Sync with TemplateDotNetLibrary: workflow comments, self-validation, artifact naming, OTS requirements, semantic IDs

[Copilot]

Brings SpdxModel in line with recent TemplateDotNetLibrary template updates across six areas: structured workflow section comments, OTS tool self-validation, unified artifact naming, OTS Software requirements, semantic requirement IDs, and tool version updates.

Description

.github/workflows/build.yaml

• Added # === SECTION HEADER === structured comments to all four jobs
• Unified all job outputs into an artifacts/ directory; test results, version captures, CodeQL SARIF, and self-validation TRXs all land there
• Renamed artifacts: artifacts-quality, artifacts-build-{os}, artifacts-codeql, packages-{os}
• Added OTS --validate --results self-validation steps:
  • quality-checks / build: VersionMark
  • build-docs: ReqStream, BuildMark, VersionMark, SarifMark, SonarMark
• Simplified build-docs artifact download to single pattern: 'artifacts-*' with merge-multiple: true
• Removed title.txt positional args from Pandoc steps (now declared in definition.yaml)
• Updated reqstream --tests glob to artifacts/**/*.trx; CodeQL output dir to artifacts
• VersionMark publish path updated to "artifacts/**/versionmark-*.json"

.github/workflows/release.yaml

• Package artifact download name: artifacts-ubuntu-latest → packages-ubuntu-latest

.config/dotnet-tools.json

• Bumped demaconsulting.reqstream from 1.3.0 to 1.4.0 (required for --validate --results OTS self-validation)

docs/*/definition.yaml

• Added title.txt to input-files in: guide, quality, requirements, justifications, tracematrix
• Added docs/buildnotes/versions.md to buildnotes/definition.yaml

requirements.yaml

• Replaced all numeric requirement IDs (e.g. REQ-SER-001) with SpdxModel-{Section}-{Description} semantic IDs (e.g. SpdxModel-Ser-Deserialize22Json, SpdxModel-Plt-Net8)
• Shortened platform requirement IDs: SpdxModel-Plt-Net8, SpdxModel-Plt-Net9, SpdxModel-Plt-Net10, SpdxModel-Plt-NetStd20
• Added OTS Software section with SpdxModel-OTS-* requirements for MSTest, ReqStream, BuildMark, VersionMark, SarifMark, and SonarMark, each linked to the self-validation test names those tools emit

AGENTS.md

• Fixed encoding description from UTF-8+BOM → UTF-8 (matching the actual .editorconfig charset = utf-8 setting)
• Updated reqstream test path from test-results/**/*.trx → artifacts/**/*.trx

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code quality improvement

Pre-Submission Checklist

Before submitting this pull request, ensure you have completed the following:

Build and Test

• Code builds successfully: dotnet build --configuration Release
• All unit tests pass: dotnet test --configuration Release
• Code produces zero warnings

Code Quality

• Code formatting is correct: dotnet format --verify-no-changes
• New code has appropriate XML documentation comments
• Static analyzer warnings have been addressed

Quality Checks

Please run the following checks before submitting:

• Spell checker passes: cspell "**/*.{md,cs}"
• Markdown linter passes: markdownlint "**/*.md"
• YAML linter passes: yamllint .

Testing

• Added unit tests for new functionality
• Updated existing tests if behavior changed
• All tests follow the AAA (Arrange, Act, Assert) pattern
• Test coverage is maintained or improved

Documentation

• Updated README.md (if applicable)
• Added code examples for new features (if applicable)
• Updated requirements.yaml (if applicable)
• Updated XML documentation comments for changed APIs

Additional Notes

OTS self-validation TRX files are consumed by ReqStream's --enforce check to satisfy the new SpdxModel-OTS-* requirements. The test names (VersionMark_CapturesVersions, ReqStream_EnforcementMode, etc.) must match what each tool emits when run with --validate. ReqStream 1.4.0 is required to support the --validate --results flag used in the self-validation steps.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Malcolmnixon]

Are you sure you merged in all the changes by inspecting the PRs - the requirements are numeric not semantic IDs. What else did you miss?

[Copilot]

Are you sure you merged in all the changes by inspecting the PRs - the requirements are numeric not semantic IDs. What else did you miss?

Done in commit a731483. All 30 requirement IDs now follow the SpdxModel-{Section}-{Description} pattern (e.g. SpdxModel-Plt-DotNet8, SpdxModel-Ser-Deserialize22Json, SpdxModel-OTS-MSTest).

I also applied the other missed changes from the template PRs:

• AGENTS.md: Fixed encoding description from UTF-8+BOM → UTF-8 (matching the actual .editorconfig charset = utf-8 setting) and updated the reqstream test path to artifacts/**/*.trx

[Malcolmnixon]

@copilot Somehow when reviewing the pull requests of the template, you forgot to apply the update to ReqStream 1.4.0 required to provide OTS Software requirements evidence - what else did you miss?

[Copilot]

@copilot Somehow when reviewing the pull requests of the template, you forgot to apply the update to ReqStream 1.4.0 required to provide OTS Software requirements evidence - what els...

Fixed in commit 045c23b — bumped demaconsulting.reqstream from 1.3.0 to 1.4.0 in .config/dotnet-tools.json. Version 1.4.0 is required for the --validate --results flag used in the OTS self-validation steps.

[Malcolmnixon]

Let's change this to "SpdxModel-Plt-Net8" - shorter description - same for the other platform requirements.

[Copilot]

Done in f45fbde — renamed to SpdxModel-Plt-Net8, SpdxModel-Plt-Net9, SpdxModel-Plt-Net10, and SpdxModel-Plt-NetStd20.

[Malcolmnixon]

Lets change this to "SpdxMode-Plt-NetStd20"

[Copilot]

Done in f45fbde — renamed to SpdxModel-Plt-NetStd20 (and shortened the other .NET platform IDs in the same commit).