diff --git a/CHANGELOG.md b/CHANGELOG.md index c670f16..f0e6f71 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to ConfigContraband will be documented in this file. -## Unreleased +## 0.7.25 - 2026-07-26 - Replaced obsolete Roslyn workspace-failure and code-fix testing APIs with `RegisterWorkspaceFailedHandler` and `CodeActionEquivalenceKey`, then removed the two blanket @@ -30,6 +30,21 @@ All notable changes to ConfigContraband will be documented in this file. before binding. Runtime order is preserved: a later empty container may overwrite an earlier value without invalidating the file. Matching paths across separate files and duplicate object members with disjoint leaves remain supported. +- Extended the existing `CFG006`-`CFG008` content checks to sound direct `Get()` targets and + inline-object `Bind(...)` calls, while retaining the framework-identity, provenance, side-effect, + strict-binding, and deduplication gates. Reordered named `OptionsBuilder.Bind(...)` arguments are + now resolved by parameter identity instead of source order. +- Suppressed `CFG003` and `CFG004` automatic fixes when a later fluent call retargets the options + builder, so a fix is offered only when it can append validation to the builder that is actually + bound. Added document, project, and solution Fix All contracts for all five automatic-fix + families, including mixed CFG001/CFG009 suggestions and cross-document CFG005 edits. +- Made schema registration extraction conservative when framework identity, the options type, + section argument, or invocation provenance cannot be proved; same-name lookalike APIs no longer + create bogus schema sections. The CLI now fails closed on incomplete workspace or project-load + analysis instead of writing a partial schema. +- Strengthened the public-package path by installing and exercising the packed CLI across help, + generation, current, stale, and load-failure paths; binding the .NET 8 compiler-host smoke to the + exact candidate package; and enforcing the CFG001-CFG009 showcase contract during publication. ## 0.7.24 - 2026-07-25 diff --git a/README.md b/README.md index cbef091..a9abde4 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,7 @@ Use it when your app relies on strongly typed options and you want configuration ## Install ```xml - + ``` The package includes `buildTransitive` props that pass visible `appsettings.json` and `appsettings.*.json` files to the analyser automatically. Add the package, build, and let your editor or CI tell you when your options contract and configuration drift apart. diff --git a/analyzer-health.md b/analyzer-health.md index 4a6312a..9fbc0e4 100644 --- a/analyzer-health.md +++ b/analyzer-health.md @@ -3,8 +3,8 @@ This file tracks the current ConfigContraband analyzer surface and the next hardening work that is still worth doing. It should stay practical: scores drive priority, notes describe shipped behavior, and gaps should be specific enough to turn into a focused PR. Last refreshed: 2026-07-26 -Package version: `0.7.24` -Base audited commit: `a5a19bf` +Package version: `0.7.25` +Base audited commit: `c99d112` ## Scoring Rubric @@ -497,7 +497,7 @@ CI and the publish workflow additionally run `scripts/verify-net8-analyzer-host. analyzer loads without `CS9057` and emits the expected `CFG001`, proving execution at the supported compiler-host floor before merge and publication. -Last executed 2026-07-26 verifier status: 775 analyzer/fixer, 303 core, and 9 tool tests passed (1,087 total); all six offline coverage-policy scenarios passed; the CI-mode Release build (`ContinuousIntegrationBuild=true`) completed with zero warnings and zero errors after removing both `CS0618` suppressions; formatter verification passed; both `0.7.24` packages passed payload/version/README verification; Codecov's official endpoint validated the no-regression project and 100% patch policies; and `git diff --check` was clean on the iteration-139 branch. The showcase contract emitted exactly one each of CFG001-CFG009 and no unrelated warnings. The prior Roslyn analyzer-testing reference-assembly resolution failure remains resolved and is not an active release-readiness blocker. +Last executed 2026-07-26 verifier status: 775 analyzer/fixer, 303 core, and 9 tool tests passed (1,087 total); all six offline coverage-policy scenarios passed; the CI-mode Release build (`ContinuousIntegrationBuild=true`) completed with zero warnings and zero errors after removing both `CS0618` suppressions; formatter verification passed; both `0.7.25` packages passed payload/version/README verification; Codecov's official endpoint validated the no-regression project and 100% patch policies; and `git diff --check` was clean on the release branch. The showcase contract emitted exactly one each of CFG001-CFG009 and no unrelated warnings. The prior Roslyn analyzer-testing reference-assembly resolution failure remains resolved and is not an active release-readiness blocker. Latest follow-up audit evidence on 2026-07-25 reported verification status `pass`, with both package projects and the public GitHub release at `0.7.23`, a Roslyn 4.8 compatibility floor on the shipped analyzer assemblies, and no score-math issue. Exact-HEAD CI, CodeQL, and publish workflows passed, including the .NET 8 analyzer-host smoke gate. That smoke script could not be replayed locally because only .NET 10 SDKs are installed, so the exact remote runs are the compatibility proof. Release Readiness remains `5`; rule severity and score math are otherwise unchanged. diff --git a/src/ConfigContraband.Tool/ConfigContraband.Tool.csproj b/src/ConfigContraband.Tool/ConfigContraband.Tool.csproj index e59d00c..7234af0 100644 --- a/src/ConfigContraband.Tool/ConfigContraband.Tool.csproj +++ b/src/ConfigContraband.Tool/ConfigContraband.Tool.csproj @@ -16,7 +16,7 @@ true configcontraband ConfigContraband.Tool - 0.7.24 + 0.7.25 George Wall ConfigContraband.Tool Generates appsettings.schema.json from your .NET Options types so editors give live autocomplete, type checking, and required-key hints while editing appsettings.json. diff --git a/src/ConfigContraband/ConfigContraband.csproj b/src/ConfigContraband/ConfigContraband.csproj index 6f920e7..0591d12 100644 --- a/src/ConfigContraband/ConfigContraband.csproj +++ b/src/ConfigContraband/ConfigContraband.csproj @@ -14,7 +14,7 @@ ConfigContraband - 0.7.24 + 0.7.25 George Wall ConfigContraband Stop smuggling broken appsettings into production. ConfigContraband is a Roslyn analyzer for .NET Options and configuration correctness. @@ -25,7 +25,7 @@ https://github.com/georgepwall1991/ConfigContraband git https://github.com/georgepwall1991/ConfigContraband - Precision release: CFG002 now recognizes non-null array initializer forms that already satisfy RequiredAttribute. CFG008 now follows ConfigurationBinder container semantics by suppressing loose collection/dictionary conversion failures that the runtime skips and reporting supported malformed elements only when strict binding rethrows. CI now enforces exactly one CFG001-CFG009 showcase diagnostic. No diagnostic IDs, severities, messages, or code fixes changed. + Reliability release: adds conservative CFG006-CFG008 analysis for direct Get<T>/Bind targets; supports reordered named Bind arguments; suppresses unsafe validation fixes after builder retargeting; aligns duplicate JSON-path handling with the runtime; makes CFG005 deterministic and cancellation-aware; hardens schema extraction and fail-closed CLI behavior; adds rule help links and Fix All contracts; and strengthens warning, coverage, showcase, packed-tool, and exact .NET 8 release gates. Diagnostic IDs and severities are unchanged. true false true diff --git a/tests/Compatibility/Net8Consumer/Net8Consumer.csproj b/tests/Compatibility/Net8Consumer/Net8Consumer.csproj index 5a6dbb3..936a77a 100644 --- a/tests/Compatibility/Net8Consumer/Net8Consumer.csproj +++ b/tests/Compatibility/Net8Consumer/Net8Consumer.csproj @@ -8,7 +8,7 @@ $(NoWarn);CA1050 $(WarningsAsErrors);CFG001;CS9057 - 0.7.24 + 0.7.25 $(MSBuildThisFileDirectory)../../../artifacts/packages;https://api.nuget.org/v3/index.json diff --git a/tests/ConfigContraband.Tests/AnalyzerInfrastructureTests.cs b/tests/ConfigContraband.Tests/AnalyzerInfrastructureTests.cs index 83c5dcd..076708e 100644 --- a/tests/ConfigContraband.Tests/AnalyzerInfrastructureTests.cs +++ b/tests/ConfigContraband.Tests/AnalyzerInfrastructureTests.cs @@ -236,7 +236,7 @@ public void Net8_host_verifier_loads_the_exact_packed_candidate() Assert.Contains(".nupkg.metadata", verifier, StringComparison.Ordinal); Assert.Contains("metadata.get(\"source\")", verifier, StringComparison.Ordinal); Assert.Contains( - "0.7.24", + "0.7.25", consumerProject, StringComparison.Ordinal); Assert.Contains(