SP220 Checkpoint D: leaf extensions and JSON definitions

.github/workflows/ci.yml

@@ -2,28 +2,50 @@ name: CI
 
 on:
   workflow_dispatch:
+    inputs:
+      diagnostic-sha:
+        description: Exact 40-character commit SHA for a single-consumer diagnostic
+        required: false
+        type: string
+        default: ''
+      diagnostic-scenario:
+        description: Exact consumer scenario ID for a single-consumer diagnostic
+        required: false
+        type: string
+        default: ''
+      diagnostic-repeat:
+        description: Number of diagnostic runs (1-5)
+        required: false
+        type: string
+        default: ''
   push:
     branches: [ main, upd, release/2.2.0 ]
   pull_request:
-    branches: [ main, upd, release/2.2.0, sp220/checkpoint-c ]
+    branches: [ main, upd, release/2.2.0, sp220/checkpoint-c, sp220/checkpoint-d ]
 
 permissions:
   contents: read
 
+env:
+  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
+
 jobs:
   validation:
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic-sha == '' && inputs.diagnostic-scenario == '' && inputs.diagnostic-repeat == ''))
     uses: ./.github/workflows/reusable-release-validation.yml
     permissions:
       contents: read
+    with:
+      runner-labels: ${{ github.event_name == 'pull_request' && '["windows-latest"]' || '["ubuntu-latest"]' }}
 
   hosting-integration:
-    name: Hosting integration (${{ matrix.os }})
+    name: Hosting integration (${{ matrix.os == 'windows-latest' && 'Windows' || matrix.os }})
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic-sha == '' && inputs.diagnostic-scenario == '' && inputs.diagnostic-repeat == ''))
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     strategy:
       fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest]
+      matrix: ${{ fromJSON(github.event_name == 'pull_request' && '{"os":["windows-latest"]}' || '{"os":["ubuntu-latest","windows-latest"]}') }}
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -34,9 +56,11 @@ jobs:
         uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
 
       - name: Restore Hosting integration tests
-        run: dotnet restore tests/SmartPipe.Extensions.Hosting.Tests/SmartPipe.Extensions.Hosting.Tests.csproj --locked-mode
+        run: dotnet restore tests/SmartPipe.Extensions.Hosting.Tests/SmartPipe.Extensions.Hosting.Tests.csproj --locked-mode -p:DisableImplicitLibraryPacksFolder=true
 
       - name: Build Hosting integration tests
         run: dotnet build tests/SmartPipe.Extensions.Hosting.Tests/SmartPipe.Extensions.Hosting.Tests.csproj --configuration Release --no-restore -warnaserror
@@ -45,6 +69,7 @@ jobs:
         run: dotnet test --project tests/SmartPipe.Extensions.Hosting.Tests/SmartPipe.Extensions.Hosting.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Hosting.Tests.Integration.GenericHostIntegrationTests --minimum-expected-tests 1
 
   json-file-windows:
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic-sha == '' && inputs.diagnostic-scenario == '' && inputs.diagnostic-repeat == ''))
     runs-on: windows-latest
     timeout-minutes: 20
 
@@ -57,35 +82,52 @@ jobs:
         uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
 
       - name: Restore locked
-        run: dotnet restore SmartPipe.Core.slnx --locked-mode
+        run: dotnet restore SmartPipe.Core.slnx --locked-mode -p:DisableImplicitLibraryPacksFolder=true
 
       - name: Build JSON test project
         run: dotnet build tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-restore -warnaserror
 
       - name: JSON file source, path, open, and share tests
+        shell: pwsh
         run: |
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sources.JsonFileSourceTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sources.JsonFileSourceRecoveryTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sources.JsonFileSourceMetadataTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: JSON file sink and dispose tests
+        shell: pwsh
         run: |
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sinks.JsonFileSinkTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sinks.JsonFileSinkAppendTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Json.Tests.Sinks.JsonFileSinkLifecycleTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Dead-letter source and sink tests
+        shell: pwsh
         run: |
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sources.DeadLetterSourceTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.Sources.DeadLetterSourceRecoveryTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.DeadLetterSinkTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Tests.DeadLetterSinkAppendTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet test --project tests/SmartPipe.Extensions.Json.Tests/SmartPipe.Extensions.Json.Tests.csproj --configuration Release --no-build --filter-class SmartPipe.Extensions.Json.Tests.DeadLetterSinkLifecycleTests --minimum-expected-tests 1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
   baseline-contract-windows:
     name: Baseline contract (Windows)
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'workflow_dispatch' || (inputs.diagnostic-sha == '' && inputs.diagnostic-scenario == '' && inputs.diagnostic-repeat == ''))
     runs-on: windows-latest
     timeout-minutes: 20
 
@@ -99,6 +141,8 @@ jobs:
         uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
 
       - name: Restore locked
         run: dotnet restore SmartPipe.Core.slnx --locked-mode -p:DisableImplicitLibraryPacksFolder=true
@@ -114,3 +158,88 @@ jobs:
 
       - name: Verify 2.1.2 baseline offline
         run: dotnet run --project eng/SmartPipe.RepositoryChecks/SmartPipe.RepositoryChecks.csproj --configuration Release --no-build -- verify-baseline --repo-root . --manifest eng/baselines/2.1.2/manifest.json --packages-dir artifacts/baselines/2.1.2 --offline --mode integrity
+
+  diagnostic-consumer:
+    name: Diagnostic consumer (${{ inputs.diagnostic-scenario }})
+    if: github.event_name == 'workflow_dispatch' && (inputs.diagnostic-sha != '' || inputs.diagnostic-scenario != '' || inputs.diagnostic-repeat != '')
+    runs-on: windows-latest
+    timeout-minutes: 45
+    steps:
+      - name: Validate diagnostic inputs
+        shell: pwsh
+        env:
+          DIAGNOSTIC_SHA: ${{ inputs.diagnostic-sha }}
+          DIAGNOSTIC_SCENARIO: ${{ inputs.diagnostic-scenario }}
+          DIAGNOSTIC_REPEAT: ${{ inputs.diagnostic-repeat }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          if ($env:DIAGNOSTIC_SHA -notmatch '^[0-9a-f]{40}$') { throw 'diagnostic-sha must be exactly 40 lowercase hexadecimal characters.' }
+          if ($env:DIAGNOSTIC_SCENARIO -notmatch '^[a-z0-9-]+$') { throw 'diagnostic-scenario must contain lowercase letters, digits, or hyphens.' }
+          if ($env:DIAGNOSTIC_REPEAT -notmatch '^[1-5]$') { throw 'diagnostic-repeat must be an integer from 1 through 5.' }
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.diagnostic-sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Verify exact diagnostic checkout
+        shell: pwsh
+        env:
+          DIAGNOSTIC_SHA: ${{ inputs.diagnostic-sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $actual = (git rev-parse HEAD).Trim()
+          if ($LASTEXITCODE -ne 0 -or $actual -cne $env:DIAGNOSTIC_SHA) { throw "Checked out SHA '$actual' does not match the requested diagnostic SHA." }
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        with:
+          global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Restore locked
+        run: dotnet restore SmartPipe.Core.slnx --locked-mode -p:DisableImplicitLibraryPacksFolder=true
+
+      - name: Build
+        run: dotnet build SmartPipe.Core.slnx --configuration Release --no-restore -warnaserror
+
+      - name: Set package version
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $packageVersion = (dotnet msbuild src/SmartPipe.Core/SmartPipe.Core.csproj -getProperty:Version -nologo).Trim()
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($packageVersion)) { throw 'Unable to determine the package version.' }
+          "PACKAGE_VERSION=$packageVersion" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Pack packages from graph
+        shell: pwsh
+        run: >
+          dotnet run --project eng/SmartPipe.RepositoryChecks/SmartPipe.RepositoryChecks.csproj
+          --configuration Release --no-build -- pack-packages
+          --mode current --configuration Release --package-version "$env:PACKAGE_VERSION"
+          --output artifacts/packages --manifest artifacts/packages/manifest.json
+
+      - name: Run diagnostic consumer
+        shell: pwsh
+        env:
+          DIAGNOSTIC_SCENARIO: ${{ inputs.diagnostic-scenario }}
+          DIAGNOSTIC_REPEAT: ${{ inputs.diagnostic-repeat }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $rows = [Collections.Generic.List[string]]::new()
+          $failed = $false
+          for ($pass = 1; $pass -le [int]$env:DIAGNOSTIC_REPEAT; $pass++) {
+            $output = (& dotnet run --project eng/SmartPipe.RepositoryChecks/SmartPipe.RepositoryChecks.csproj --configuration Release --no-build -- run-consumers --set current --scenario $env:DIAGNOSTIC_SCENARIO --package-directory artifacts/packages --package-version "$env:PACKAGE_VERSION" 2>&1 | Out-String).Trim()
+            $exitCode = $LASTEXITCODE
+            $snippet = ($output -replace '\r?\n', ' ').Trim()
+            if ($snippet.Length -gt 512) { $snippet = $snippet.Substring($snippet.Length - 512) }
+            $rows.Add("- pass ${pass}: exit=$exitCode; $snippet")
+            if ($exitCode -ne 0) { $failed = $true; break }
+          }
+          $summary = @('## Single-consumer diagnostic', '', "- scenario: $env:DIAGNOSTIC_SCENARIO", "- repeat requested: $env:DIAGNOSTIC_REPEAT") + $rows
+          $summaryText = ($summary -join [Environment]::NewLine)
+          if ($summaryText.Length -gt 8192) { $summaryText = $summaryText.Substring(0, 8192) + [Environment]::NewLine + '... summary truncated ...' }
+          Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY -Value $summaryText
+          if ($failed) { exit 1 }

.github/workflows/codeql.yml

@@ -4,16 +4,20 @@ on:
   push:
     branches: [ main, upd, release/2.2.0 ]
   pull_request:
-    branches: [ main, release/2.2.0, sp220/checkpoint-c ]
+    branches: [ main, release/2.2.0, sp220/checkpoint-c, sp220/checkpoint-d ]
   schedule:
     - cron: '27 3 * * 1'
 
 permissions:
   contents: read
   security-events: write
 
+env:
+  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
+
 jobs:
   analyze:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -24,6 +28,8 @@ jobs:
         uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           global-json-file: global.json
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
@@ -35,3 +41,6 @@ jobs:
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          ram: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && '16384' || '' }}
+          threads: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && '2' || '' }}

.github/workflows/dependency-review.yml

@@ -2,7 +2,7 @@ name: Dependency Review
 
 on:
   pull_request:
-    branches: [ main, release/2.2.0, sp220/checkpoint-c ]
+    branches: [ main, release/2.2.0, sp220/checkpoint-c, sp220/checkpoint-d ]
 
 permissions:
   contents: read