mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-18 22:55:08 +08:00
e9313ef957
## Description Two related changes to how the 2.0 line is built and shipped. ### 1. Release-branch-only package publication - `master` produces development previews only. - Stable packages can only be built from a canonical `release/<major>.<minor>` branch and are promoted manually from the exact signed candidate artifact. - Core packages use explicit `major.minor.patch` versions (`2.0.0`, `2.0.1`, then `2.1.0`); git height never changes a stable package patch. - XRegistry, WoT Connectivity, Vision, Robotics, Redundancy, Positioning, OpenUSD, ISA95, AI, DI, the relevant MCP extensions, and OpenUSD connector tools remain `-preview.N` while following the core numeric version. - nuget.org receives only non-`.Debug` package IDs; GitHub Packages retains the complete signed Release/Debug candidate. - `docs/ReleaseProcess.md` is a reproducible runbook for developers and agents, with each step stating its completion evidence. Promotion is source-bound and byte-checked: `release.yml` checks out nothing until the candidate SHA is known, and `assert-published-packages-match.ps1` proves that any version already on a feed holds *this* candidate's content before `--skip-duplicate` is allowed to skip it. Canonical release-branch naming is matched case-sensitively with no leading zeroes, and `version.json`'s `publicReleaseRefSpec`, both policy helpers and the copy `release.yml` inlines are pinned to one expression by tests. ### 2. PR CI moved to GitHub-hosted runners - `.github/workflows/buildandtest.yml` (**CI**) now owns pull-request validation outright, covering the Windows Debug/Release net48 + net10.0 solution builds and fast tests that only Azure Pipelines ran, alongside the existing Linux/macOS, all-target and NativeAOT legs. `build-and-test summary` remains the stable required check name. - `.github/workflows/nightly.yml` is a new **manual-only** (`workflow_dispatch`) full-scope workflow covering the Azure nightly workload: all solutions x seven target profiles x Debug/Release, the net472/netstandard profiles, Windows + Linux NativeAOT, and the long-running and durable tiers. - Shared deterministic discovery/batching lives in `.github/scripts/get-ci-matrix.ps1` with a local composite action, so both entry points expand the same workload manifest instead of duplicating a large embedded script. - `azure-pipelines.yml` is set to `pr: none`. - The standalone pump sample image workflow is folded into the consolidated **Images CI** workflow, which now builds all ten images and publishes an `images summary` rollup suitable as a required check. ## Related Issues No related issue provided. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received. ## Validation - `Opc.Ua.Tools.Tests` full `net10.0` suite: **959 passed, 1 skipped, 0 failed**. - Version/package-policy regression subset (`PackageVersionPolicyTests`): **60 passed, 0 failed**. - GitHub Actions **CI** run 35719807620: **149/149 jobs green** on GitHub-hosted runners. - Canonical release-branch rule verified against the pinned nbgv 3.7.115 by building throwaway branches: `release/2.0`, `release/0.9`, `release/10.42` -> `PublicRelease=True`; `release/02.0`, `release/2.00`, `Release/2.0` -> `False`. - Package identity gate verified against a live nuget.org package: served packages carry a repository `.signature.p7s`, so equality is decided on content excluding that part. Re-signing and zip reordering produce an identical digest; a one-byte content change does not. - Synthetic Release-only, Debug-only, combined, preview, duplicate, orphaned-symbol, mismatched-root and accidental-stable-family package sets exercise the shared validator. - Stable-release rehearsal in an isolated `release/2.0` clone: `Opc.Ua.Di` packed as `2.0.0-preview.6` depending on stable Core `2.0.0`; `Opc.Ua.Di.Client` likewise against stable Client `2.0.0`. - All workflow YAML, `version.json`, the package-policy PowerShell scripts and the internal release-runbook anchors parse. ## Known validation limits - Full `UA.slnx` `net48` and `net10.0` local validation remains blocked by pre-existing `NETSDK1005` and dependency-version failures in unmodified fuzz/sample projects; the corresponding checklist items intentionally stay open. - The TRX-driven test verdict added for the intermittent at-exit host stall is proven by `CiTestVerdictTests`; the stall itself has not recurred since. - `nightly.yml` has not yet been run against a full-scope Azure run for tuple-level parity — see below. ## Operational follow-up This remains a preparation PR targeting `master`. It does **not** authorize a release. Release sequence: 1. Merge this PR. 2. Create canonical `release/2.0`, advance `master` to `2.1.0-preview.{height}`, and open a separate `2.0.0` version PR against `release/2.0`. 3. Follow [`docs/ReleaseProcess.md`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/docs/ReleaseProcess.md) for candidate dry-run, environment approval, promotion, tag/release finalization, and next-patch preview setup. CI migration steps still needing administrator access are tracked in [`docs/DeveloperGuide.md#migration-status`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/docs/DeveloperGuide.md#migration-status): proving `nightly.yml` parity on a trusted SHA with the private fuzz corpus provisioned, turning off definition 14's service-side PR override, retiring the Azure full-scope schedules and push trigger, and retiring the duplicate `azure-pipelines-preview.yml` publisher. > **Before cutting `release/2.0`:** the `Release` ruleset requires the Azure context for *every* `refs/heads/release/*`, but a new 2.x branch inherits `pr: none`, so that context would never report and would block every PR into the new line. Exclude the new ref from that ruleset, or add a 2.x ruleset requiring `build-and-test summary`, as part of creating the branch. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
70 lines
2.5 KiB
PowerShell
70 lines
2.5 KiB
PowerShell
<#
|
|
.SYNOPSIS
|
|
Decides whether a set of changed files can affect a build or test outcome.
|
|
|
|
.DESCRIPTION
|
|
Called by .github/scripts/get-ci-matrix.ps1's callers - currently the
|
|
'Resolve path relevance' step in .github/workflows/buildandtest.yml - and
|
|
exercised directly by tests/Opc.Ua.Tools.Tests/CiPathRelevanceTests.cs.
|
|
|
|
This replaces the 'paths:' filter that used to sit on the pull_request
|
|
trigger. Filtering the whole workflow out would stop 'build-and-test
|
|
summary' from ever reporting, and a required status check that never
|
|
reports blocks the pull request forever; deciding relevance here skips the
|
|
expensive jobs instead, while the summary job still reports.
|
|
|
|
That makes this rule fail-dangerous in exactly one direction. If it wrongly
|
|
reports a change as irrelevant, the build, test and NativeAOT jobs are
|
|
skipped and the required summary still reports success - a broken change
|
|
merges with a green check. If it wrongly reports an irrelevant change as
|
|
relevant, CI merely does needless work.
|
|
|
|
So the rule is a deny-list, not an allow-list of build inputs. An allow-list
|
|
of extensions cannot be kept complete: the source generators consume .xml
|
|
and .csv design files (see the AdditionalFiles items in
|
|
src/Opc.Ua.WotCon/Opc.Ua.WotCon.csproj), test projects carry XML and JSON
|
|
fixtures and NodeSet assets, .editorconfig is enforced at build time, and
|
|
every new input of that kind would have to be remembered here. Only files
|
|
that cannot change a build or test outcome are skippable: Markdown, and the
|
|
docs/ tree, which holds nothing but Markdown and images.
|
|
|
|
.PARAMETER ChangedFile
|
|
Repository-relative paths, as produced by 'git diff --name-only'. An empty
|
|
set means the branch changes nothing and nothing needs to be rebuilt.
|
|
|
|
.OUTPUTS
|
|
[bool] $true when at least one changed file can affect a build or test.
|
|
#>
|
|
param(
|
|
[AllowEmptyCollection()]
|
|
[AllowEmptyString()]
|
|
[string[]] $ChangedFile = @()
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
function Test-DocumentationOnlyPath([string] $Path)
|
|
{
|
|
if ([string]::IsNullOrWhiteSpace($Path)) {
|
|
return $true
|
|
}
|
|
|
|
# git reports forward slashes on every platform, including Windows.
|
|
$normalized = $Path -replace '\\', '/'
|
|
|
|
if ([System.IO.Path]::GetExtension($normalized) -ieq '.md') {
|
|
return $true
|
|
}
|
|
|
|
return $normalized -like 'docs/*'
|
|
}
|
|
|
|
foreach ($file in $ChangedFile) {
|
|
if (-not (Test-DocumentationOnlyPath $file)) {
|
|
return $true
|
|
}
|
|
}
|
|
|
|
return $false
|