Repository navigation
ci: adopt the ci-baseline v1 checks - #259
Merged
Merged
Conversation
Add baseline-checks.yml, which calls the ci-baseline baseline workflow for gitleaks, CodeQL and NuGetAudit, and history-scan.yml, a manual full-history secret scan. Both pin @v1. The build job runs the coverage gate after the tests. codecov.yml takes the baseline project status, target auto with a 1 percent threshold, and keeps the informational patch status. release-please.yml gets an sbom job that attaches a CycloneDX SBOM to each release, and Directory.Build.props sets the NuGetAudit properties so a local restore reports what CI reports.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopts the shared ci-baseline v1 checks: gitleaks, CodeQL and NuGetAudit on every pull request, a line coverage floor in the build job, and a CycloneDX SBOM on each release.
Type of Change
feat— New featurefix— Bug fixperf— Performance improvementrefactor— Code refactoring (no behavior change)docs— Documentation onlytest— Adding or updating testsbuild/ci— Build system or CI changeschore— MaintenanceChanges
baseline-checks.ymlcallsbaseline.yml@v1as the jobbaseline: gitleaks on pull requests, CodeQL for C#, and NuGetAudit onZeroAlloc.Serialisation.slnxwith the SDK fromglobal.json.history-scan.ymlis a manual full-history secret scan. It reads the optionalGITLEAKS_CONFIGsecret.buildjob runscoverage-gate@v1right after the test step, on the reports inTestResults/. The floor is 80 percent line coverage.codecov.ymltakes the baseline project status:target: autowith a 1 percent threshold, no longer informational. The informational 80 percent patch status and the comment layout stay, because the gate governs only the project status.benchmarks/**joins the ignore list.release-please.ymlgets ansbomjob. When release-please creates a release, it checks out the release tag, builds it and attaches a CycloneDX SBOM to that release. The shared publish workflow cannot take an extra step, so this runs as its own job.Directory.Build.propssets the NuGetAudit properties so a local restore shows what CI shows.There was no
.github/dependabot.ymland no committed.gitleaks.toml.Breaking Changes
None
Test Plan
baseline / gitleaks,baseline / codeql (csharp),baseline / nuget-auditandbuildwith the coverage gate.sbomjob runs on the next release.Checklist
After merge
Add the required checks to the
mainruleset:baseline / gitleaks,baseline / codeql (csharp),baseline / nuget-auditandbuild.codecov/projectfollows once it reports in this org.