feat: Update GitHub Actions workflow to improve CI permissions and version handling

Author: jongalloway

.github/workflows/build.yml

@@ -1,49 +1,74 @@
-name: Build and Test
+name: .NET Build and Test
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
 
 on:
   push:
-    branches: [ main ]
-    tags: [ 'v*' ]
+    branches: [ main, develop ]
+    tags: [ 'v*' ]  # Trigger on version tags
   pull_request:
-    branches: [ main ]
+    branches: [ main, develop ]
 
 env:
-  DOTNET_VERSION: '9.x'
-  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 'true'
-  DOTNET_CLI_TELEMETRY_OPTOUT: 'true'
+  DOTNET_VERSION: '9.0.x'
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  CI: true
 
 jobs:
+  # Check if we should skip build for markdown-only changes
   check-changes:
     runs-on: ubuntu-latest
     outputs:
-      should-skip: ${{ steps.skip-check.outputs.should_skip }}
+      should-skip: ${{ steps.skip-check.outputs.should-skip }}
+      paths-result: ${{ steps.skip-check.outputs.paths-result }}
     steps:
-    - id: skip-check
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Check for non-markdown changes
+      id: skip-check
       uses: fkirc/skip-duplicate-actions@v5
       with:
-        concurrent_skipping: 'same_content_newer'
-        skip_after_successful_duplicate: 'true'
-        paths_ignore: '["**/*.md", "**/docs/**"]'
+        # Skip if only markdown files changed
+        paths_ignore: '["**/*.md", "doc/**", "**/README*", "**/CHANGELOG*", "**/LICENSE*"]'        # Don't skip on main branch or tags
+        skip_after_successful_duplicate: 'false'
 
+  # Simple job for markdown-only changes
+  markdown-check:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: needs.check-changes.outputs.should-skip == 'true'
+    steps:
+    - name: Documentation changes only
+      run: |
+        echo "✅ Only documentation files were changed - skipping build"
+        echo "📝 Changes detected in markdown files only"
   build:
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     needs: check-changes
     if: needs.check-changes.outputs.should-skip != 'true'
 
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        configuration: [Release]
-
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      with:
+        fetch-depth: 0 # Shallow clones should be disabled for better analysis
 
     - name: Setup .NET
       uses: actions/setup-dotnet@v4
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
+    - name: Display .NET info
+      run: dotnet --info
+
     - name: Cache NuGet packages
       uses: actions/cache@v4
       with:
@@ -56,7 +81,7 @@ jobs:
       run: dotnet restore
 
     - name: Build solution
-      run: dotnet build --configuration ${{ matrix.configuration }} --no-restore --verbosity minimal
+      run: dotnet build --configuration Release --no-restore --verbosity minimal
 
     - name: Test solution
       run: |
@@ -65,7 +90,7 @@ jobs:
         
         if [ -n "$TEST_PROJECTS" ]; then
           echo "Found test projects, running tests..."
-          dotnet test --configuration ${{ matrix.configuration }} --no-build --verbosity minimal --logger "trx;LogFileName=test-results-${{ matrix.configuration }}.trx" --results-directory TestResults/
+          dotnet test --configuration Release --no-build --verbosity minimal --logger "trx;LogFileName=test-results-Release.trx" --results-directory TestResults/
         else
           echo "No test projects found - skipping tests"
           mkdir -p TestResults
@@ -74,33 +99,60 @@ jobs:
       continue-on-error: false
 
     - name: Build demo application
-      run: dotnet build demo --configuration ${{ matrix.configuration }} --no-restore --verbosity minimal
+      run: dotnet build demo --configuration Release --no-restore --verbosity minimal
 
     - name: Publish test results
       uses: dorny/test-reporter@v1
       if: success() || failure()
       with:
-        name: Test Results (${{ matrix.configuration }})
+        name: Test Results (Release)
         path: TestResults/*.trx
         reporter: dotnet-trx
         fail-on-error: false
         fail-on-empty: false
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Upload build artifacts
-      if: matrix.configuration == 'Release'
       uses: actions/upload-artifact@v4
       with:
-        name: build-artifacts-${{ matrix.os }}
+        name: build-artifacts-Release
         path: |
-          src/*/bin/Release/
+          src/NLWebNet/bin/Release/
           demo/bin/Release/
         retention-days: 7
 
-  security-scan:
+  code-quality:
     runs-on: ubuntu-latest
-    needs: check-changes
+    needs: [check-changes, build]
     if: needs.check-changes.outputs.should-skip != 'true'
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNET_VERSION }}
 
+    - name: Restore dependencies
+      run: dotnet restore
+
+    - name: Run code analysis
+      run: |
+        dotnet build --configuration Release --verbosity minimal --warnaserror
+        
+    - name: Check formatting
+      run: dotnet format --verify-no-changes --verbosity diagnostic
+
+  security-scan:
+    runs-on: ubuntu-latest
+    needs: [check-changes, build]
+    if: needs.check-changes.outputs.should-skip != 'true'
+    
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -122,7 +174,6 @@ jobs:
         else
           echo "✅ No vulnerable packages found."
         fi
-
   package-validation:
     runs-on: ubuntu-latest
     needs: [check-changes, build]
@@ -137,9 +188,6 @@ jobs:
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
-    - name: Fetch all tags for versioning
-      run: git fetch --tags --force
-
     - name: Restore dependencies
       run: dotnet restore
 
@@ -150,9 +198,7 @@ jobs:
         if [[ $GITHUB_REF == refs/tags/v* ]]; then
           # Extract version from tag (remove 'v' prefix)
           VERSION=${GITHUB_REF#refs/tags/v}
-          echo "📦 Using tag version: ${VERSION}"
-          IS_RELEASE_TAG="true"
-        else
+          echo "📦 Using tag version: ${VERSION}"        else
           # Get the latest git tag or use 0.1.0 as default
           LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v0.1.0")
           
@@ -164,25 +210,9 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           VERSION="${VERSION}-alpha.${COMMITS_SINCE_TAG}+${SHORT_SHA}"
           echo "📦 Using development version: ${VERSION}"
-          IS_RELEASE_TAG="false"
-        fi
-        
-        echo "version=${VERSION}" >> $GITHUB_OUTPUT
-        echo "is_release_tag=${IS_RELEASE_TAG}" >> $GITHUB_OUTPUT
-
-    - name: Check version output
-      run: |
-        if [ -z "${{ steps.version.outputs.version }}" ]; then
-          echo "❌ PackageVersion is not set!"
-          echo "Debug info:"
-          echo "GITHUB_REF: $GITHUB_REF"
-          echo "Available tags:"
-          git tag -l
-          exit 1
-        else
-          echo "✅ PackageVersion: ${{ steps.version.outputs.version }}"
-          echo "✅ Is release tag: ${{ steps.version.outputs.is_release_tag }}"
         fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+        echo "is_release_tag=$([[ $GITHUB_REF == refs/tags/v* ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
 
     - name: Build (Release) for packaging
       run: dotnet build src/NLWebNet --configuration Release --no-restore --verbosity minimal
@@ -223,3 +253,5 @@ jobs:
         tag_name: ${{ github.ref_name }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+

doc/todo.md

@@ -510,6 +510,7 @@ Comprehensive testing and validation infrastructure has been implemented coverin
     - [x] ✅ Verify symbols package (.snupkg) generation - Package ready
     - [x] ✅ Confirm README.md and metadata inclusion - All metadata validated
     - [x] ✅ Fix CI versioning issue - Updated GitHub Actions workflow with proper version determination and validation
+    - [x] ✅ Fix CI permissions issue - Added checks: write permissions and GITHUB_TOKEN for test-reporter action
   - [x] ✅ **COMPLETED**: Update documentation with confirmed usage patterns
 
 ### Phase 11: Deployment & Production Readiness