FEntwumS.ContainerExtension/Directory.Build.props at main · FEntwumS/FEntwumS.ContainerExtension · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
<Project>
    <!-- Core Compiler Settings -->
    <PropertyGroup>
        <LangVersion>13.0</LangVersion>
        <ImplicitUsings>enable</ImplicitUsings>
        <Nullable>enable</Nullable>
        <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
        <IsAotCompatible>true</IsAotCompatible>
    </PropertyGroup>

    <!-- Code Analysis & Warnings -->
    <PropertyGroup>
        <AnalysisMode>All</AnalysisMode>
        <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
        <AnalysisLevel>latest-all</AnalysisLevel>
        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
        <!-- Suppressions are limited to three categories, each reviewed:
             - Build plumbing: NETSDK1187, SYSLIB1054, NU1510.
             - Accepted style/perf/globalization noise for an EDA tool: CA2007, CA1822, CA1032, CA1805,
               CA1034, CA1307 (and its Meziantou twin MA0074), CA1859, CA1513, CA1847, CA1848, CA1308,
               CA1861, CA1303, CA1305, CA1867, CA1002.
             - Deliberate or reviewed-as-false-positive: CA1031 (catch Exception is intentional in the
               telemetry/process layer), CA2000 (dispose ownership verified by the correctness audit),
               CA1062 (the public boundary is null-guarded by Nullable=enable), CA5392 (P/Invokes target OS
               KnownDLLs and libc, where DLL planting does not apply), CA5398 (TLS 1.2/1.3 is pinned by
               design), CA1508 (dataflow false positive: the Process initializer can throw, leaving p null).
             CA1001 and CA1849 were re-enabled and fixed rather than suppressed. -->
        <NoWarn>NETSDK1187;SYSLIB1054;NU1510;CA2007;CA1822;CA1032;CA1805;CA1034;CA1307;MA0074;CA1031;CA1859;CA1513;CA1847;CA1848;CA1308;CA1861;CA1303;CA1305;CA1867;CA1002;CA2000;CA1062;CA5392;CA5398;CA1508</NoWarn>
    </PropertyGroup>

    <!-- Supply Chain Security & CI/CD -->
    <PropertyGroup>
        <Deterministic>true</Deterministic>
        <PathMap Condition="'$(GITHUB_ACTIONS)' == 'true'">$(MSBuildProjectDirectory)=/_/</PathMap>
        <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
        <EmbedUntrackedSources>true</EmbedUntrackedSources>

        <NuGetAudit>true</NuGetAudit>
        <NuGetAuditMode>all</NuGetAuditMode>
        <NuGetAuditLevel>low</NuGetAuditLevel>

        <!-- Pin the restore graph to a committed packages.lock.json. CI restores in locked
             mode (RestoreLockedMode=true), so a drifted transitive dependency fails the build
             rather than resolving silently: restore is reproducible, not only the compile. -->
        <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
    </PropertyGroup>

    <!-- Metadata -->
    <PropertyGroup>
        <Authors>Mert Torun</Authors>
        <Company>TH Köln</Company>
        <Copyright>© 2025 - 2026 Mert Torun</Copyright>
        <RepositoryUrl>https://github.com/FEntwumS/FEntwumS.ContainerExtension</RepositoryUrl>
        <RepositoryType>git</RepositoryType>
    </PropertyGroup>

    <!-- Deterministic builds are asserted, not announced: the property is required rather than
         reported, so a misconfigured build fails closed instead of printing that it was verified.
         Source formatting is gated separately, by the dotnet format step in the CI workflow. -->
    <Target Name="DeterministicVerify" BeforeTargets="BeforeBuild">
        <Error Condition="'$(Deterministic)' != 'true'" Text="Deterministic builds are required." />
    </Target>
</Project>