From 827b1e76decb94d8c83104400744cd6485a650be Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Thu, 1 Oct 2026 06:46:44 +0000
Subject: [PATCH 1/4] ci(tics): add weekly TICS analysis

---
 .github/workflows/tics.yaml | 49 +++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 .github/workflows/tics.yaml

diff --git a/.github/workflows/tics.yaml b/.github/workflows/tics.yaml
new file mode 100644
index 00000000000..6d0c7a48355
--- /dev/null
+++ b/.github/workflows/tics.yaml
@@ -0,0 +1,49 @@
+name: TICS
+
+on:
+  schedule:
+    - cron: "0 3 * * 2"
+  workflow_dispatch:
+
+jobs:
+  tics:
+    name: TICS
+    runs-on: self-hosted-linux-amd64-noble-large-tiobe
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Build & layout
+        working-directory: src
+        run: ./dev.sh layout Release linux-x64
+
+      - name: Run L0 tests with coverage
+        working-directory: src
+        run: |
+          # dev.sh installs its own SDK under _dotnetsdk/<version>
+          DOTNET_DIR="$(dirname "$(ls "${GITHUB_WORKSPACE}"/_dotnetsdk/*/dotnet | head -n1)")"
+          export PATH="${DOTNET_DIR}:${HOME}/.dotnet/tools:${PATH}"
+          dotnet tool install --global dotnet-coverage
+          dotnet-coverage collect --output-format cobertura \
+            --output "${GITHUB_WORKSPACE}/.coverage/cobertura.xml" "./dev.sh test"
+
+      - name: Locate .NET SDK
+        if: ${{ !cancelled() }}
+        run: echo "DOTNET_ROOT=$(dirname "$(ls "${GITHUB_WORKSPACE}"/_dotnetsdk/*/dotnet | head -n1)")" >> "$GITHUB_ENV"
+
+      - name: TICS GitHub Action
+        if: ${{ !cancelled() }}
+        uses: tiobe/tics-github-action@v3
+        with:
+          mode: qserver
+          project: github-actions-runner
+          branchdir: ${{ github.workspace }}
+          viewerUrl: https://canonical.tiobe.com/tiobeweb/TICS/api/cfg?name=default
+          ticsAuthToken: ${{ secrets.TICSAUTHTOKEN }}
+          installTics: true
+
+concurrency:
+  group: tics
+  cancel-in-progress: false

From 12b32e03de9daf831d7eafe080da631f3399035c Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Thu, 1 Oct 2026 06:49:38 +0000
Subject: [PATCH 2/4] ci(tics): make dotnet tool install idempotent

---
 .github/workflows/tics.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tics.yaml b/.github/workflows/tics.yaml
index 6d0c7a48355..4ee73b069fd 100644
--- a/.github/workflows/tics.yaml
+++ b/.github/workflows/tics.yaml
@@ -25,7 +25,7 @@ jobs:
           # dev.sh installs its own SDK under _dotnetsdk/<version>
           DOTNET_DIR="$(dirname "$(ls "${GITHUB_WORKSPACE}"/_dotnetsdk/*/dotnet | head -n1)")"
           export PATH="${DOTNET_DIR}:${HOME}/.dotnet/tools:${PATH}"
-          dotnet tool install --global dotnet-coverage
+          dotnet tool update --global dotnet-coverage
           dotnet-coverage collect --output-format cobertura \
             --output "${GITHUB_WORKSPACE}/.coverage/cobertura.xml" "./dev.sh test"
 

From 9c4fe8931b8e5d516358f8b722a9921f996d23e9 Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Thu, 1 Oct 2026 07:12:49 +0000
Subject: [PATCH 3/4] ci(tics): restrict GITHUB_TOKEN to read-only contents

---
 .github/workflows/tics.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/tics.yaml b/.github/workflows/tics.yaml
index 4ee73b069fd..bc63f76c954 100644
--- a/.github/workflows/tics.yaml
+++ b/.github/workflows/tics.yaml
@@ -5,6 +5,9 @@ on:
     - cron: "0 3 * * 2"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   tics:
     name: TICS

From 24580c6fb880257015bf062c51cd6cbe1f428112 Mon Sep 17 00:00:00 2001
From: Christopher Bartz <christopher.bartz@canonical.com>
Date: Thu, 1 Oct 2026 07:24:41 +0000
Subject: [PATCH 4/4] ci(tics): run only on main and skip analysis when tests
 fail

---
 .github/workflows/tics.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/tics.yaml b/.github/workflows/tics.yaml
index bc63f76c954..026656611a6 100644
--- a/.github/workflows/tics.yaml
+++ b/.github/workflows/tics.yaml
@@ -11,6 +11,7 @@ permissions:
 jobs:
   tics:
     name: TICS
+    if: github.ref == 'refs/heads/main'
     runs-on: self-hosted-linux-amd64-noble-large-tiobe
     timeout-minutes: 120
     steps:
@@ -33,11 +34,9 @@ jobs:
             --output "${GITHUB_WORKSPACE}/.coverage/cobertura.xml" "./dev.sh test"
 
       - name: Locate .NET SDK
-        if: ${{ !cancelled() }}
         run: echo "DOTNET_ROOT=$(dirname "$(ls "${GITHUB_WORKSPACE}"/_dotnetsdk/*/dotnet | head -n1)")" >> "$GITHUB_ENV"
 
       - name: TICS GitHub Action
-        if: ${{ !cancelled() }}
         uses: tiobe/tics-github-action@v3
         with:
           mode: qserver