chore: retarget at main, add the standard scaffolding and shared workflows - #1
Merged
Merged
Conversation
The repository's default branch is main; the workflow push triggers, the CI badge and the contributor docs still referenced develop, so CI, security and scorecard runs never fired on the default branch.
Brings the repository in line with the other Authplane SDKs: ownership routed to the engineering team, the three shared issue templates, the PR checklist adapted to the .NET toolchain, and weekly NuGet + Actions updates grouped by minor/patch.
RobertoIskandarani
force-pushed
the
chore/oss-readiness-scaffolding
branch
from
August 6, 2026 17:13
2638b31 to
fb7c509
Compare
Brings the repository in line with the other Authplane SDKs, which all carry these three. CodeQL runs the security-extended suite over the C# sources with a manual build so the extractor sees both target frameworks; the actionlint job is scoped to workflow changes. The backport workflow and its script are portable git plumbing and are taken verbatim, which also retires the manual-only note in the release runbook.
PackageProjectUrl and PackageReleaseNotes still referenced /tree/develop and /blob/develop. That branch no longer exists, so both links would 404 from the NuGet listing — and a published version's metadata is immutable.
RobertoIskandarani
changed the title
muralx
approved these changes
Aug 7, 2026
muralx
left a comment
muralx
left a comment
Collaborator
There was a problem hiding this comment.
./.github/workflows/codeql.yml:44-47 — dotnet build Authplane.slnx builds all six projects in the solution, so the "tests are excluded from the analysis target" claim is wrong (and the catalog is runtime-only, so it wouldn't block a compile anyway); keep the solution
build — it keeps SAST coverage tracking the solution automatically — and drop the second and third sentences of the comment.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Repository hygiene ahead of going public: point everything at the
mainbranch, add the standard scaffolding and shared workflows the other Authplane SDK repositories already carry, and fix the package URLs before the first release freezes them.Changes
ci.yml,security.yml,scorecard.yml), the CI badge, thestale.ymllink and the branching instructions inCONTRIBUTING.md/RELEASE_SETUP.mdall referenceddevelop. The default branch ismain, so CI, security and scorecard runs never fired on it and the badge resolved to nothing..github/CODEOWNERS, the three shared issue templates, the pull request template anddependabot.yml, matching the other SDK repositories. The PR checklist and the issue templates are adapted to the .NET toolchain, and Dependabot tracks NuGet plus GitHub Actions with minor/patch updates grouped.codeql.yml(security-extended over the C# sources, manual build so the extractor sees both target frameworks),workflows-lint.yml(actionlint, scoped to workflow changes) andbackport-fixes.ymlwithscripts/backport-fixes.sh. The backport pair is portable git plumbing, taken as-is; it also retires the manual-only note in the release runbook.PackageProjectUrlandPackageReleaseNotesin both packable projects: they pointed at/tree/developand/blob/develop, which no longer resolve. A published version's metadata is immutable, so this has to land before the first release.Test Plan
No C# source is touched by this PR. Locally, on the branch:
dotnet format Authplane.slnx --verify-no-changes— cleandotnet build Authplane.slnx --configuration Release— 0 warnings, 0 errorsdotnet test— 375 core + 38 MCP tests pass onnet10.0(thenet8.0leg needs the 8.0 runtime, which CI installs)dotnet pack— both packages and their symbol packages build; the generated.nuspecwas checked to confirm the corrected project and release-notes URLsThe workflow retarget is exercised by this pull request itself: CI runs here for the first time on the
mainbase.Checklist
dotnet build Authplane.slnx --configuration Releasepassesdotnet format Authplane.slnx --verify-no-changesis cleandotnet testpasses for affected projectsCHANGELOG.mdentry added under[Unreleased]— n/a, not user-facingFollow-ups
The labels Dependabot applies (
dependencies,dotnet,ci) now exist in the repository.conformance-catalog-drift.ymlis deliberately not included: it lives only in the private mirrors, not in the public repositories.