V2.4.2

.editorconfig

@@ -155,7 +155,7 @@ csharp_space_between_square_brackets = false
 csharp_prefer_braces = true:silent
 csharp_preserve_single_line_blocks = true
 csharp_preserve_single_line_statements = true
-# Mapperly configuration drift (an unmapped source or target member on a [Mapper] class) must fail the build, the way AutoMapperConfigurationTest's AssertConfigurationIsValid() used to fail the test run
-# before it was deleted - see docs/automapper-removal-plan.md.
+# Mapperly configuration drift (an unmapped source or target member on a [Mapper] class) must fail the build.
+# The compiler diagnostic replaces a runtime AssertConfigurationIsValid() test, see docs/data-model.md.
 dotnet_diagnostic.RMG012.severity = error
 dotnet_diagnostic.RMG020.severity = error

.github/workflows/ci.yaml

@@ -31,21 +31,23 @@ permissions:
   pull-requests: write
 
 jobs:
+  markup-lint:
+    name: Markup
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-markup-lint.yml@1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
+
   git-check:
     name: Git
-    uses: ./.github/workflows/reusable-git-check.yml
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-git-check.yml@1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
     with:
-      is-pull-request: ${{ github.event_name == 'pull_request' }}
-
-  markup-lint:
-    name: Markup
-    uses: devpro/github-workflow-parts/.github/workflows/reusable-markup-lint.yml@00907950b2c345e8ad6934b07268cef056d50d86
+      paths: 'src test Directory.Build.props Directory.Packages.props *.slnx global.json SonarQube.Analysis.xml'
+      version-file: Directory.Build.props
+      workflow-parts-version: 1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
 
   code-quality:
     name: Code
     needs: git-check
-    if: needs.git-check.outputs.app_changed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.run-code-quality)
-    uses: devpro/github-workflow-parts/.github/workflows/reusable-dotnet-quality.yml@00907950b2c345e8ad6934b07268cef056d50d86
+    if: needs.git-check.outputs.changed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.run-code-quality)
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-dotnet-quality.yml@1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
     with:
       # TODO: need a safe solution for service account json content
       #
@@ -61,10 +63,9 @@ jobs:
       # Firebase__WebAppConfiguration__ProjectId=${{ secrets.FIREBASE_PROJECTID }}
       # Firebase__ServiceAccount=${{ secrets.FIREBASE_SERVICEACCOUNT }}
       custom-commands: |
-        ./scripts/mongodb-install.sh
         echo "Initialize database (indexes, tenants & users)"
         echo "TODO (MONGODB_URI="mongodb://localhost:27017/keeptrack_dev" ./scripts/...)"
-      dotnet-test-args: "--report-xunit-trx --coverage --coverage-output-format cobertura"
+      dotnet-test-args: "--report-xunit-trx --coverage --coverage-output-format cobertura ${{ vars.DOTNET_TEST_EXTRA_ARGS }}"
       extra-vars: |
         AllowedOrigins__0=5207
         AllowedOrigins__1=7042
@@ -73,14 +74,17 @@ jobs:
         Infrastructure__MongoDB__ConnectionString=mongodb://localhost:27017
         Infrastructure__MongoDB__DatabaseName=keeptrack_ci
         Logging__LogLevel__Keeptrack=Debug
-      fossa-enabled: true
+      fossa-enabled: ${{ vars.FOSSA_ENABLED != 'false' }}
+      mongodb-enabled: true
       sonar-enabled: true
+      sonar-host-url: ${{ vars.SONAR_HOST_URL || 'https://sonarcloud.io' }}
       sonar-cpd-exclusions: "**/*.g.cs,**/*.generated.cs,**/src/WebApi.Contracts/Dto/*.cs,**/src/Domain/Models/*.cs,**/src/Infrastructure.MongoDb/Entities/*.cs"
       sonar-exclusions: "**/samples/**,**/*.png"
       sonar-organization: ${{ vars.SONAR_ORG }}
       sonar-project-key: ${{ vars.SONAR_PROJECT_KEY }}
       sonar-project-name: Keeptrack
-      workflow-parts-version: 00907950b2c345e8ad6934b07268cef056d50d86
+      sonar-settings-file: SonarQube.Analysis.xml
+      workflow-parts-version: 1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
     secrets:
       fossa-api-key: ${{ secrets.FOSSA_API_KEY }}
       sonar-token: ${{ secrets.SONAR_TOKEN }}
@@ -105,7 +109,7 @@ jobs:
   image-scan:
     name: "Image ${{ matrix.name }}"
     needs: git-check
-    if: needs.git-check.outputs.app_changed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.run-image-scan)
+    if: needs.git-check.outputs.changed == 'true' || (github.event_name == 'workflow_dispatch' && inputs.run-image-scan)
     strategy:
       matrix:
         include:
@@ -115,12 +119,10 @@ jobs:
           - name: "Web Api"
             image-name: "keeptrack-webapi"
             image-definition: "src/WebApi/Dockerfile"
-    uses: devpro/github-workflow-parts/.github/workflows/reusable-container-scan.yml@00907950b2c345e8ad6934b07268cef056d50d86
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-container-scan.yml@1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4
     with:
       image-definition: ${{ matrix.image-definition }}
       image-name: ${{ matrix.image-name }}
       image-path: ${{ vars.CONTAINER_REGISTRY_PATH }}
-      image-tag: "${{ needs.git-check.outputs.version_major_minor }}.${{ github.run_id }}"
-      max-high-cves: 1 # temporary (2026-07-19): libxml2-2 │ SUSE-SU-2026:3097-1 │ HIGH │ fixed │ 2.12.10-150700.4.11.1 │ 2.12.10-150700.4.14.1 │ Security update for libxml2
-      max-medium-cves: 0
-      workflow-parts-version: 00907950b2c345e8ad6934b07268cef056d50d86
+      image-tag: "${{ needs.git-check.outputs.version-major-minor }}.${{ github.run_id }}"
+      workflow-parts-version: 1c7f098dd14618eeb1a5080b60eaf07c3a12c3c4

.github/workflows/pkg.yaml

@@ -10,12 +10,15 @@ on:
 jobs:
   git-check:
     name: Git
-    uses: ./.github/workflows/reusable-git-check.yml
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-git-check.yml@591b0c7bfba6fbc7b0cab7d896447e0732b819de
+    with:
+      version-file: Directory.Build.props
+      workflow-parts-version: 591b0c7bfba6fbc7b0cab7d896447e0732b819de
 
   image-publication:
     name: "Image ${{ matrix.name }}"
     needs: git-check
-    if: github.event_name == 'workflow_dispatch' || needs.git-check.outputs.app_changed == 'true'
+    if: github.event_name == 'workflow_dispatch' || needs.git-check.outputs.changed == 'true'
     strategy:
       matrix:
         include:
@@ -28,14 +31,15 @@ jobs:
     permissions:
       id-token: write
       contents: read
-    uses: devpro/github-workflow-parts/.github/workflows/reusable-container-publication.yml@00907950b2c345e8ad6934b07268cef056d50d86
+    uses: devpro/github-workflow-parts/.github/workflows/reusable-container-publication.yml@591b0c7bfba6fbc7b0cab7d896447e0732b819de
     with:
       create-latest: ${{ github.ref_name == 'main' }}
       image-definition: ${{ matrix.image-definition }}
       image-name: ${{ matrix.image-name }}
       image-path: ${{ vars.CONTAINER_REGISTRY_PATH }}
-      image-tag: "${{ needs.git-check.outputs.version_major_minor }}.${{ github.run_id }}"
-      workflow-parts-version: 00907950b2c345e8ad6934b07268cef056d50d86
+      image-tag: "${{ needs.git-check.outputs.version-major-minor }}.${{ github.run_id }}"
+      image-platform: linux/amd64
+      workflow-parts-version: 591b0c7bfba6fbc7b0cab7d896447e0732b819de
     secrets:
       container-registry-password: ${{ secrets.DOCKERHUB_TOKEN }}
       container-registry-username: ${{ secrets.DOCKERHUB_USERNAME }}

.istarci.yml

@@ -7,9 +7,12 @@ runner:
     "markup-lint*": ghcr.io/devpro/debian-node:latest
     "image-scan*": ghcr.io/devpro/debian-node:latest
   # The scan jobs build an image and scan it through the host Docker daemon.
-  docker: true
+  docker: ["image-scan*"]
+  # The analysis runs against the SonarQube IstarCI starts on this machine, with a token made there.
+  sonarqube: true
 
 workflow:
+  onDisallowedAction: fail
   # Actions published by GitHub or Docker, and the composite replacements for every other one kept in github-workflow-parts.
   allowedActions:
     - actions/*
@@ -22,4 +25,12 @@ workflow:
 
 # Repository variables the pipeline reads, which a local run otherwise gets as placeholders, and an image tag refuses the uppercase in one.
 vars:
+  # FOSSA analyses on its own service with an API key, which a local run never holds.
+  FOSSA_ENABLED: "false"
+  # The local SonarQube has no organizations, and a non-empty one is what turns the analysis on.
+  SONAR_ORG: local
+  SONAR_PROJECT_KEY: keeptrack
   CONTAINER_REGISTRY_PATH: devprofr
+  # The integration tests sign in to Firebase, an external system a local run never reaches,
+  # and leaving them out leaves their project with no test, which exit code 8 reports.
+  DOTNET_TEST_EXTRA_ARGS: --filter-not-namespace Keeptrack.WebApi.IntegrationTests* --ignore-exit-code 8