Skip to content

Commit 219ec02

Browse files
randleerandlee
authored
Merge pull request #7 from randlee/develop
feat: CI/CD Enhancements and NuGet Publishing Setup
2 parents 40c17c6 + 5b5666f commit 219ec02

File tree

9 files changed

+155
-25
lines changed

9 files changed

+155
-25
lines changed

‎.github/dependabot.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "nuget"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 10
8+
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ on:
88

99
jobs:
1010
build-and-test:
11-
runs-on: ubuntu-latest
11+
strategy:
12+
fail-fast: false
13+
matrix:
14+
os: [ubuntu-latest, macos-latest, windows-latest]
15+
runs-on: ${{ matrix.os }}
1216

1317
steps:
1418
- name: Checkout code
@@ -33,12 +37,12 @@ jobs:
3337
uses: actions/upload-artifact@v4
3438
if: always()
3539
with:
36-
name: test-results
40+
name: test-results-${{ matrix.os }}
3741
path: "**/TestResults/**/*.trx"
3842

3943
- name: Upload coverage reports
4044
uses: actions/upload-artifact@v4
4145
if: always()
4246
with:
43-
name: coverage-reports
47+
name: coverage-reports-${{ matrix.os }}
4448
path: "**/TestResults/**/coverage.cobertura.xml"

‎.github/workflows/codeql.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
schedule:
9+
- cron: '0 0 * * 1' # Weekly on Monday
10+
11+
jobs:
12+
analyze:
13+
name: Analyze
14+
runs-on: ubuntu-latest
15+
permissions:
16+
actions: read
17+
contents: read
18+
security-events: write
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
language: ['csharp']
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Initialize CodeQL
28+
uses: github/codeql-action/init@v3
29+
with:
30+
languages: ${{ matrix.language }}
31+
32+
- name: Autobuild
33+
uses: github/codeql-action/autobuild@v3
34+
35+
- name: Perform CodeQL Analysis
36+
uses: github/codeql-action/analyze@v3
37+
with:
38+
category: "/language:${{ matrix.language }}"

‎.github/workflows/publish.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Publish NuGet
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*' # Triggers on tags like v1.0.0, v0.5.1, etc.
7+
8+
jobs:
9+
publish:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
packages: write
14+
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Setup .NET
19+
uses: actions/setup-dotnet@v4
20+
with:
21+
dotnet-version: '10.0.x'
22+
dotnet-quality: 'preview'
23+
24+
- name: Extract version from tag
25+
id: version
26+
run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
27+
28+
- name: Restore dependencies
29+
run: dotnet restore
30+
31+
- name: Build
32+
run: dotnet build -c Release --no-restore -p:Version=${{ steps.version.outputs.VERSION }}
33+
34+
- name: Run tests
35+
run: dotnet test -c Release --no-build
36+
37+
- name: Pack
38+
run: dotnet pack src/RoslynDiff.Cli/RoslynDiff.Cli.csproj -c Release --no-build -p:Version=${{ steps.version.outputs.VERSION }} -o ./packages
39+
40+
- name: Publish to GitHub Packages
41+
run: dotnet nuget push ./packages/*.nupkg --source "https://nuget.pkg.github.com/randlee/index.json" --api-key ${{ secrets.GITHUB_TOKEN }} --skip-duplicate

‎Directory.Build.props‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,15 @@
2020
<FileVersion>0.5.0.0</FileVersion>
2121
</PropertyGroup>
2222

23+
<!-- NuGet Package Common Properties -->
2324
<PropertyGroup>
24-
<Authors>RoslynDiff Contributors</Authors>
25+
<Authors>Rand Lee</Authors>
2526
<Company>RoslynDiff</Company>
26-
<Copyright>Copyright (c) 2025-2026 RoslynDiff Contributors</Copyright>
27+
<Copyright>Copyright (c) 2025-2026 Rand Lee</Copyright>
2728
<RepositoryUrl>https://github.com/randlee/roslyn-diff</RepositoryUrl>
2829
<RepositoryType>git</RepositoryType>
30+
<PackageProjectUrl>https://github.com/randlee/roslyn-diff</PackageProjectUrl>
31+
<PackageLicenseExpression>MIT</PackageLicenseExpression>
2932
</PropertyGroup>
3033

3134
<PropertyGroup Condition="'$(Configuration)' == 'Release'">

‎SECURITY.md‎

Lines changed: 44 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,54 @@
22

33
## Supported Versions
44

5-
Use this section to tell people about which versions of your project are
6-
currently being supported with security updates.
5+
The following versions of roslyn-diff are currently supported with security updates:
76

87
| Version | Supported |
98
| ------- | ------------------ |
10-
| 5.1.x | :white_check_mark: |
11-
| 5.0.x | :x: |
12-
| 4.0.x | :white_check_mark: |
13-
| < 4.0 | :x: |
9+
| 0.5.x | :white_check_mark: |
10+
| < 0.5 | :x: |
1411

1512
## Reporting a Vulnerability
1613

17-
Use this section to tell people how to report a vulnerability.
14+
If you discover a security vulnerability in roslyn-diff, please report it responsibly:
1815

19-
Tell them where to go, how often they can expect to get an update on a
20-
reported vulnerability, what to expect if the vulnerability is accepted or
21-
declined, etc.
16+
1. **Do not** open a public GitHub issue for security vulnerabilities.
17+
18+
2. **Email** the maintainers directly or use GitHub's private vulnerability reporting feature.
19+
20+
3. **Include** the following information in your report:
21+
- Description of the vulnerability
22+
- Steps to reproduce the issue
23+
- Potential impact
24+
- Any suggested fixes (optional)
25+
26+
4. **Response timeline**:
27+
- Initial acknowledgment: within 48 hours
28+
- Status update: within 7 days
29+
- Resolution target: within 30 days for critical issues
30+
31+
## Security Considerations
32+
33+
roslyn-diff is a code comparison tool that:
34+
35+
- Reads and parses source code files locally
36+
- Does not transmit data over the network
37+
- Does not execute the code it analyzes
38+
- Generates HTML reports that may be opened in a browser
39+
40+
### HTML Report Security
41+
42+
When generating HTML reports:
43+
- All user-provided file paths are HTML-encoded to prevent XSS
44+
- JavaScript in reports is sandboxed to clipboard and UI operations only
45+
- Reports use `encodeURIComponent()` for URL parameters
46+
47+
## Scope
48+
49+
This security policy applies to:
50+
- The roslyn-diff CLI tool
51+
- The RoslynDiff.Core library
52+
- The RoslynDiff.Output library
53+
- Generated HTML/JSON output formats
54+
55+
Third-party dependencies are managed via NuGet and should be kept updated.

‎src/RoslynDiff.Cli/RoslynDiff.Cli.csproj‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,11 @@
55
<AssemblyName>roslyn-diff</AssemblyName>
66
</PropertyGroup>
77

8-
<!-- NuGet Package Metadata (Version inherited from Directory.Build.props) -->
8+
<!-- NuGet Package Metadata (common properties inherited from Directory.Build.props) -->
99
<PropertyGroup>
10-
<PackageId>RoslynDiff</PackageId>
11-
<Description>A semantic diff tool for .NET source code using Roslyn. Unlike traditional line-by-line diff tools, roslyn-diff understands code structure, detecting and reporting changes at the semantic level (classes, methods, properties, etc.).</Description>
12-
<PackageTags>roslyn;diff;semantic-diff;code-analysis;csharp;vb;dotnet;cli;tool</PackageTags>
13-
<PackageProjectUrl>https://github.com/randlee/roslyn-diff</PackageProjectUrl>
14-
<PackageLicenseExpression>MIT</PackageLicenseExpression>
10+
<PackageId>roslyn-diff</PackageId>
11+
<Description>Roslyn-based semantic diff tool for C# and VB.NET code comparison</Description>
12+
<PackageTags>diff;roslyn;csharp;vbnet;code-comparison;cli</PackageTags>
1513
<PackageReadmeFile>README.md</PackageReadmeFile>
1614
<PackageIcon>icon.png</PackageIcon>
1715
<PackageReleaseNotes>Initial release of roslyn-diff with semantic diff capabilities for C# and VB.NET files.</PackageReleaseNotes>

‎src/RoslynDiff.Core/RoslynDiff.Core.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

3+
<!-- This project is NOT packaged separately - it's bundled into the CLI tool package -->
34
<PropertyGroup>
4-
<Description>Core library for Roslyn-based semantic code diffing</Description>
5-
<PackageId>RoslynDiff.Core</PackageId>
5+
<IsPackable>false</IsPackable>
66
</PropertyGroup>
77

88
<ItemGroup>

‎src/RoslynDiff.Output/RoslynDiff.Output.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

3+
<!-- This project is NOT packaged separately - it's bundled into the CLI tool package -->
34
<PropertyGroup>
4-
<Description>Output formatters and renderers for RoslynDiff results</Description>
5-
<PackageId>RoslynDiff.Output</PackageId>
5+
<IsPackable>false</IsPackable>
66
</PropertyGroup>
77

88
<ItemGroup>

0 commit comments

Comments
 (0)