Promote develop to main

.config/dotnet-tools.json

@@ -1,27 +1,27 @@
-{
-  "version": 1,
-  "isRoot": true,
-  "tools": {
-    "csharpier": {
-      "version": "1.3.0",
-      "commands": [
-        "csharpier"
-      ],
-      "rollForward": false
-    },
-    "husky": {
-      "version": "0.9.1",
-      "commands": [
-        "husky"
-      ],
-      "rollForward": false
-    },
-    "dotnet-outdated-tool": {
-      "version": "4.8.1",
-      "commands": [
-        "dotnet-outdated"
-      ],
-      "rollForward": false
-    }
-  }
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "csharpier": {
+      "version": "1.3.0",
+      "commands": [
+        "csharpier"
+      ],
+      "rollForward": false
+    },
+    "husky": {
+      "version": "0.9.1",
+      "commands": [
+        "husky"
+      ],
+      "rollForward": false
+    },
+    "dotnet-outdated-tool": {
+      "version": "4.8.1",
+      "commands": [
+        "dotnet-outdated"
+      ],
+      "rollForward": false
+    }
+  }
 }

.editorconfig-checker.json

@@ -1,10 +1,17 @@
-{
-  "Disable": {
-    "Charset": true,
-    "Indentation": true,
-    "IndentSize": true,
-    "TrimTrailingWhitespace": true,
-    "InsertFinalNewline": true,
-    "MaxLineLength": true
-  }
-}
+{
+  "Exclude": [
+    "(^|/)__pycache__/",
+    "(^|/)\\.mypy_cache/",
+    "(^|/)\\.pytest_cache/",
+    "(^|/)\\.ruff_cache/",
+    "(^|/)\\.venv/"
+  ],
+  "Disable": {
+    "Charset": true,
+    "Indentation": true,
+    "IndentSize": true,
+    "TrimTrailingWhitespace": true,
+    "InsertFinalNewline": true,
+    "MaxLineLength": true
+  }
+}

.gitattributes

@@ -1,22 +1,11 @@
-# Default: do not normalize line endings (`* -text`); .editorconfig end_of_line rules guide what the editor writes.
-# The exception pins below are git's own enforcement - they force LF for execution-sensitive classes regardless of editor.
-# git config --global core.autocrlf false
-# git add --renormalize .
-# git ls-files --eol
-* -text
-
-# Exception: scripts must stay LF regardless of the `* -text` default - a CRLF shebang breaks execution. `.editorconfig`
-# covers `*.sh`, but extensionless executables (s6 service scripts, hooks) match no extension rule, so pin them here so
-# git enforces LF on checkout and `--renormalize`. A repo shipping extensionless scripts adds an explicit path rule,
-# e.g. for s6-overlay init: `Docker/s6-overlay/** text eol=lf`.
-*.sh text eol=lf
-
-# Dockerfiles must be LF - a CRLF breaks RUN heredocs and line continuations.
-Dockerfile text eol=lf
-*.Dockerfile text eol=lf
-
-# Extensionless executables must stay LF - a CRLF shebang breaks execution. The Husky.Net git hook matches no extension rule.
-.husky/pre-commit text eol=lf
-
-# LanguageData/ holds downloaded source data the parser reads byte-for-byte; never normalize it. The `* -text` default
-# above preserves it exactly as downloaded - do NOT add a `text`/`eol=` rule here.
+# Normalize every detected text file to LF in the index and on checkout.
+# `text=auto` leaves binary files byte-preserved.
+* text=auto eol=lf
+
+# Windows batch and command scripts require CRLF.
+*.bat text eol=crlf
+*.cmd text eol=crlf
+
+# LanguageData/ holds downloaded source data the parser reads byte-for-byte; never normalize it,
+# overriding the `* text=auto eol=lf` default above.
+LanguageData/** -text

.github/dependabot.yml

@@ -1,57 +1,57 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-#
-# Every ecosystem is listed twice, target-branch main and develop, so Dependabot opens parallel PRs that keep
-# both branches current independently. main is listed because consumers (NuGet.org, GitHub releases) pull from
-# it directly, and the develop -> main release gap can be long, so main must not wait for a promotion to get its
-# dependency bumps. The codegen workflow takes the same dual-target shape for the same reason.
-#
-# The merge-bot (.github/workflows/merge-bot-pull-request.yml) picks the merge method per base (squash on
-# develop, merge on main) and auto-merges both. develop is forward-only: no main -> develop back-merges, each
-# branch absorbs its own bot PRs. Dependabot opens CVE security PRs against the default branch (main) whatever
-# the target-branch, and the merge-bot handles them in the same path.
-version: 2
-updates:
-
-  # ----- nuget -----
-
-  - package-ecosystem: "nuget"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "nuget"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-
-  # ----- github-actions -----
-
-  - package-ecosystem: "github-actions"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "github-actions"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+#
+# Every ecosystem is listed twice, target-branch main and develop, so Dependabot opens parallel PRs that keep
+# both branches current independently. main is listed because consumers (NuGet.org, GitHub releases) pull from
+# it directly, and the develop -> main release gap can be long, so main must not wait for a promotion to get its
+# dependency bumps. The codegen workflow takes the same dual-target shape for the same reason.
+#
+# The merge-bot (.github/workflows/merge-bot-pull-request.yml) picks the merge method per base (squash on
+# develop, merge on main) and auto-merges both. develop is forward-only: no main -> develop back-merges, each
+# branch absorbs its own bot PRs. Dependabot opens CVE security PRs against the default branch (main) whatever
+# the target-branch, and the merge-bot handles them in the same path.
+version: 2
+updates:
+
+  # ----- nuget -----
+
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "nuget"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  # ----- github-actions -----
+
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/workflows/build-release-task.yml

@@ -43,14 +43,14 @@ jobs:
     steps:
 
       - name: Setup .NET SDK step
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.x
 
       # Default checkout: the triggering commit on its real branch. NBGV classifies from GITHUB_REF
       # directly. fetch-depth: 0 gives NBGV the full history for the version height.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -101,14 +101,14 @@ jobs:
     steps:
 
       - name: Setup .NET SDK step
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.x
 
       # Pin to the versioned commit so the package and the release tag match even if the branch advances
       # mid-run. This is a compile checkout only, NBGV already ran in get-version.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 
@@ -177,7 +177,7 @@ jobs:
 
       # Same versioned commit (GitCommitId) the build used, so the release tag and files match it.
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.get-version.outputs.GitCommitId }}
 

.github/workflows/merge-bot-pull-request.yml

@@ -1,22 +1,18 @@
 name: Merge bot pull request action
 
-# Enables auto-merge on bot pull requests (Dependabot and codegen) and disables it when a maintainer
-# pushes to a bot branch. Auto-merge completes only once the required checks pass, so a breaking update
-# blocks itself. Merge method follows the base: squash for develop, merge commit for main.
-#
-# Every job mints an App token. The built-in GITHUB_TOKEN will not do: its merge commits do not trigger
-# downstream workflows (GitHub's recursion guard), and on a Dependabot pull request it is read-only.
-#
-# Trigger is pull_request_target, not pull_request, so action SHAs resolve from the base branch while the
-# jobs hold the App key. Safe because this workflow never checks out PR code, it only runs `gh pr merge`
-# against the PR URL.
+# Auto-merges in-repo bot PRs (Dependabot, codegen): enable on opened/reopened, disable on a maintainer push.
+# Carried from the fleet reference trimmed to the jobs this repo needs (no upstream-version tracker).
+# - Merge method by base: develop = squash, main = merge.
+# - App token, not GITHUB_TOKEN: fires downstream workflows on merge, and grants write on read-only Dependabot PRs.
+# - pull_request_target, not pull_request: jobs hold the App key, so the workflow + action SHAs resolve from the
+#   trusted base, not PR head. Safe because no job checks out PR code (each runs gh pr merge by URL).
 on:
   pull_request_target:
     types: [opened, reopened, synchronize]
 
-# Key on the PR number, not github.ref (the base branch under pull_request_target, which would serialize
-# every bot PR). cancel-in-progress: false so a synchronize does not cancel an in-flight opened run before
-# it enables auto-merge.
+# Concurrency keys on the PR number, not github.ref (the base branch under pull_request_target, which would
+# serialize every bot PR against it), so each PR queues independently. cancel-in-progress: false so a follow-up
+# synchronize doesn't cancel an in-flight opened run before it enables auto-merge.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: false
@@ -26,8 +22,7 @@ jobs:
   merge-dependabot:
     name: Merge dependabot pull request job
     runs-on: ubuntu-latest
-    # In-repo Dependabot PRs only, on opened/reopened so the disable job stays sticky. Every tier
-    # auto-merges, semver-major included: the required checks are the gate, not the version bump.
+    # Dependabot PRs from this repo (not forks). Only on opened/reopened so the disable job stays sticky.
     if: >-
       (github.event.action == 'opened' || github.event.action == 'reopened') &&
       github.event.pull_request.user.login == 'dependabot[bot]' &&
@@ -45,24 +40,28 @@ jobs:
           client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
           private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
 
+      # Auto-merge every tier, semver-major included: the required checks are the gate, not the bump magnitude.
       - name: Merge pull request step
         run: |
           set -euo pipefail
           case "${{ github.event.pull_request.base.ref }}" in
             develop) method=--squash ;;
             main) method=--merge ;;
-            *) echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"; exit 1 ;;
+            *)
+              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
+              exit 1
+              ;;
           esac
-          gh pr merge --auto --delete-branch "$method" "$PR_URL"
+          gh pr merge --auto "$method" "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
   merge-codegen:
     name: Merge codegen pull request job
     runs-on: ubuntu-latest
-    # In-repo codegen PRs, on opened/reopened, with the head/base pairing pinned
-    # (codegen-main -> main, codegen-develop -> develop).
+    # Codegen PRs from this repo. Head/base pairing is enforced strictly (codegen-main->main, codegen-develop->
+    # develop). Only on opened/reopened so the disable job stays sticky.
     if: >-
       (github.event.action == 'opened' || github.event.action == 'reopened') &&
       github.event.pull_request.user.login == 'ptr727-codegen[bot]' &&
@@ -90,18 +89,21 @@ jobs:
           case "${{ github.event.pull_request.base.ref }}" in
             develop) method=--squash ;;
             main) method=--merge ;;
-            *) echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"; exit 1 ;;
+            *)
+              echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"
+              exit 1
+              ;;
           esac
-          gh pr merge --auto --delete-branch "$method" "$PR_URL"
+          gh pr merge --auto "$method" "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
   disable-auto-merge-on-maintainer-push:
     name: Disable auto-merge on maintainer push job
     runs-on: ubuntu-latest
-    # A maintainer push to a bot branch (synchronize, actor is not the bot) disables auto-merge so the
-    # maintainer's commits do not merge with the bot's. Re-enable manually. The disable call is idempotent.
+    # Fires when a maintainer pushes to a bot's branch (synchronize, actor != bot). Disables auto-merge so the
+    # maintainer's commits don't merge with the bot's, and they re-enable it manually. The disable call is idempotent.
     if: >-
       github.event.action == 'synchronize' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
@@ -116,6 +118,7 @@ jobs:
     steps:
 
       - name: Generate GitHub App token step
+        # App token because a Dependabot PR's GITHUB_TOKEN is read-only regardless of who triggered the event.
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:

.github/workflows/run-codegen-pull-request-task.yml

@@ -43,12 +43,12 @@ jobs:
           private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
 
       - name: Setup .NET SDK step
-        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.x
 
       - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.target.ref }}
           token: ${{ steps.app-token.outputs.token }}