From b4b0a3d2b59f2cb887ec1fef127da1b39166943f Mon Sep 17 00:00:00 2001 From: gmasci Date: Fri, 10 Jul 2026 12:08:48 +0200 Subject: [PATCH 1/2] ci(publish): use GitHub App token for commit-back to bypass branch protection The stable-release commit-back + tag push must bypass the protected-main ruleset (PR required). GITHUB_TOKEN cannot; a GitHub App installation token can. Adds the create-github-app-token step and uses it for checkout/push. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 40830cd..d88ebc2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -22,7 +22,11 @@ name: Publish packages # (or `v7.1.0-rc.1`) publishes exactly that version. # # Requires repository secret NUGET_API_KEY (a NuGet.org API key with push rights -# for the CodeArchitects.Platform.* package ids). Commit-back uses GITHUB_TOKEN. +# for the CodeArchitects.Platform.* package ids). The commit-back + tag push is +# authenticated with a GitHub App installation token (secrets +# CODEARCHITECTS_RELEASE_BOT_APP_ID / CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY) so it +# can bypass the branch ruleset that would otherwise require a pull request. The +# built-in GITHUB_TOKEN cannot bypass that rule. on: release: @@ -69,10 +73,18 @@ jobs: permissions: contents: write # needed to commit the version bump and push the tag steps: + - name: Generate GitHub App token + id: app_token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_APP_ID }} + private-key: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY }} + - uses: actions/checkout@v4 with: + # full history + GitHub App token to bypass branch protection rules fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + token: ${{ steps.app_token.outputs.token }} - name: Setup .NET uses: actions/setup-dotnet@v4 From e7c8f5370db923fb66e944619aba1b122507806c Mon Sep 17 00:00:00 2001 From: gmasci Date: Fri, 10 Jul 2026 13:11:56 +0200 Subject: [PATCH 2/2] ci: serialize build (-m:1) to fix intermittent CS0006 race ProduceReferenceAssembly=false only moved the missing file from ref/ to bin/; the parallel multi-TFM ProjectReference race persisted. Building with a single MSBuild node forces dependency-ordered builds and eliminates it deterministically. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 5 ++++- .github/workflows/publish.yml | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 95116c2..f030ad6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,10 @@ jobs: run: dotnet restore CodeArchitects.Platform.sln - name: Build - run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore + # -m:1 (single MSBuild node) serializes the build so multi-targeted + # ProjectReferences build in dependency order, avoiding an intermittent + # CS0006 "metadata file could not be found" race under parallel builds. + run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1 - name: Test (unit & functional) shell: bash diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d88ebc2..a18a0c7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -118,7 +118,9 @@ jobs: run: dotnet restore CodeArchitects.Platform.sln - name: Build - run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -p:Version=${{ steps.meta.outputs.version }} + # -m:1 serializes the build to avoid an intermittent CS0006 race between + # multi-targeted ProjectReferences (see ci.yml for details). + run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1 -p:Version=${{ steps.meta.outputs.version }} - name: Pack (all packable projects under src/) shell: bash