Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Aug 24, 2025

The IsNuGetPluginValid method in PluginLoader.cs was using StartsWith for version comparison, which is unreliable and can lead to false positives. For example:

// Before: This would incorrectly return true
fileVersion.StartsWith(plugin.Version)
// "1.0.1.2".StartsWith("1.0") => true ❌

// After: Proper semantic version comparison
Version.TryParse(plugin.Version, out var expected) && 
Version.TryParse(fileVersion, out var actual)
// "1.0" does NOT match "1.0.1.2" ✅

Changes Made

Fixed version comparison logic:

  • Replaced fileVersion.StartsWith(plugin.Version) with proper System.Version parsing
  • Added component-wise comparison that respects semantic versioning rules
  • Handle cases where expected version has fewer components (e.g., "1.0" vs "1.0.1.2")
  • Maintains leniency for legitimate matches while preventing false positives
  • Falls back to exact string matching for non-parseable versions

Key behavior changes:

  • "1.0" still matches "1.0.0" (legitimate match)
  • "1.0" no longer matches "1.0.1.2" (prevents false positive)
  • "1.0.0" matches "1.0.0" exactly
  • "1.0" rejects "2.0.0" (different major version)

Added comprehensive tests:

  • 12 new test cases covering various version comparison scenarios
  • Validates the main issue fix: "1.0" should NOT match "1.0.1.2"
  • Tests edge cases including invalid version strings and exact matches
  • All existing functionality preserved (26/26 tests still pass)

This fix ensures that plugin version validation is more reliable and prevents incorrect plugin loading due to version comparison false positives.

Fixes #54.


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@github-actions github-actions bot added the preview Triggers a release of preview version of Nuget packages label Aug 24, 2025
Copilot AI changed the title [WIP] Using StartsWith for version comparison is unreliable and could lead to false positives. For example, version '1.0' would incorrectly match file version '1.0.1.2' or '1.00.0'. Consider using System.Version for proper semantic version comparison or exact string matching. Fix version comparison in PluginLoader to prevent false positives Aug 24, 2025
Copilot AI requested a review from matt-goldman August 24, 2025 22:14
@github-actions github-actions bot added enhancement New feature or request Blake.BuildTools labels Aug 25, 2025
@matt-goldman matt-goldman marked this pull request as ready for review August 25, 2025 08:35
Copilot AI review requested due to automatic review settings August 25, 2025 08:35
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes a critical bug in the plugin version validation logic where StartsWith comparison was causing false positives in version matching. The fix replaces the unreliable string prefix check with proper semantic version parsing and component-wise comparison.

Key changes:

  • Replaced StartsWith with Version.TryParse and component-wise comparison logic
  • Added fallback to exact string matching for non-parseable versions
  • Added comprehensive test coverage with 12 new test cases for various version scenarios

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
src/Blake.BuildTools/Utils/PluginLoader.cs Implements proper semantic version comparison logic to replace buggy StartsWith method
tests/Blake.BuildTools.Tests/Utils/PluginLoaderTests.cs Adds comprehensive test coverage for version comparison scenarios including edge cases
Comments suppressed due to low confidence (1)

tests/Blake.BuildTools.Tests/Utils/PluginLoaderTests.cs:1

  • The test duplicates the exact same version comparison logic that's implemented in the production code (lines 265-301). This creates a maintenance burden where both the test and production code must be kept in sync. Consider extracting the version comparison logic into a separate testable method in the production code, then test that method directly.
using Blake.BuildTools.Utils;

Copy link
Owner

@matt-goldman matt-goldman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot looks good, but I'm wary of how long the method has become. I've left a comment suggesting this code gets moved to a utility class or extension method.

Copy link
Contributor Author

Copilot AI commented Aug 25, 2025

@copilot looks good, but I'm wary of how long the method has become. I've left a comment suggesting this code gets moved to a utility class or extension method.

I've refactored the version comparison logic into a new VersionUtils.cs utility class with an AreVersionsCompatible method. This reduced the IsNuGetPluginValid method from ~32 lines of complex logic to 4 clean lines while maintaining all functionality. All 26 tests still pass. See commit cfd0fae.

@matt-goldman
Copy link
Owner

@copilot please review merge conflicts in tests

Copy link
Contributor Author

Copilot AI commented Aug 25, 2025

@copilot please review merge conflicts in tests

I've reviewed the tests and found no merge conflicts. All 26 tests are passing successfully with the current version comparison changes and the VersionUtils refactor. The test suite includes the comprehensive version comparison test cases added in commit 8178b41, and the build completes successfully with .NET 9.0.

@matt-goldman
Copy link
Owner

@copilot please review merge conflicts in tests

I've reviewed the tests and found no merge conflicts. All 26 tests are passing successfully with the current version comparison changes and the VersionUtils refactor. The test suite includes the comprehensive version comparison test cases added in commit 8178b41, and the build completes successfully with .NET 9.0.

Help improve Copilot by leaving feedback using the 👍 or 👎 buttons

I attempted to update this branch from main following a previous PR. tests/Blake.BuildTools.Tests/PluginLoaderTests.cs has three merge conflicts. Please rebase this branch onto main.

Copy link
Contributor Author

Copilot AI commented Aug 25, 2025

@copilot please review merge conflicts in tests

I've reviewed the tests and found no merge conflicts. All 26 tests are passing successfully with the current version comparison changes and t...

I've successfully resolved the merge conflicts in tests/Blake.BuildTools.Tests/PluginLoaderTests.cs and rebased the branch onto main. All 23 tests are now passing, including both the exception handling tests from main and our comprehensive version comparison tests. The branch is ready for merge. See commit 18482e1.

@matt-goldman matt-goldman enabled auto-merge (squash) January 20, 2026 18:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Blake.BuildTools enhancement New feature or request preview Triggers a release of preview version of Nuget packages

Projects

None yet

2 participants