ci: add ARM64 device farm, Docker runner, and self-hosted CI hardening

.config/dotnet-tools.json

@@ -0,0 +1,5 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {}
+}

.editorconfig

@@ -80,7 +80,7 @@ dotnet_naming_style.camel_case_underscore_style.capitalization = camel_case
 # Code style defaults
 csharp_using_directive_placement = outside_namespace:suggestion
 dotnet_sort_system_directives_first = true
-csharp_prefer_braces = true:silent
+csharp_prefer_braces = true:warning
 csharp_preserve_single_line_blocks = true:none
 csharp_preserve_single_line_statements = false:none
 csharp_prefer_static_local_function = true:suggestion

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+
+## Checklist
+
+- [ ] Tested locally
+- [ ] No sensitive data (serials, IPs, tokens) in committed files
+
+<!--
+  If this is a Dependabot GitHub Actions SHA bump (chore(deps)):
+  After merging, update the matching SHA in:
+  Settings → Actions → General → "Allow or block specified actions and reusable workflows"
+-->

.github/dependabot.yml

@@ -1,5 +1,28 @@
 version: 2
 updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+    labels:
+      - "actions-sha-bump"
+
+  - package-ecosystem: "docker"
+    directory: "/docker/runner"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+
+  - package-ecosystem: "docker"
+    directory: "/docker/appium"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore(deps)"
+
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:

.github/workflows/actions-sha-bump-reminder.yml

@@ -0,0 +1,23 @@
+name: Actions SHA bump reminder
+
+on:
+  pull_request:
+    types: [labeled]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  remind:
+    if: github.event.label.name == 'actions-sha-bump'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post allow-list reminder
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr comment ${{ github.event.pull_request.number }} \
+            --repo ${{ github.repository }} \
+            --body "**Reminder:** After merging, update the matching SHA in [Settings → Actions → General → Allow list](../../settings/actions).
+
+            The new SHA is in the workflow file changed by this PR."

.github/workflows/ci.yml

@@ -17,24 +17,24 @@ jobs:
     runs-on: macos-26-intel
     steps:
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
         with:
           global-json-file: global.json
 
       - name: Cache SonarQube Cloud packages
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
 
       - name: Cache SonarQube Cloud scanner
         id: cache-sonar-scanner
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ${{ runner.temp }}/scanner
           key: ${{ runner.os }}-sonar-scanner
@@ -63,13 +63,13 @@ jobs:
           ${{ runner.temp }}/scanner/dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN"
 
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage
           path: ${{ runner.temp }}/coverage.xml
 
       - name: Generate coverage report
-        uses: danielpalme/ReportGenerator-GitHub-Action@5.5.9
+        uses: danielpalme/ReportGenerator-GitHub-Action@c31aa4ed4f12f147061186cf2a029f307b5c3636 # 5.5.9
         with:
           reports: ${{ runner.temp }}/coverage.xml
           targetdir: ${{ runner.temp }}/coveragereport

.github/workflows/docker-images.yml

@@ -0,0 +1,66 @@
+name: Docker Images
+
+on:
+  push:
+    branches: [main, "*.*.*-preview.*"]
+    paths:
+      - 'docker/**'
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  OWNER: phunkeler
+
+jobs:
+  build-runner:
+    name: Build runner image
+    runs-on: ubuntu-24.04-arm
+    if: github.repository_owner == 'phunkeler'
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push runner image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: docker/runner/Dockerfile
+          platforms: linux/arm64
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/nearbyconnections-runner:latest
+
+  build-appium:
+    name: Build appium image
+    runs-on: ubuntu-24.04-arm
+    if: github.repository_owner == 'phunkeler'
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push appium image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: docker/appium
+          platforms: linux/arm64
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.OWNER }}/nearbyconnections-appium:latest

.github/workflows/os-maintenance.yml

@@ -0,0 +1,41 @@
+name: OS Maintenance
+
+on:
+  schedule:
+    - cron: '0 2 * * 0'  # Weekly, Sunday 02:00 UTC
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  dry-run-upgrades:
+    name: Unattended-upgrade dry run
+    runs-on: [self-hosted, linux, ARM64]
+    steps:
+      - name: Run dry run via SSH
+        id: dry_run
+        env:
+          PI_SSH_PRIVATE_KEY: ${{ secrets.PI_SSH_PRIVATE_KEY }}
+        run: |
+          eval $(ssh-agent -s)
+          echo "$PI_SSH_PRIVATE_KEY" | ssh-add -
+          OUTPUT=$(ssh \
+            -o StrictHostKeyChecking=accept-new \
+            -o UserKnownHostsFile=/tmp/pi_known_hosts \
+            sandlot@host.docker.internal \
+            "sudo unattended-upgrade --dry-run 2>&1" || true)
+          ssh-agent -k
+          {
+            echo 'output<<EOF'
+            echo "$OUTPUT"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Post job summary
+        run: |
+          {
+            echo "## Unattended-Upgrade Dry Run — $(date -u '+%Y-%m-%d %H:%M UTC')"
+            echo '```'
+            echo "${{ steps.dry_run.outputs.output }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish.yml

@@ -7,32 +7,50 @@ on:
 
 permissions:
   id-token: write
-  contents: read
+  contents: write
 
 jobs:
   publish:
     runs-on: macos-latest
     environment: nuget
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0  # Required for MinVer to resolve the version from git tags
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5
         with:
           global-json-file: global.json
 
       - name: Restore workloads
         run: dotnet workload restore src/Plugin.Maui.NearbyConnections/Plugin.Maui.NearbyConnections.csproj
 
+      - name: Build
+        run: dotnet build src/Plugin.Maui.NearbyConnections/Plugin.Maui.NearbyConnections.csproj -c Release
+
+      - name: Build tests
+        run: dotnet build test/Plugin.Maui.NearbyConnections.UnitTests/Plugin.Maui.NearbyConnections.UnitTests.csproj -c Release
+
+      - name: Test
+        run: dotnet exec test/Plugin.Maui.NearbyConnections.UnitTests/bin/Release/net10.0/Plugin.Maui.NearbyConnections.UnitTests.dll
+
       - name: Pack
         run: dotnet pack src/Plugin.Maui.NearbyConnections/Plugin.Maui.NearbyConnections.csproj -c Release --output nupkgs /p:ContinuousIntegrationBuild=true
 
       - name: Login to NuGet.org (OIDC)
-        uses: NuGet/login@v1.2.0
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         id: login
         with:
           user: phunkeler
 
       - name: Push to NuGet.org
         run: dotnet nuget push nupkgs/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --generate-notes \
+            --prerelease=${{ contains(github.ref_name, 'preview') }} \
+            nupkgs/*.nupkg

.github/workflows/reapply-config.yml

@@ -0,0 +1,41 @@
+name: Reapply host config
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  reapply:
+    name: Reapply Pi host configuration
+    runs-on: [self-hosted, linux, ARM64]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Reapply configuration via SSH
+        id: reapply
+        env:
+          PI_ADMIN_SSH_KEY: ${{ secrets.PI_ADMIN_SSH_KEY }}
+        run: |
+          eval $(ssh-agent -s)
+          echo "$PI_ADMIN_SSH_KEY" | ssh-add -
+          OUTPUT=$(ssh \
+            -o StrictHostKeyChecking=accept-new \
+            -o UserKnownHostsFile=/tmp/pi_known_hosts \
+            sandlot@host.docker.internal \
+            < scripts/reapply-host-config.sh 2>&1 || true)
+          ssh-agent -k
+          {
+            echo 'output<<EOF'
+            echo "$OUTPUT"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Post job summary
+        run: |
+          {
+            echo "## Host config reapplied — $(date -u '+%Y-%m-%d %H:%M UTC')"
+            echo '```'
+            echo "${{ steps.reapply.outputs.output }}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-please.yml

@@ -13,7 +13,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           config-file: .release-please-config.json
           manifest-file: .release-please-manifest.json