FlowX/Directory.Build.props at dev · votrongdao/FlowX · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
<Project>

  <PropertyGroup>
    <TargetFramework>net10.0</TargetFramework>
    <LangVersion>preview</LangVersion>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>

    <!-- Constraint C2: every package must stay NativeAOT- and trim-compatible. -->
    <IsAotCompatible>true</IsAotCompatible>
    <IsTrimmable>true</IsTrimmable>
    <EnableTrimAnalyzer>true</EnableTrimAnalyzer>
    <EnableAotAnalyzer>true</EnableAotAnalyzer>

    <!-- A warning nobody fixes is a warning that hides the next one. -->
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <WarningsNotAsErrors></WarningsNotAsErrors>
    <AnalysisLevel>latest-recommended</AnalysisLevel>
    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>

    <!--
      ADR-0002: generated code is debuggable, on disk, breakpoint-able (risk R1).

      The path is spelled out rather than built from $(BaseIntermediateOutputPath):
      that property is not yet assigned when Directory.Build.props is evaluated, so
      it expands to empty and the generated sources land in the project directory —
      where the next build globs them back in and they collide with the generator's
      own output (CS0102/CS0433). Under obj/ they stay out of the default Compile
      glob while remaining on disk for the debugger.
    -->
    <EmitCompilerGeneratedFiles>true</EmitCompilerGeneratedFiles>
    <CompilerGeneratedFilesOutputPath>$(MSBuildProjectDirectory)/obj/generated</CompilerGeneratedFilesOutputPath>

    <!-- Supply chain: reproducible builds + source links (docs/15-Security.md §8). -->
    <Deterministic>true</Deterministic>
    <ContinuousIntegrationBuild Condition="'$(CI)' == 'true'">true</ContinuousIntegrationBuild>
    <PublishRepositoryUrl>true</PublishRepositoryUrl>
    <EmbedUntrackedSources>true</EmbedUntrackedSources>
    <IncludeSymbols>true</IncludeSymbols>
    <SymbolPackageFormat>snupkg</SymbolPackageFormat>

    <!-- Constraint C7: SemVer with a 2-minor deprecation window. -->
    <VersionPrefix>0.1.0</VersionPrefix>
    <Authors>FlowX Contributors</Authors>
    <Product>FlowX</Product>
    <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
    <PackageProjectUrl>https://github.com/votrongdao/FlowX</PackageProjectUrl>
    <RepositoryUrl>https://github.com/votrongdao/FlowX</RepositoryUrl>
    <RepositoryType>git</RepositoryType>
  </PropertyGroup>

  <PropertyGroup Condition="$(MSBuildProjectName.EndsWith('.Tests'))">
    <IsPackable>false</IsPackable>
    <!--
      Test projects legitimately reflect — the fitness functions read the contract
      surface with reflection by design. The AOT/trim rule is about what ships,
      i.e. everything under src/, and EveryShippedProjectIsAotAnalyzed guards it.
    -->
    <IsAotCompatible>false</IsAotCompatible>
    <IsTrimmable>false</IsTrimmable>
    <EnableTrimAnalyzer>false</EnableTrimAnalyzer>
    <EnableAotAnalyzer>false</EnableAotAnalyzer>
  </PropertyGroup>

  <!--
    Analyzers behind the build gates in docs/21-Quality-Gates.md §2.1 and §2.2.
    Both are development dependencies: PrivateAssets="all" keeps them out of the
    generated nuspec, so nothing a consumer restores changes. They contribute no
    runtime assembly and are invisible to the trim and AOT analyzers (constraint
    C2) for the same reason — an analyzer runs in the compiler, not in the app.

    They are declared here rather than per project on purpose. A gate that only
    some projects opt into is a gate with holes in it, and adding a project would
    silently create one. FlowX.Abstractions is included and stays compliant with
    AbstractionsHasNoDependencies: that rule reads PackageReference items out of
    the .csproj, and its intent — "a dependency here is inherited by everyone" —
    is untouched, because PrivateAssets="all" means nobody inherits this.

    Pinned exactly. An analyzer that floats can change what compiles between two
    checkouts of the same commit, which is the one thing Deterministic=true above
    exists to prevent.
  -->
  <ItemGroup>
    <PackageReference Include="SonarAnalyzer.CSharp" Version="10.31.0.145097" PrivateAssets="all" />
    <PackageReference Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.14.15" PrivateAssets="all" />

    <!--
      Sonar reads rule thresholds only from an AdditionalFile named exactly
      SonarLint.xml; .editorconfig carries severities and silently ignores
      thresholds. One file at the root, linked into every project, so the
      numbers §2.1 commits to are stated once.
    -->
    <AdditionalFiles Include="$(MSBuildThisFileDirectory)SonarLint.xml" Link="SonarLint.xml" Visible="false" />
  </ItemGroup>

  <!--
    Package consumers get this by importing the analyzer package's props. Repository
    projects reference FlowX.Compiler as a ProjectReference, which does not import it,
    so the same file is imported here — one definition, not a copy that can drift.
  -->
  <Import Project="$(MSBuildThisFileDirectory)src/FlowX.Compiler/build/FlowX.Compiler.props" />

</Project>