chore(ci): rebuild & harden workflows

.github/workflows/ci.yml

@@ -14,8 +14,13 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   pr-labeling:
+    name: pr-labeling
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     permissions:
@@ -40,7 +45,9 @@ jobs:
       - name: Run Entry Check
         env:
           GH_TOKEN: ${{ github.token }}
-        run: bash tools/ci/bin/run.sh pr-labeling
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh pr-labeling
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -50,6 +57,7 @@ jobs:
           if-no-files-found: error
 
   preflight:
+    name: preflight
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -67,7 +75,9 @@ jobs:
         with:
           node-version: "20"
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh preflight
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh preflight
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -77,6 +87,7 @@ jobs:
           if-no-files-found: error
 
   docs-links-full:
+    name: docs-links-full
     runs-on: ubuntu-latest
     needs: preflight
     steps:
@@ -89,7 +100,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh docs-links-full
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh docs-links-full
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -99,6 +112,7 @@ jobs:
           if-no-files-found: error
 
   versioning-svt:
+    name: versioning-svt
     runs-on: ubuntu-latest
     needs: preflight
     steps:
@@ -111,7 +125,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh versioning-svt
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh versioning-svt
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -121,6 +137,7 @@ jobs:
           if-no-files-found: error
 
   naming-snt:
+    name: naming-snt
     runs-on: ubuntu-latest
     needs: preflight
     steps:
@@ -133,7 +150,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh naming-snt
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh naming-snt
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -143,6 +162,7 @@ jobs:
           if-no-files-found: error
 
   build:
+    name: build
     runs-on: ubuntu-latest
     needs: [preflight, versioning-svt, naming-snt]
     steps:
@@ -155,7 +175,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh build
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh build
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -165,6 +187,7 @@ jobs:
           if-no-files-found: error
 
   api-contract:
+    name: api-contract
     runs-on: ubuntu-latest
     needs: build
     steps:
@@ -177,7 +200,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh api-contract
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh api-contract
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -187,6 +212,7 @@ jobs:
           if-no-files-found: error
 
   pack:
+    name: pack
     runs-on: ubuntu-latest
     needs: [build, versioning-svt]
     steps:
@@ -199,7 +225,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh pack
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh pack
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -209,6 +237,7 @@ jobs:
           if-no-files-found: error
 
   consumer-smoke:
+    name: consumer-smoke
     runs-on: ubuntu-latest
     needs: pack
     steps:
@@ -226,7 +255,9 @@ jobs:
           name: ci-pack
           path: artifacts/ci/pack
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh consumer-smoke
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh consumer-smoke
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -236,6 +267,7 @@ jobs:
           if-no-files-found: error
 
   package-backed-tests:
+    name: package-backed-tests
     runs-on: ubuntu-latest
     needs: pack
     steps:
@@ -253,7 +285,9 @@ jobs:
           name: ci-pack
           path: artifacts/ci/pack
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh package-backed-tests
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh package-backed-tests
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -263,6 +297,7 @@ jobs:
           if-no-files-found: error
 
   security-nuget:
+    name: security-nuget
     runs-on: ubuntu-latest
     needs: build
     steps:
@@ -275,7 +310,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh security-nuget
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh security-nuget
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -285,6 +322,7 @@ jobs:
           if-no-files-found: error
 
   tests-bdd-coverage:
+    name: tests-bdd-coverage
     runs-on: ubuntu-latest
     needs: build
     steps:
@@ -297,7 +335,9 @@ jobs:
             8.0.x
             10.0.102
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh tests-bdd-coverage
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh tests-bdd-coverage
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4
@@ -307,6 +347,7 @@ jobs:
           if-no-files-found: error
 
   summary:
+    name: summary
     runs-on: ubuntu-latest
     needs: [docs-links-full, naming-snt, versioning-svt, api-contract, consumer-smoke, package-backed-tests, security-nuget, tests-bdd-coverage]
     steps:
@@ -369,7 +410,9 @@ jobs:
           name: ci-tests-bdd-coverage
           path: artifacts/ci/tests-bdd-coverage
       - name: Run Entry Check
-        run: bash tools/ci/bin/run.sh summary
+        run: |
+          set -euo pipefail
+          bash tools/ci/bin/run.sh summary
       - name: Upload Artifact
         if: always()
         uses: actions/upload-artifact@v4

.github/workflows/qodana.yml

@@ -44,19 +44,15 @@ jobs:
           if [ -f .editorconfig.qodana.bak ]; then
             mv .editorconfig.qodana.bak .editorconfig
           fi
-      - name: Skip Qodana (missing token)
-        if: env.QODANA_TOKEN == ''
-        run: echo "QODANA_TOKEN is not set; skipping Qodana scan."
       - name: Run Entry Check
-        if: env.QODANA_TOKEN != ''
         run: bash tools/ci/bin/run.sh qodana
       - name: Upload SARIF To Code Scanning
         if: github.event_name != 'pull_request' && env.QODANA_TOKEN != ''
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: artifacts/ci/qodana/qodana.sarif.json
       - name: Upload Artifact
-        if: always() && env.QODANA_TOKEN != ''
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: ci-qodana

qodana.yaml

@@ -2,4 +2,16 @@ version: "1.0"
 linter: jetbrains/qodana-dotnet:2025.3
 
 profile:
-    path: .qodana/profiles/fileclassifier.yaml
+  path: .qodana/profiles/fileclassifier.yaml
+
+# Scope-limited excludes for known non-security false positives on the VB codebase.
+exclude:
+  - name: CheckNamespace
+    paths:
+      - src/FileTypeDetection/**
+  - name: VBWarnings__BC40056
+    paths:
+      - src/FileTypeDetection/**
+  - name: UnusedImportClause
+    paths:
+      - src/FileTypeDetection/**

tools/ci/bin/run.sh

@@ -15,15 +15,6 @@ fi
 
 OUT_DIR="artifacts/ci/${CHECK_ID}"
 
-if [[ "$CHECK_ID" == "artifact_contract" || "$CHECK_ID" == "summary" ]]; then
-  cd "$ROOT_DIR"
-  dotnet restore --locked-mode "${ROOT_DIR}/tools/ci/checks/ResultSchemaValidator/ResultSchemaValidator.csproj"
-  dotnet build -c Release "${ROOT_DIR}/tools/ci/checks/ResultSchemaValidator/ResultSchemaValidator.csproj"
-  dotnet restore --locked-mode "${ROOT_DIR}/tools/ci/checks/PolicyRunner/PolicyRunner.csproj"
-  dotnet build -c Release "${ROOT_DIR}/tools/ci/checks/PolicyRunner/PolicyRunner.csproj"
-  exec dotnet "${ROOT_DIR}/tools/ci/checks/PolicyRunner/bin/Release/net10.0/PolicyRunner.dll" --check-id "${CHECK_ID}" --repo-root "${ROOT_DIR}" --out-dir "${OUT_DIR}"
-fi
-
 ci_result_init "$CHECK_ID" "$OUT_DIR"
 
 finalized=0
@@ -406,6 +397,14 @@ run_qodana_contract() {
   ci_result_append_summary "Qodana contract validation completed."
 }
 
+run_policy_contract() {
+  build_validators
+  if ! run_policy_runner_bridge "$CHECK_ID" "$OUT_DIR" "Policy contract check (${CHECK_ID})" "tools/ci/policies/rules"; then
+    return 1
+  fi
+  ci_result_append_summary "Policy contract check '${CHECK_ID}' completed."
+}
+
 main() {
   cd "$ROOT_DIR"
   case "$CHECK_ID" in
@@ -420,10 +419,7 @@ main() {
     build) run_build ;;
     security-nuget) run_security_nuget ;;
     tests-bdd-coverage) run_tests_bdd_coverage ;;
-    summary)
-      ci_result_add_violation "CI-RUNNER-001" "fail" "summary must be executed via PolicyRunner bridge" "tools/ci/bin/run.sh"
-      return 2
-      ;;
+    summary|artifact_contract) run_policy_contract ;;
     pr-labeling) run_pr_labeling ;;
     qodana) run_qodana_contract ;;
     *)

tools/ci/errors/classes.toml

@@ -0,0 +1,6 @@
+[classes]
+missing_input = "01"
+command_failed = "02"
+policy_violation = "03"
+schema_failure = "04"
+blocking_findings = "05"

tools/ci/errors/errors.toml

@@ -0,0 +1,16 @@
+[errors]
+E0102 = "CI setup command failed for check '{check_id}' ({rule_id})."
+E1002 = "Policy execution command failed for check '{check_id}' ({rule_id})."
+E1003 = "Policy violation detected for check '{check_id}' ({rule_id})."
+E2002 = "Build command failed for check '{check_id}' ({rule_id})."
+E3002 = "Test execution failed for check '{check_id}' ({rule_id})."
+E4002 = "Packaging command failed for check '{check_id}' ({rule_id})."
+E5002 = "Security scan command failed for check '{check_id}' ({rule_id})."
+E5005 = "Security blocking findings detected for check '{check_id}' ({rule_id})."
+E6001 = "Qodana required input missing for check '{check_id}' ({rule_id})."
+E6002 = "Qodana contract execution failed for check '{check_id}' ({rule_id})."
+E6005 = "Qodana blocking findings detected for check '{check_id}' ({rule_id})."
+E7001 = "Runner invocation is invalid for check '{check_id}' ({rule_id})."
+E8004 = "Result schema validation failed for check '{check_id}' ({rule_id})."
+E9002 = "CI command failed for check '{check_id}' ({rule_id})."
+E9901 = "Error mapping/artifact-link failure for check '{check_id}' ({reason})."

tools/ci/errors/steps.toml

@@ -0,0 +1,12 @@
+[steps]
+setup = "01"
+policy = "10"
+build = "20"
+test = "30"
+pack = "40"
+security = "50"
+qodana = "60"
+runner = "70"
+schema = "80"
+generic = "90"
+error_ux = "99"