
+    r"(<PackageValidationBaselineVersion>)[^<]*(</PackageValidationBaselineVersion>)"
+)
 
 
 def read_entries(path):
@@ -83,9 +92,25 @@ def promote(unshipped_path):
     return True
 
 
+def bump_validation_baseline(version, path=BASELINE_FILE):
+    with open(path, encoding="utf-8") as handle:
+        content = handle.read()
+
+    updated, count = BASELINE_PATTERN.subn(rf"\g<1>{version}\g<2>", content)
+    if count == 0:
+        print(f"::warning::{path}: no <PackageValidationBaselineVersion> element found; skipped.")
+        return False
+
+    with open(path, "w", encoding="utf-8", newline="\n") as handle:
+        handle.write(updated)
+    print(f"Bumped package validation baseline: {path} -> {version}")
+    return True
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--root", default="src", help="Directory to scan (default: src)")
+    parser.add_argument("--version", help="Version just released; also bumps PackageValidationBaselineVersion")
     args = parser.parse_args()
 
     pattern = os.path.join(args.root, "**", UNSHIPPED_NAME)
@@ -95,6 +120,9 @@ def main():
 
     print(f"Promoted public API in {promoted} project(s).")
 
+    if args.version:
+        bump_validation_baseline(args.version)
+
     output = os.environ.get("GITHUB_OUTPUT")
     if output:
         with open(output, "a", encoding="utf-8") as handle: