From dfae955d044dac35b846050cbb9f5e9a1c55c44f Mon Sep 17 00:00:00 2001 From: Georgios Smyrlis Date: Wed, 17 Jun 2026 23:01:39 +0200 Subject: [PATCH 1/2] Add CI workflow and v1 roadmap --- .github/dependabot.yml | 27 +++++++++++++++++++ .github/workflows/ci.yml | 57 ++++++++++++++++++++++++++++++++++++++++ README.md | 2 ++ 3 files changed, 86 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/ci.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..50c035e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +version: 2 + +updates: + # .NET / NuGet package references across the solution. + - package-ecosystem: nuget + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + # Bundle minor and patch bumps into a single weekly PR to cut noise; major bumps stay + # individual so a potentially breaking update gets its own review. + groups: + nuget-minor-and-patch: + update-types: + - minor + - patch + + # GitHub Actions used by the workflows. Few and low-risk, so group them into one PR. + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + open-pull-requests-limit: 5 + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..5192170 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,57 @@ +name: CI + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + +# Least privilege: the build only needs to read the repository. No publishing, no secrets. +permissions: + contents: read + +# Cancel superseded runs on the same ref to save CI minutes. +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + build-test: + name: Build & Test + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup .NET 8 + uses: actions/setup-dotnet@v4 + with: + # Floats to the latest 8.0 patch (picks up SDK security fixes) while staying on the + # net8.0 target line the projects build against. No global.json to maintain. + dotnet-version: 8.0.x + + - name: Restore + run: dotnet restore + + - name: Build + run: dotnet build -c Release --no-restore + + - name: Test + run: dotnet test -c Release --no-build + + # Pack runs only on push to main: it validates packaging (the bundled netstandard2.0 analyzer + # and package validation) without publishing anything. Release is required because the EF Core + # package picks up the analyzer DLL from its bin/Release output. + - name: Pack (validation only, no publish) + if: github.event_name == 'push' + run: dotnet pack -c Release --no-build --output artifacts + + - name: Upload packages + if: github.event_name == 'push' + uses: actions/upload-artifact@v4 + with: + name: nuget-packages + path: | + artifacts/*.nupkg + artifacts/*.snupkg + if-no-files-found: error diff --git a/README.md b/README.md index db438f7..243469a 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # Proteos — Application Layer Encryption for .NET +[![CI](https://github.com/ProteosEncryption/Proteos.Encryption/actions/workflows/ci.yml/badge.svg)](https://github.com/ProteosEncryption/Proteos.Encryption/actions/workflows/ci.yml) + Encrypt sensitive entity fields **in the application**, before they reach the database, blob storage or any cloud system. A database, backup or storage leak then exposes only ciphertext — not your customers' data. From f5ce3a37deaaec7475b5b2d53df82df8b089f82d Mon Sep 17 00:00:00 2001 From: Georgios Smyrlis Date: Fri, 19 Jun 2026 11:17:01 +0200 Subject: [PATCH 2/2] Add public API surface guidance to CONTRIBUTING.md --- CONTRIBUTING.md | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index de69c17..fd0bfe5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -15,6 +15,45 @@ The cryptographic core, the `PENC` envelope format and the key model are stable. crypto behaviour, the envelope format, or the public API without opening an issue and agreeing on the approach first. Extensions should be additive (a new `SuiteId`, `AadSchemeId`, key version, or package). +## Public API surface + +The packable libraries track their public API with `Microsoft.CodeAnalysis.PublicApiAnalyzers`. Each +project carries two files: + +- `PublicAPI.Shipped.txt` — API that has already been published. +- `PublicAPI.Unshipped.txt` — public API added since the last release, not yet published. + +Every public type and member must appear in one of these files, so any change to the public surface shows +up as a deliberate diff in your pull request. The analyzer fails the build (these diagnostics are errors) +when the files and the code disagree: + +- **`RS0016`** — a public API exists in the code but is not declared in the files. Add it. +- **`RS0017`** — a public API is declared in the files but no longer exists in the code. Remove it. + +What to do: + +- **Adding public API:** add the new entries to that project's `PublicAPI.Unshipped.txt`. +- **Removing or changing public API before 1.0** (still allowed while on `0.x`): adjust + `PublicAPI.Shipped.txt` accordingly and explain the breaking change clearly in the pull request. +- **After 1.0:** avoid breaking changes — the public surface is frozen for the major version (a + PackageValidation baseline will additionally enforce this later). + +A plain build reports the diagnostics: + +``` +dotnet build -c Release +``` + +To regenerate the entries, run this **from the project's own folder** (a solution-wide run has not +reliably populated every project): + +``` +dotnet format analyzers --diagnostics RS0016 +``` + +Do **not** update the `PublicAPI.*.txt` files blindly just to make the build green — the diff is part of +the review, and an unexpected entry usually means a type or member was made public by accident. + ## Coding style Match the existing style: explicit and small responsibilities, `sealed` by default, nullable reference