Merge pull request #4 from ktsu-dev/claude/happy-rubin-w67sx1 #13

Workflow file for this run

	name: .NET Workflow

	on:
	push:
	branches: [main, develop]
	paths-ignore:
	[".md", ".github/ISSUE_TEMPLATE/", ".github/pull_request_template.md"]
	pull_request:
	paths-ignore:
	[".md", ".github/ISSUE_TEMPLATE/", ".github/pull_request_template.md"]
	schedule:
	- cron: "0 23 * * *" # Daily at 11 PM UTC
	workflow_dispatch: # Allow manual triggers
	inputs:
	version-bump:
	description: 'Version bump type'
	required: false
	default: 'auto'
	type: choice
	options:
	- auto
	- patch
	- minor
	- major

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	# Default permissions
	permissions:
	contents: read

	env:
	DOTNET_VERSION: "10.0" # Only needed for actions/setup-dotnet

	jobs:
	discover:
	name: Discover Test Projects
	runs-on: ubuntu-latest
	timeout-minutes: 10

	outputs:
	matrix: ${{ steps.discover.outputs.matrix }}
	platforms: ${{ steps.discover.outputs.platforms }}
	has_tests: ${{ steps.discover.outputs.has_tests }}

	steps:
	- name: Checkout Repository
	uses: actions/checkout@v7

	- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
	uses: actions/setup-dotnet@v6
	with:
	dotnet-version: ${{ env.DOTNET_VERSION }}.x

	- name: Install KtsuBuild
	shell: bash
	run: \|
	dotnet tool install ktsu.KtsuBuild.Tool --tool-path "${{ runner.temp }}/ktsubuild"
	echo "${{ runner.temp }}/ktsubuild" >> "$GITHUB_PATH"

	# `test list` reports every test project regardless of the host it runs on, unlike the
	# filter `build` and `ci` apply, so one Linux job can enumerate cells that Windows and
	# macOS runners will execute. It writes failures to stdout rather than stderr, so the
	# exit code is the only reliable signal and has to be checked before parsing.
	- name: Discover Test Projects
	id: discover
	shell: bash
	run: \|
	set -euo pipefail

	if ! projects=$(ktsubuild test list --workspace "$GITHUB_WORKSPACE"); then
	echo "::error::ktsubuild test list failed:"
	echo "$projects"
	exit 1
	fi

	echo "Discovered test projects:"
	echo "$projects" \| jq .

	# An unrecognized platform must stop the run rather than drop the project. Dropping
	# it would produce a smaller matrix that still reports success, which is the failure
	# this design exists to remove.
	unknown=$(echo "$projects" \| jq -r '[.[] \| select(.platform as $p \| ["neutral","windows","macos"] \| index($p) \| not) \| .platform] \| unique \| join(", ")')
	if [ -n "$unknown" ]; then
	echo "::error::Cannot place test project(s) on a runner. Unhandled platform(s): $unknown"
	echo "::error::An ios-tied test project needs 'dotnet workload install ios', which this job does not run; the iOS workflow is where iOS builds happen."
	exit 1
	fi

	# macOS is back in this mapping. It was excluded org-wide because of one repository:
	# a macOS runner widened ktsu-dev/ImGuiApp's target frameworks to include net10.0-ios,
	# which needs a workload this job does not install, so every macOS cell failed during
	# its build with NETSDK1147 -- and every other repository paid for that by losing a
	# platform it had no trouble on. That widening is now opt-in (IncludeIosTargets, set
	# only by the iOS workflow), so a macOS cell builds exactly what Linux and Windows
	# build. An ios-tied test project would still have nowhere to run and fails the guard
	# above rather than silently disappearing.
	#
	# The UI test projects, which are what makes a test job expensive, are run on Linux
	# only -- see the Test step below -- so a macOS cell stays cheap despite macOS minutes
	# being billed at roughly ten times Linux.
	matrix=$(echo "$projects" \| jq -c '
	{
	include: [
	.[]
	\| . as $p
	\| {
	neutral: ["ubuntu-latest", "windows-latest", "macos-latest"],
	windows: ["windows-latest"],
	macos: ["macos-latest"]
	}[$p.platform][]
	\| {
	os: .,
	project: $p.project,
	name: ($p.project \| split("/") \| last \| rtrimstr(".csproj")),
	slug: ($p.project \| rtrimstr(".csproj") \| gsub("[^A-Za-z0-9]"; "-"))
	}
	]
	}')

	count=$(echo "$matrix" \| jq '.include \| length')
	echo "Matrix has $count cell(s)."
	echo "$matrix" \| jq .

	# The distinct hosts the cells land on. One test job runs per platform and builds once,
	# so this is what that job fans out over, while `matrix` tells each job which projects
	# are its own.
	platforms=$(echo "$matrix" \| jq -c '[.include[].os] \| unique')
	echo "Platforms: $platforms"

	echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
	echo "platforms=$platforms" >> "$GITHUB_OUTPUT"
	if [ "$count" -gt 0 ]; then
	echo "has_tests=true" >> "$GITHUB_OUTPUT"
	else
	echo "has_tests=false" >> "$GITHUB_OUTPUT"
	fi

	test:
	name: Test on ${{ matrix.os }}
	needs: discover
	if: needs.discover.outputs.has_tests == 'true'
	runs-on: ${{ matrix.os }}
	timeout-minutes: 45

	strategy:
	# One platform's failure must not cancel the others. Knowing that a project fails on one
	# host only is the point of testing on more than one.
	fail-fast: false
	matrix:
	os: ${{ fromJson(needs.discover.outputs.platforms) }}

	steps:
	- name: Checkout Repository
	uses: actions/checkout@v7
	with:
	lfs: true
	submodules: recursive

	- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
	uses: actions/setup-dotnet@v6
	with:
	# Test projects commonly multi-target every framework their library publishes, so the
	# test hosts for the older ones need those runtimes present alongside the SDK, or the
	# run fails looking for a framework it was built against. global.json pins the SDK, so
	# naming the older versions here only adds runtimes -- it does not change what builds.
	dotnet-version: \|
	8.0.x
	9.0.x
	${{ env.DOTNET_VERSION }}.x
	cache: true
	cache-dependency-path: \|
	*/.csproj
	**/Directory.Packages.props
	**/global.json

	- name: Install KtsuBuild
	shell: bash
	run: \|
	dotnet tool install ktsu.KtsuBuild.Tool --tool-path "${{ runner.temp }}/ktsubuild"
	echo "${{ runner.temp }}/ktsubuild" >> "$GITHUB_PATH"

	# `test all` restores, builds, and tests every test project this host can build, pinned to
	# the host's runtime identifier. The pin is what makes this cheap: without it a project's
	# output carries native assets for every runtime its packages ship, sixteen of them here,
	# and copying that dominates the job on Windows where file writes are several times slower
	# than on Linux. Measured at 115 MB against 39 MB for the smallest test project.
	#
	# Deliberately not `ci --no-release`: `ci` commits and pushes the metadata files when the
	# build is official and on main, so with one job per platform both jobs would race to
	# commit on every push to main. `test all` does no metadata, version, or release work.
	#
	# A project the host cannot build is skipped and named before anything is built, and a
	# project that fails does not stop the ones after it, so one run reports everything broken.
	#
	# UI test projects are run on Linux only. What they exercise is a pure managed CPU
	# rasterizer with no window, GPU or driver, so one platform covers the same ground, and
	# Linux is both the faster host for that work and much the cheaper runner -- which is also
	# what keeps macOS affordable now that it is in the matrix, since macOS runner minutes are
	# billed at roughly ten times Linux.
	#
	# Where these suites exist they dominate the job. Measured in ktsu-dev/ImGuiApp, five of
	# them took 17m28s, 14m32s, 10m05s, 8m20s and 1m01s on Windows against about thirty-four
	# seconds for all nine other test projects combined, in a test phase of 17m45s; the
	# rasterizer itself renders the same workload in 482.6ms on Windows against 476.0ms on
	# Linux, self-contained for each runtime and timed on one machine. A repository with no UI
	# test project matches nothing here and is unaffected, which is why the rule is safe to
	# carry in the shared workflow.
	#
	# Only the test projects are excluded. The example applications they drive stay in the
	# build on every platform, so a change that breaks one still fails here.
	#
	# The test is on Linux rather than against Windows, so a platform added to the matrix later
	# gets the cheap treatment by default rather than silently inheriting the expensive one.
	- name: Test
	shell: bash
	run: \|
	set -euo pipefail
	if [ "${{ runner.os }}" = "Linux" ]; then
	ktsubuild test all --workspace "$GITHUB_WORKSPACE" --verbose
	else
	ktsubuild test all --workspace "$GITHUB_WORKSPACE" --verbose --exclude "*/.UITests/*"
	fi

	- name: Upload Coverage
	uses: actions/upload-artifact@v7
	if: always()
	with:
	name: coverage-${{ matrix.os }}
	path: ./coverage/*
	retention-days: 7
	if-no-files-found: warn

	release:
	name: Analyze & Release
	needs: [discover, test]
	# `!cancelled()` is required because `test` is skipped when a repo has no test projects, and
	# a skipped dependency would otherwise skip this job too. It also stops a run that
	# `concurrency.cancel-in-progress` superseded from reaching `Release` and racing the newer
	# run. The explicit result checks are what keep a genuine test failure from releasing anyway.
	if: \|
	!cancelled()
	&& needs.discover.result == 'success'
	&& (needs.test.result == 'success' \|\| needs.test.result == 'skipped')
	runs-on: windows-latest
	timeout-minutes: 30
	permissions:
	contents: write # For creating releases and committing metadata
	packages: write # For publishing packages

	outputs:
	version: ${{ steps.pipeline.outputs.version }}
	release_hash: ${{ steps.pipeline.outputs.release_hash }}
	should_release: ${{ steps.pipeline.outputs.should_release }}

	steps:
	- name: Set up JDK 17
	uses: actions/setup-java@v5
	with:
	java-version: 17
	distribution: "zulu" # Alternative distribution options are available.

	- name: Checkout Repository
	uses: actions/checkout@v7
	with:
	fetch-depth: 0 # Full history for versioning
	fetch-tags: true
	lfs: true
	submodules: recursive
	persist-credentials: true

	- name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
	uses: actions/setup-dotnet@v6
	with:
	# Test projects commonly multi-target every framework their library publishes, so the
	# test hosts for the older ones need those runtimes present alongside the SDK, or the
	# run fails looking for a framework it was built against. global.json pins the SDK, so
	# naming the older versions here only adds runtimes -- it does not change what builds.
	dotnet-version: \|
	8.0.x
	9.0.x
	${{ env.DOTNET_VERSION }}.x
	cache: true
	cache-dependency-path: \|
	*/.csproj
	**/Directory.Packages.props
	**/global.json

	# Ensure NuGet packages directory exists for caching (prevents error when pipeline exits early)
	- name: Ensure NuGet cache directory exists
	run: New-Item -Path "$env:USERPROFILE\.nuget\packages" -ItemType Directory -Force
	shell: pwsh

	# SonarCloud is a third party, and when it is down the scanner fails in pre-processing —
	# before a single project is compiled or a single test runs. A total outage therefore turned
	# every pull request red while saying nothing about the change, which is a false signal
	# rather than a quality gate. Probed here so that an outage skips analysis instead.
	#
	# Three attempts, because the point is to tell an outage from a blip: analysis is worth
	# having, and one slow response should not cost a run its quality gate.
	#
	# Where the gate is blocking, an outage still fails. Skipping is safe only while the gate is
	# advisory: the Release step below is implicitly gated on the steps before it succeeding, and
	# a skipped step is not a failed one, so forgiving an outage in a repository that has opted
	# in would release past the very gate it opted into.
	#
	# Skipping is otherwise deliberately loud. No quality gate is produced when analysis is
	# skipped, so the SonarCloud check simply does not report — it is never made to look as though
	# it passed, and a branch rule that requires it still holds the merge until a human decides.
	- name: Probe SonarQube Cloud
	id: sonar
	if: ${{ env.SONAR_TOKEN != '' }}
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
	shell: pwsh
	run: \|
	$available = $false
	foreach ($attempt in 1..3) {
	try {
	$response = Invoke-WebRequest -Uri "https://sonarcloud.io/api/server/version" -Method Get -TimeoutSec 20
	if ($response.StatusCode -eq 200) {
	Write-Host "sonarcloud.io answered on attempt $attempt."
	$available = $true
	break
	}

	Write-Host "Attempt ${attempt}: sonarcloud.io answered $($response.StatusCode)."
	} catch {
	Write-Host "Attempt ${attempt}: sonarcloud.io did not answer. $($_.Exception.Message)"
	}

	if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
	}

	"available=$($available.ToString().ToLowerInvariant())" >> $env:GITHUB_OUTPUT

	if ($available) { exit 0 }

	# Only a run that could publish is held to a blocking gate. A pull request cannot
	# release, so failing it would cost exactly the tolerance this step exists for and buy
	# nothing: a required SonarCloud check still holds the merge, because a skipped analysis
	# reports no gate at all.
	if ($env:SONAR_BLOCKING_GATE -eq 'true' -and $env:GITHUB_EVENT_NAME -ne 'pull_request') {
	Write-Host "::error title=SonarQube Cloud unreachable::The quality gate is blocking for this repository and this run could publish, so it fails rather than releasing ungated."
	exit 1
	}

	Write-Host "::warning title=SonarQube Cloud unreachable::Static analysis was skipped. The build and tests still ran and still had to pass, but no quality gate was produced, so this run is not evidence that one would pass."
	"### SonarQube Cloud unreachable" >> $env:GITHUB_STEP_SUMMARY
	"" >> $env:GITHUB_STEP_SUMMARY
	"Static analysis was skipped for this run. The build and tests still ran; no quality gate was produced." >> $env:GITHUB_STEP_SUMMARY

	- name: Cache SonarQube Cloud packages
	if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' }}
	uses: actions/cache@v6
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	with:
	path: ~\sonar\cache
	key: ${{ runner.os }}-sonar
	restore-keys: ${{ runner.os }}-sonar

	- name: Cache SonarQube Cloud scanner
	if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' }}
	id: cache-sonar-scanner
	uses: actions/cache@v6
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	with:
	path: .\.sonar\scanner
	key: ${{ runner.os }}-sonar-scanner
	restore-keys: ${{ runner.os }}-sonar-scanner

	- name: Install SonarQube Cloud scanner
	if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' && steps.cache-sonar-scanner.outputs.cache-hit != 'true' }}
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	shell: pwsh
	run: \|
	New-Item -Path .\.sonar\scanner -ItemType Directory
	dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner

	- name: Install KtsuBuild
	shell: pwsh
	run: \|
	dotnet tool install ktsu.KtsuBuild.Tool --tool-path "${{ runner.temp }}/ktsubuild"
	if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
	"${{ runner.temp }}/ktsubuild" >> $env:GITHUB_PATH

	# Each platform's artifact holds one coverage.xml, already merged across that platform's test
	# projects by `test all`. The downloads must stay in their own per-artifact directories so
	# they all survive: flattened, one platform's report would overwrite the others' and the
	# scanner would see a single platform's coverage as though it were the whole matrix's.
	- name: Download Coverage
	if: needs.discover.outputs.has_tests == 'true'
	uses: actions/download-artifact@v7
	with:
	pattern: coverage-*
	path: coverage

	# The UI suites run on Linux only, so their coverage exists only in the Linux report, which
	# records the paths that runner checked out to. This job analyses a
	# Windows checkout, and Sonar matches coverage to source files by path, so every entry from
	# that report was dropped without a word: five suites' worth of coverage, and with it every
	# file only they exercise, reported as untested. Pointing those paths at this workspace is
	# what makes them count.
	- name: Point Linux Coverage Paths at This Workspace
	if: needs.discover.outputs.has_tests == 'true'
	shell: pwsh
	run: \|
	$report = Join-Path $env:GITHUB_WORKSPACE 'coverage/coverage-ubuntu-latest/coverage.xml'
	if (-not (Test-Path $report)) {
	Write-Host 'No Linux coverage report to rewrite.'
	exit 0
	}

	# Where the Linux runner checks out to. Fixed by the runner image, and not reported to
	# this job, so it is rebuilt from the repository name rather than read.
	$repository = ($env:GITHUB_REPOSITORY -split '/')[1]
	$linuxRoot = "/home/runner/work/$repository/$repository"

	$text = [IO.File]::ReadAllText($report)
	$pattern = 'path="' + [regex]::Escape($linuxRoot) + '([^"]*)"'
	$found = [regex]::Matches($text, $pattern).Count

	if ($found -eq 0) {
	Write-Host "::warning::No coverage paths under '$linuxRoot' were found, so the Linux suites' coverage will not be counted. The runner's checkout path has probably changed."
	exit 0
	}

	$workspace = $env:GITHUB_WORKSPACE
	$text = [regex]::Replace($text, $pattern, {
	param($match)
	'path="' + $workspace + $match.Groups[1].Value.Replace('/', '\') + '"'
	})

	[IO.File]::WriteAllText($report, $text)
	Write-Host "Pointed $found coverage path(s) at $workspace."

	# SonarCloud's "previous version" new-code period needs recorded version boundaries to
	# anchor to. Without /v: the scanner reports the version as "not provided", so the period
	# has nothing to anchor against and widens to the whole history, which makes the new-code
	# coverage condition measure the entire codebase instead of what this change touched.
	# `version bump` prints the computed version as its only bare semver line.
	- name: Resolve Version for Analysis
	id: analysis_version
	shell: pwsh
	run: \|
	$output = & ktsubuild version bump --workspace "${{ github.workspace }}" 2>&1
	if ($LASTEXITCODE -ne 0) { $output; exit $LASTEXITCODE }
	$matches = @($output \| Where-Object { $_ -match '^\d+\.\d+\.\d+' })
	if ($matches.Count -ne 1) {
	$output
	Write-Error "Expected exactly one bare version line from 'version bump', got $($matches.Count)."
	exit 1
	}
	"version=$($matches[0].Trim())" >> $env:GITHUB_OUTPUT

	# The quality gate blocks the release only where a repository opts in, by setting the
	# SONAR_BLOCKING_GATE repository variable to true. It is not on by default because most of
	# these repositories carry security hotspots that have never been reviewed, and a gate they
	# have never been held to would stop every release at once rather than improve anything. The
	# analysis is still uploaded and the gate is still evaluated either way, so turning a
	# repository on is a variable away once its findings are triaged.
	- name: Begin SonarQube
	if: ${{ env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' }}
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
	SONAR_COVERAGE_EXCLUSIONS_EXTRA: ${{ vars.SONAR_COVERAGE_EXCLUSIONS_EXTRA }}
	shell: pwsh
	run: \|
	# A file that cannot be executed rather than one nobody has got round to testing --
	# a windowed entry point, say -- is excluded per repository through the
	# SONAR_COVERAGE_EXCLUSIONS_EXTRA variable, so this workflow stays identical
	# everywhere instead of accumulating one repository's paths for all the others to carry.
	$coverageExclusions = '*/Test.cs,/.Tests.cs,*/.Tests/*/,/obj//,/.dll,**/NativeExports.cs'
	if (-not [string]::IsNullOrWhiteSpace($env:SONAR_COVERAGE_EXCLUSIONS_EXTRA)) {
	$coverageExclusions += ',' + $env:SONAR_COVERAGE_EXCLUSIONS_EXTRA.Trim()
	Write-Host "Excluding additionally from coverage: $($env:SONAR_COVERAGE_EXCLUSIONS_EXTRA.Trim())"
	}

	$sonarArgs = @(
	'begin'
	'/k:${{ github.repository_owner }}_${{ github.event.repository.name }}'
	'/o:${{ github.repository_owner }}'
	'/v:${{ steps.analysis_version.outputs.version }}'
	"/d:sonar.token=$env:SONAR_TOKEN"
	'/d:sonar.host.url=https://sonarcloud.io'
	'/d:sonar.projectBaseDir=${{ github.workspace }}'
	'/d:sonar.cs.vscoveragexml.reportsPaths=coverage/**/coverage.xml'
	"/d:sonar.coverage.exclusions=$coverageExclusions"
	'/d:sonar.cs.vstest.reportsPaths=coverage/*/.trx'
	'/d:sonar.exclusions=**/NativeExports.cs'
	)

	if ($env:SONAR_BLOCKING_GATE -eq 'true') {
	$sonarArgs += '/d:sonar.qualitygate.wait=true'
	Write-Host 'Quality gate is blocking for this repository.'
	} else {
	Write-Host 'Quality gate is advisory for this repository. Set the SONAR_BLOCKING_GATE variable to true to enforce it.'
	}

	& .\.sonar\scanner\dotnet-sonarscanner @sonarArgs

	# `ci` rather than restore and build directly, because it is the only place that updates
	# and commits the metadata files, updates the repository topics, applies the version gate
	# behind `[skip ci]`, and writes the step outputs the security job reads.
	# The tests already ran in the matrix, and where the gate is blocking the release waits for
	# it below.
	- name: Run KtsuBuild Pipeline
	id: pipeline
	shell: pwsh
	env:
	GH_TOKEN: ${{ github.token }}
	NUGET_API_KEY: ${{ secrets.NUGET_KEY }}
	KTSU_PACKAGE_KEY: ${{ secrets.KTSU_PACKAGE_KEY }}
	EXPECTED_OWNER: ktsu-dev
	run: \|
	$versionBump = "${{ github.event.inputs.version-bump }}"

	$args = @("ci", "--workspace", "${{ github.workspace }}", "--no-test", "--no-release", "--verbose")
	if (![string]::IsNullOrEmpty($versionBump) -and $versionBump -ne "auto") {
	$args += @("--version-bump", $versionBump)
	}

	& ktsubuild @args
	if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

	- name: End SonarQube
	id: sonar_end
	if: env.SONAR_TOKEN != '' && steps.sonar.outputs.available == 'true' && steps.pipeline.outputs.build_skipped != 'true'
	env:
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	SONAR_BLOCKING_GATE: ${{ vars.SONAR_BLOCKING_GATE }}
	shell: pwsh
	run: \|
	.\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="$env:SONAR_TOKEN"
	if ($LASTEXITCODE -eq 0) {
	"analysed=true" >> $env:GITHUB_OUTPUT
	exit 0
	}

	# Whatever happens below, no gate came out of this run. The Release step reads this.
	"analysed=false" >> $env:GITHUB_OUTPUT

	# The upload failed. An outage that began after the probe looks exactly like this, and
	# forgiving it is the same judgement the probe makes — but only when the server really is
	# unreachable, so a malformed report, a bad token or a rejected analysis still fails here.
	# Where the gate is blocking it is not forgiven on a run that could publish: with
	# `sonar.qualitygate.wait=true` a failed gate is one of the ways this command exits
	# non-zero. A pull request publishes nothing, so it is forgiven like any other.
	if ($env:SONAR_BLOCKING_GATE -eq 'true' -and $env:GITHUB_EVENT_NAME -ne 'pull_request') { exit 1 }

	try {
	$response = Invoke-WebRequest -Uri "https://sonarcloud.io/api/server/version" -Method Get -TimeoutSec 20
	Write-Host "::error title=SonarQube analysis failed::The upload failed while sonarcloud.io was answering $($response.StatusCode), so this is not an outage."
	exit 1
	} catch {
	Write-Host "::warning title=SonarQube Cloud went away mid-run::The analysis upload failed and sonarcloud.io is unreachable, so no quality gate was produced. The build and tests still ran."
	"### SonarQube Cloud went away mid-run" >> $env:GITHUB_STEP_SUMMARY
	"" >> $env:GITHUB_STEP_SUMMARY
	"The analysis upload failed and sonarcloud.io is unreachable. No quality gate was produced; the build and tests still ran." >> $env:GITHUB_STEP_SUMMARY
	}

	# Gated on the quality gate where the repository opted into a blocking one. With
	# SONAR_BLOCKING_GATE set, `sonar.qualitygate.wait=true` makes a failed gate fail the step
	# above, and a step whose `if:` names no status function is implicitly gated on success, so
	# a gate the project did not pass already stops the release.
	#
	# What that implicit gating does not cover is a gate that never happened: an outage skips
	# the analysis, and a skipped step is not a failed one. So the two Sonar outputs are named
	# here explicitly. `available` is empty when there is no SONAR_TOKEN, which holds a release
	# in a repository that asked for a blocking gate it has no way to produce -- the safe side
	# of a contradictory configuration. Without the variable, none of this applies: the analysis
	# is still published and the gate still evaluated, it just does not hold up the release.
	- name: Release
	if: steps.pipeline.outputs.should_release == 'true' && (vars.SONAR_BLOCKING_GATE != 'true' \|\| (steps.sonar.outputs.available == 'true' && steps.sonar_end.outputs.analysed != 'false'))
	shell: pwsh
	env:
	GH_TOKEN: ${{ github.token }}
	NUGET_API_KEY: ${{ secrets.NUGET_KEY }}
	KTSU_PACKAGE_KEY: ${{ secrets.KTSU_PACKAGE_KEY }}
	EXPECTED_OWNER: ktsu-dev
	run: \|
	ktsubuild release --workspace "${{ github.workspace }}" --verbose
	if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

	- name: Upload Coverage Report
	uses: actions/upload-artifact@v7
	if: always()
	with:
	name: analysis-coverage-report
	path: \|
	./coverage/*
	retention-days: 7
	if-no-files-found: ignore

	security:
	name: Security Scanning
	needs: release
	if: needs.release.outputs.should_release == 'true'
	runs-on: windows-latest
	timeout-minutes: 10
	permissions:
	id-token: write # For dependency submission
	contents: write # For dependency submission

	steps:
	- name: Checkout Release Commit
	uses: actions/checkout@v7
	with:
	ref: ${{ needs.release.outputs.release_hash }}
	- name: Detect Dependencies
	uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4

Navigation Menu

Uh oh!

Merge pull request #4 from ktsu-dev/claude/happy-rubin-w67sx1 #13

Workflow file

Merge pull request #4 from ktsu-dev/claude/happy-rubin-w67sx1 #13

Uh oh!

Workflow file for this run