From b4423f11b0747db758d2a75c264aeaae2be52020 Mon Sep 17 00:00:00 2001 From: Timothy van der Ham Date: Mon, 31 Aug 2026 07:18:03 +0200 Subject: [PATCH 1/2] ci: pin global.json and CI to the same SDK band global.json named 10.0.204 with latestFeature, while every actions/setup-dotnet step asked for 10.0.x and floated to whatever band was newest at tag time -- 10.0.400 as of this change. With TreatWarningsAsErrors and AnalysisLevel latest, an analyzer diagnostic new to a later band fails CI without a local repro on the older SDK. Point global.json at 10.0.400 with latestPatch, and have all five setup-dotnet steps resolve global-json-file: global.json instead of repeating the version inline, so the two can no longer drift apart. Closes #231 --- .github/workflows/ci.yml | 4 ++-- .github/workflows/docs.yml | 2 +- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 8 ++++++++ global.json | 4 ++-- 5 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3e81af69..83b4891d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + global-json-file: global.json - name: Clean-room check shell: pwsh @@ -164,7 +164,7 @@ jobs: - uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + global-json-file: global.json - name: Install Native AOT prerequisites if: runner.os == 'Linux' diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 3e59c914..aa313e3a 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -38,7 +38,7 @@ jobs: - uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + global-json-file: global.json - name: Install DocFX run: dotnet tool update -g docfx diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e944d47..ae16a211 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + global-json-file: global.json - name: Derive version from tag id: version @@ -121,7 +121,7 @@ jobs: - uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + global-json-file: global.json - name: Derive version from tag id: version diff --git a/CHANGELOG.md b/CHANGELOG.md index d4ddea80..2e991691 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -209,6 +209,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). every assembly, and all eleven symbol PDBs with their SourceLink document maps are byte-identical, so nothing that ships changes. The package's own MSBuild logic is byte-identical to the SDK's copy; only the compiled task assembly now floats with the SDK band instead of being pinned. (#202) +- **`global.json` now pins the SDK feature band the workflows resolve, instead of trailing it.** + It named `10.0.204` with `latestFeature`, while every `actions/setup-dotnet` step asked for + `10.0.x` and landed on whatever band was newest at the time — `10.0.400` as of this change. With + `TreatWarningsAsErrors` and `AnalysisLevel latest`, a diagnostic new to that band is a CI failure + a developer on the older SDK cannot reproduce. `global.json` now reads `10.0.400` with + `latestPatch`, and all five `setup-dotnet` steps (`ci.yml` build and AOT smoke jobs, `release.yml` + library and tool jobs, `docs.yml`) point at `global-json-file: global.json` rather than repeating + the version inline, so the two can no longer drift apart. (#231) ### Fixed diff --git a/global.json b/global.json index 7270173c..55f28a66 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,6 @@ { "sdk": { - "version": "10.0.204", - "rollForward": "latestFeature" + "version": "10.0.400", + "rollForward": "latestPatch" } } From 762432f93cce8d76157c5dab76039b4482e39d86 Mon Sep 17 00:00:00 2001 From: Timothy van der Ham Date: Mon, 31 Aug 2026 08:16:30 +0200 Subject: [PATCH 2/2] ci: document the SDK band pin and log the resolved version Security review on #379 flagged that the SDK band change removed the automatic band uptake the old 10.0.x float gave developers, with no human-facing note of the new constraint or the release-time risk. - CONTRIBUTING.md: name the pinned feature band in the prerequisite and require any global.json bump to be merged and CI-validated before the next release tag, since release.yml reads global.json from the tag's tree. - global.json: comment on rollForward explaining it is load-bearing here even though latestPatch is the host default -- without it, setup-dotnet would freeze CI to exactly 10.0.400. - ci.yml, release.yml: log dotnet --version right after each setup-dotnet step so the resolved SDK lands in the build log. --- .github/workflows/ci.yml | 4 ++++ .github/workflows/release.yml | 4 ++++ CONTRIBUTING.md | 6 +++++- global.json | 2 ++ 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 83b4891d..9360b97b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,6 +22,8 @@ jobs: with: global-json-file: global.json + - run: dotnet --version + - name: Clean-room check shell: pwsh run: ./eng/clean-room-check.ps1 @@ -166,6 +168,8 @@ jobs: with: global-json-file: global.json + - run: dotnet --version + - name: Install Native AOT prerequisites if: runner.os == 'Linux' run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ae16a211..4c1513c8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,8 @@ jobs: with: global-json-file: global.json + - run: dotnet --version + - name: Derive version from tag id: version shell: bash @@ -123,6 +125,8 @@ jobs: with: global-json-file: global.json + - run: dotnet --version + - name: Derive version from tag id: version shell: bash diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 955d2468..e0168d69 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,7 +5,11 @@ build, test, and submit changes to VellumPdf. ## Prerequisites -- **.NET 10 SDK** (the only required runtime dependency). +- **.NET 10 SDK**, feature band 10.0.4xx — the exact pin is in `global.json`; + earlier feature bands are rejected. +- Before tagging a release: merge and CI-validate any `global.json` + feature-band bump first. `release.yml` reads `global.json` from the tag's + tree, so a stale pin ships a release built on a superseded SDK band. - **Docker** — needed to run the veraPDF conformance gate locally. - **qpdf** and **poppler-utils** — needed to run the structural-validator, text-extraction, signature, and barcode-rasterization oracle tests locally diff --git a/global.json b/global.json index 55f28a66..07023180 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,8 @@ { "sdk": { "version": "10.0.400", + // Required for CI to pick up 10.0.4xx patch releases; removing it pins CI to + // exactly 10.0.400 and drops patch servicing. "rollForward": "latestPatch" } }