diff --git a/.github/workflows/nuget-reference-check.yml b/.github/workflows/nuget-reference-check.yml index 1c2a50972..f66ddc315 100644 --- a/.github/workflows/nuget-reference-check.yml +++ b/.github/workflows/nuget-reference-check.yml @@ -31,9 +31,10 @@ jobs: set -e # Deliberately floored to an LTS version so that redistributable libraries do not impose a - # high minimum on downstream consumers (see issue #328). They are by design permanently - # "outdated", so they are excluded from the outdated signal only - the --deprecated and - # --vulnerable steps below do not use this filter. + # high minimum on downstream consumers. The list below mirrors the floored packages + # declared in Directory.Packages.props - keep the two in step. They are by design + # permanently "outdated", so they are excluded from the outdated signal only - the + # --deprecated and --vulnerable steps below do not use this filter. IGNORE_PACKAGES="Microsoft\.NETCore\.Platforms|Microsoft\.NETCore\.Targets|Microsoft\.Extensions\.Logging\.Abstractions|Microsoft\.Extensions\.DependencyInjection\.Abstractions|System\.Collections\.Immutable|System\.IO\.Pipelines" # Full report for the workflow logs only, including transitive packages diff --git a/CLAUDE.md b/CLAUDE.md index e4f141574..90ebf980f 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -36,6 +36,20 @@ dotnet-coverage collect "dotnet test SysML2.NET.sln --no-build" -f xml -o covera Test framework: **NUnit** (`[TestFixture]`, `[Test]`). +## Dependency management (Central Package Management) + +`Directory.Packages.props` at the repo root owns **every** NuGet version. A `` carries `Include` only — **never `Version`**. Adding a package means adding a `` there as well. + +`Directory.Build.targets` at the repo root owns the rest: NuGet ignores asset metadata on ``, so `PrivateAssets` / `IncludeAssets` are centralized there via ``. It also sets `PackageIcon` / `PackageReadmeFile` and packs `cdp4-icon.png` and `README.md` for every project that does not set `IsPackable` to `false`. Neither belongs in a `.csproj`. + +Version policy, driven by the `netstandard2.1` target making any referenced version a floor for downstream consumers: + +- **Redistributable libraries** reference the lowest version providing the APIs used; stable framework abstractions stay at an **LTS floor**; serialization/crypto packages track current. +- **Applications and `*.Tests`** track current. +- Raise a library dependency only for (a) a required new API or (b) a CVE on that package. + +The floored packages are listed once in the comment block in `Directory.Packages.props` and mirrored in `IGNORE_PACKAGES` in `.github/workflows/nuget-reference-check.yml`. Change one, change the other. That filter suppresses the *outdated* signal only — `--deprecated` and `--vulnerable` stay strict on every package. + ## Mandatory reading **`DEVELOPMENT_STANDARDS.md`** (repo root) governs how code is written across the whole solution — production, tests, generator, scripts. Read it before authoring code in a session where you have not already done so; do not code from memory of "typical C#" or by copying a neighbouring file, since parts of this repo predate it. diff --git a/Directory.Build.targets b/Directory.Build.targets new file mode 100644 index 000000000..f679ecc92 --- /dev/null +++ b/Directory.Build.targets @@ -0,0 +1,22 @@ + + + + + + + + + + + + + cdp4-icon.png + README.md + + + + + + + + diff --git a/Directory.Packages.props b/Directory.Packages.props new file mode 100644 index 000000000..c14a9d9d2 --- /dev/null +++ b/Directory.Packages.props @@ -0,0 +1,63 @@ + + + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/README.md b/README.md index b60670bce..dd6987195 100644 --- a/README.md +++ b/README.md @@ -45,6 +45,20 @@ Branch | Build Status Master | ![Build Status](https://github.com/STARIONGROUP/SysML2.NET/actions/workflows/CodeQuality.yml/badge.svg?branch=master) Development | ![Build Status](https://github.com/STARIONGROUP/SysML2.NET/actions/workflows/CodeQuality.yml/badge.svg?branch=development) +## Dependency management + +Every NuGet version is declared once, in [Directory.Packages.props](Directory.Packages.props), using [Central Package Management](https://learn.microsoft.com/nuget/consume-packages/central-package-management). A `` in a project carries `Include` only — never `Version`. + +[Directory.Build.targets](Directory.Build.targets) holds what `Directory.Packages.props` cannot: NuGet ignores asset metadata on ``, so the `PrivateAssets` / `IncludeAssets` of `Microsoft.Sbom.Targets`, `coverlet.collector` and `coverlet.msbuild` are centralized there through ``. The same file gives every packable project its `PackageIcon` and `PackageReadmeFile`, and packs `cdp4-icon.png` and `README.md` into the `.nupkg`; a project opts out by setting `IsPackable` to `false`. + +The redistributable libraries multi-target `netstandard2.1;net10.0`, so a referenced version is a **minimum floor** for every downstream consumer. The version policy follows from that: + +- **Libraries** (`SysML2.NET`, `SysML2.NET.Serializer.*`, `SysML2.NET.Dal`, `SysML2.NET.REST`, `SysML2.NET.Kpar`, `SysML2.NET.Extensions`, `SysML2.NET.Semantics`) reference the lowest version that provides the APIs used. Stable framework abstractions stay at an LTS floor; serialization and cryptography packages track current. +- **Applications and test projects** track current versions. +- A library dependency is raised only when a required new API needs it, or when a CVE affects that package. + +The floored packages — `Microsoft.Extensions.DependencyInjection.Abstractions`, `Microsoft.Extensions.Logging.Abstractions`, `System.Collections.Immutable`, `System.IO.Pipelines`, plus the transitive `Microsoft.NETCore.Platforms` and `Microsoft.NETCore.Targets` — are by design permanently "outdated". They are listed in `Directory.Packages.props` and mirrored in `IGNORE_PACKAGES` in [.github/workflows/nuget-reference-check.yml](.github/workflows/nuget-reference-check.yml), which suppresses the *outdated* signal only: the deprecated and vulnerable checks still cover them. + ## API conventions ### 1-based positional operations diff --git a/SySML2.NET.REST.Tests/SySML2.NET.REST.Tests.csproj b/SySML2.NET.REST.Tests/SySML2.NET.REST.Tests.csproj index 73f0401b5..50a379adb 100644 --- a/SySML2.NET.REST.Tests/SySML2.NET.REST.Tests.csproj +++ b/SySML2.NET.REST.Tests/SySML2.NET.REST.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SySML2.NET.REST/SySML2.NET.REST.csproj b/SySML2.NET.REST/SySML2.NET.REST.csproj index b4238afed..25428f8e6 100644 --- a/SySML2.NET.REST/SySML2.NET.REST.csproj +++ b/SySML2.NET.REST/SySML2.NET.REST.csproj @@ -16,20 +16,13 @@ [Update] IRestClient and RestClient aligned with the move of QueryParameters, Page and PagedResult to the SysML2.NET.PSM namespace - cdp4-icon.png - README.md true true - + - - - - - diff --git a/SysML2.NET.CodeGenerator.Tests/SysML2.NET.CodeGenerator.Tests.csproj b/SysML2.NET.CodeGenerator.Tests/SysML2.NET.CodeGenerator.Tests.csproj index 4526d5670..d6c31c55f 100644 --- a/SysML2.NET.CodeGenerator.Tests/SysML2.NET.CodeGenerator.Tests.csproj +++ b/SysML2.NET.CodeGenerator.Tests/SysML2.NET.CodeGenerator.Tests.csproj @@ -30,23 +30,17 @@ - - - - - - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - + + + + + + + + + + + diff --git a/SysML2.NET.CodeGenerator/SysML2.NET.CodeGenerator.csproj b/SysML2.NET.CodeGenerator/SysML2.NET.CodeGenerator.csproj index 55824d0bc..f92793185 100644 --- a/SysML2.NET.CodeGenerator/SysML2.NET.CodeGenerator.csproj +++ b/SysML2.NET.CodeGenerator/SysML2.NET.CodeGenerator.csproj @@ -19,11 +19,11 @@ en-US - - - - - + + + + + diff --git a/SysML2.NET.Dal.Tests/SysML2.NET.Dal.Tests.csproj b/SysML2.NET.Dal.Tests/SysML2.NET.Dal.Tests.csproj index a097b3a8a..ac79c69fe 100644 --- a/SysML2.NET.Dal.Tests/SysML2.NET.Dal.Tests.csproj +++ b/SysML2.NET.Dal.Tests/SysML2.NET.Dal.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Dal/SysML2.NET.Dal.csproj b/SysML2.NET.Dal/SysML2.NET.Dal.csproj index 9dd4043f2..fd12be44c 100644 --- a/SysML2.NET.Dal/SysML2.NET.Dal.csproj +++ b/SysML2.NET.Dal/SysML2.NET.Dal.csproj @@ -16,21 +16,15 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true - + - - - - diff --git a/SysML2.NET.Extensions.Tests/SysML2.NET.Extensions.Tests.csproj b/SysML2.NET.Extensions.Tests/SysML2.NET.Extensions.Tests.csproj index ee8ed40c5..a4b3fa527 100644 --- a/SysML2.NET.Extensions.Tests/SysML2.NET.Extensions.Tests.csproj +++ b/SysML2.NET.Extensions.Tests/SysML2.NET.Extensions.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Extensions/SysML2.NET.Extensions.csproj b/SysML2.NET.Extensions/SysML2.NET.Extensions.csproj index c98b3e13f..95b9045e4 100644 --- a/SysML2.NET.Extensions/SysML2.NET.Extensions.csproj +++ b/SysML2.NET.Extensions/SysML2.NET.Extensions.csproj @@ -16,20 +16,13 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true - - - - - - + diff --git a/SysML2.NET.Kpar.Tests/SysML2.NET.Kpar.Tests.csproj b/SysML2.NET.Kpar.Tests/SysML2.NET.Kpar.Tests.csproj index a6ef2a1e7..de54d7106 100644 --- a/SysML2.NET.Kpar.Tests/SysML2.NET.Kpar.Tests.csproj +++ b/SysML2.NET.Kpar.Tests/SysML2.NET.Kpar.Tests.csproj @@ -28,23 +28,17 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + - - - + + + diff --git a/SysML2.NET.Kpar/SysML2.NET.Kpar.csproj b/SysML2.NET.Kpar/SysML2.NET.Kpar.csproj index f59cbbb1e..d794fda9b 100644 --- a/SysML2.NET.Kpar/SysML2.NET.Kpar.csproj +++ b/SysML2.NET.Kpar/SysML2.NET.Kpar.csproj @@ -18,15 +18,13 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true - - + + @@ -36,9 +34,4 @@ - - - - - diff --git a/SysML2.NET.Semantics.Tests/SysML2.NET.Semantics.Tests.csproj b/SysML2.NET.Semantics.Tests/SysML2.NET.Semantics.Tests.csproj index c8b31c272..4e46f70b9 100644 --- a/SysML2.NET.Semantics.Tests/SysML2.NET.Semantics.Tests.csproj +++ b/SysML2.NET.Semantics.Tests/SysML2.NET.Semantics.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Semantics/SysML2.NET.Semantics.csproj b/SysML2.NET.Semantics/SysML2.NET.Semantics.csproj index fe0f3942d..fa9001b35 100644 --- a/SysML2.NET.Semantics/SysML2.NET.Semantics.csproj +++ b/SysML2.NET.Semantics/SysML2.NET.Semantics.csproj @@ -17,21 +17,14 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true - - - - - - - - + + + diff --git a/SysML2.NET.Serializer.Json.Tests/SysML2.NET.Serializer.Json.Tests.csproj b/SysML2.NET.Serializer.Json.Tests/SysML2.NET.Serializer.Json.Tests.csproj index cab681ae2..a8e8f8224 100644 --- a/SysML2.NET.Serializer.Json.Tests/SysML2.NET.Serializer.Json.Tests.csproj +++ b/SysML2.NET.Serializer.Json.Tests/SysML2.NET.Serializer.Json.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Serializer.Json/SysML2.NET.Serializer.Json.csproj b/SysML2.NET.Serializer.Json/SysML2.NET.Serializer.Json.csproj index 8e46c8a66..a1e140fef 100644 --- a/SysML2.NET.Serializer.Json/SysML2.NET.Serializer.Json.csproj +++ b/SysML2.NET.Serializer.Json/SysML2.NET.Serializer.Json.csproj @@ -16,20 +16,13 @@ [Update] Serializer and DeSerializer aligned with the move of QueryParameters, Page and PagedResult to the SysML2.NET.PSM namespace - cdp4-icon.png - README.md true true - - - - - - - + + diff --git a/SysML2.NET.Serializer.MessagePack.Tests/SysML2.NET.Serializer.MessagePack.Tests.csproj b/SysML2.NET.Serializer.MessagePack.Tests/SysML2.NET.Serializer.MessagePack.Tests.csproj index 97130f7e5..9de0dda72 100644 --- a/SysML2.NET.Serializer.MessagePack.Tests/SysML2.NET.Serializer.MessagePack.Tests.csproj +++ b/SysML2.NET.Serializer.MessagePack.Tests/SysML2.NET.Serializer.MessagePack.Tests.csproj @@ -18,20 +18,14 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Serializer.MessagePack/SysML2.NET.Serializer.MessagePack.csproj b/SysML2.NET.Serializer.MessagePack/SysML2.NET.Serializer.MessagePack.csproj index 4793750d4..83d79653c 100644 --- a/SysML2.NET.Serializer.MessagePack/SysML2.NET.Serializer.MessagePack.csproj +++ b/SysML2.NET.Serializer.MessagePack/SysML2.NET.Serializer.MessagePack.csproj @@ -15,8 +15,6 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true @@ -27,14 +25,9 @@ - - - - - - - - + + + diff --git a/SysML2.NET.Serializer.TextualNotation.Tests/SysML2.NET.Serializer.TextualNotation.Tests.csproj b/SysML2.NET.Serializer.TextualNotation.Tests/SysML2.NET.Serializer.TextualNotation.Tests.csproj index 080d52cc1..158a8a080 100644 --- a/SysML2.NET.Serializer.TextualNotation.Tests/SysML2.NET.Serializer.TextualNotation.Tests.csproj +++ b/SysML2.NET.Serializer.TextualNotation.Tests/SysML2.NET.Serializer.TextualNotation.Tests.csproj @@ -24,21 +24,15 @@ - - - - - - + + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET.Serializer.TextualNotation/SysML2.NET.Serializer.TextualNotation.csproj b/SysML2.NET.Serializer.TextualNotation/SysML2.NET.Serializer.TextualNotation.csproj index 7c258259f..3a84fa7cb 100644 --- a/SysML2.NET.Serializer.TextualNotation/SysML2.NET.Serializer.TextualNotation.csproj +++ b/SysML2.NET.Serializer.TextualNotation/SysML2.NET.Serializer.TextualNotation.csproj @@ -19,21 +19,14 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true - - - - - - - - + + + diff --git a/SysML2.NET.Serializer.Xmi.Tests/SysML2.NET.Serializer.Xmi.Tests.csproj b/SysML2.NET.Serializer.Xmi.Tests/SysML2.NET.Serializer.Xmi.Tests.csproj index b63d2cf60..f5659d4f1 100644 --- a/SysML2.NET.Serializer.Xmi.Tests/SysML2.NET.Serializer.Xmi.Tests.csproj +++ b/SysML2.NET.Serializer.Xmi.Tests/SysML2.NET.Serializer.Xmi.Tests.csproj @@ -18,21 +18,15 @@ - - - - - + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - - + + + diff --git a/SysML2.NET.Serializer.Xmi/SysML2.NET.Serializer.Xmi.csproj b/SysML2.NET.Serializer.Xmi/SysML2.NET.Serializer.Xmi.csproj index b13d2af1b..321ae1af5 100644 --- a/SysML2.NET.Serializer.Xmi/SysML2.NET.Serializer.Xmi.csproj +++ b/SysML2.NET.Serializer.Xmi/SysML2.NET.Serializer.Xmi.csproj @@ -16,8 +16,6 @@ [Update] Aligned with SysML2.NET 0.24.1 - cdp4-icon.png - README.md true true @@ -27,12 +25,7 @@ - + - - - - - diff --git a/SysML2.NET.Tests/SysML2.NET.Tests.csproj b/SysML2.NET.Tests/SysML2.NET.Tests.csproj index a65f48ea0..20090fabf 100644 --- a/SysML2.NET.Tests/SysML2.NET.Tests.csproj +++ b/SysML2.NET.Tests/SysML2.NET.Tests.csproj @@ -18,21 +18,15 @@ - - - - - - + + + + + + - - runtime; build; native; contentfiles; analyzers; buildtransitive - all - - - all - runtime; build; native; contentfiles; analyzers; buildtransitive - + + diff --git a/SysML2.NET/SysML2.NET.csproj b/SysML2.NET/SysML2.NET.csproj index d4490c3c8..44f77993d 100644 --- a/SysML2.NET/SysML2.NET.csproj +++ b/SysML2.NET/SysML2.NET.csproj @@ -19,21 +19,14 @@ [Add] PagedResult<T> and Page carry one page of records together with the cursors that address the pages either side of it [Update] QueryParameters, ConstraintValue, ConstraintValueKind, IRequest and IResponse moved from the PIM namespace to PSM and PSM.DTO - cdp4-icon.png - README.md true true - - - - - - - - + + +