Restructure project layout to more modern form

.config/dotnet-tools.json

@@ -3,21 +3,21 @@
   "isRoot": true,
   "tools": {
     "csharpier": {
-      "version": "1.1.2",
+      "version": "1.2.6",
       "commands": [
         "csharpier"
       ],
       "rollForward": false
     },
     "dotnet-outdated-tool": {
-      "version": "4.6.8",
+      "version": "4.7.1",
       "commands": [
         "dotnet-outdated"
       ],
       "rollForward": false
     },
     "husky": {
-      "version": "0.7.2",
+      "version": "0.9.1",
       "commands": [
         "husky"
       ],

.gitattributes

@@ -1,26 +1,57 @@
+###############################################################################
+# Git Attributes
+#
+# Normalize text files to LF in the repository. Git will handle conversion
+# during checkout as needed, while .editorconfig controls the editor behavior.
 ###############################################################################
-# Set default behavior to automatically normalize line endings.
+
+* text=auto eol=lf
+
 ###############################################################################
-* text=auto
+# Language-specific diff drivers
+###############################################################################
+
+*.cs diff=csharp
 
 ###############################################################################
-# Set default behavior for command prompt diff.
+# Merge behavior
 #
-# This is need for earlier builds of msysgit that does not have it on by
-# default for csharp files.
-# Note: This is only used by command line
+# Prevent Git from inserting conflict markers into Visual Studio solution and
+# project files. These files require manual conflict resolution.
+###############################################################################
+
+*.sln     merge=binary
+*.csproj  merge=binary
+
+###############################################################################
+# Linux / Cross-platform files
 ###############################################################################
-*.cs     diff=csharp
+
+*.bash          text eol=lf
+*.editorconfig  text eol=lf
+*.sh            text eol=lf
+
+*.json          text eol=lf
+*.jsonc         text eol=lf
+*.md            text eol=lf
+*.xml           text eol=lf
+*.yaml          text eol=lf
+*.yml           text eol=lf
+
+Dockerfile      text eol=lf
 
 ###############################################################################
-# Set the merge driver for project and solution files
+# Windows-native files
+###############################################################################
+
+*.bat           text eol=crlf
+*.cmd           text eol=crlf
+
+###############################################################################
+# PowerShell
 #
-# Merging from the command prompt will add diff markers to the files if there
-# are conflicts (Merging from VS is not affected by the settings below, in VS
-# the diff markers are never inserted). Diff markers may cause the following 
-# file extensions to fail to load in VS. An alternative would be to treat
-# these files as binary and thus will always conflict and require user
-# intervention with every merge. To do so, just uncomment the entries below
-###############################################################################
-*.sln       merge=binary
-*.csproj    merge=binary
+# PowerShell fully supports LF, making it the preferred choice for
+# cross-platform repositories and devcontainers.
+###############################################################################
+
+*.ps1           text eol=lf

.github/codeql/codeql-config.yml

@@ -0,0 +1,12 @@
+name: "NetDuid CodeQL Configuration"
+
+query-filters:
+  - exclude:
+      problem.severity:
+        - warning
+        - recommendation
+        - note
+
+paths-ignore:
+  - src/NetDuid.Tests
+  - src/NetDuid.Benchmarks

.github/dependabot.yml

@@ -9,10 +9,6 @@ updates:
       day: "sunday"
     allow:
       - dependency-type: direct
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-patch"
     commit-message:
       prefix: "Dependabot package update"
     open-pull-requests-limit: 5

.github/workflows/build.yml

@@ -13,11 +13,19 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
     env:
-      HUSKY: 0 # don't run husky.net hooks
+      HUSKY: 0  # don't run husky.net hooks
 
     steps:
       - name: Checkout code
@@ -26,22 +34,87 @@ jobs:
       - name: Setup .NET SDKs
         uses: actions/setup-dotnet@v5
         with:
-          # .net 4.8.x is included by default in windows-latest
           dotnet-version: |
             8.0.x
             9.0.x
             10.0.x
 
+      - name: NuGet cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
       - name: Restore .NET tools
         run: dotnet tool restore
-        working-directory: .
 
       - name: Restore dependencies
         run: dotnet restore
-        working-directory: ./src
 
       - name: Build
-        run: dotnet build ./src --no-restore -p:VersionFromCI="0.0.0-cibuild"
+        run: dotnet build --no-restore --configuration Release -p:VersionFromCI="0.0.0-cibuild"
+
+      - name: Test with coverage (Ubuntu — net8.0)
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          dotnet tool install --global dotnet-coverage 2>/dev/null || dotnet tool update --global dotnet-coverage
+          dotnet-coverage collect "dotnet test --no-build --verbosity normal --logger trx --framework net8.0" -f cobertura -o coverage/cobertura-net8.xml
 
-      - name: Test
-        run: dotnet test ./src --no-build --verbosity normal
+      - name: Test with coverage (Ubuntu — net9.0)
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          dotnet tool install --global dotnet-coverage 2>/dev/null || dotnet tool update --global dotnet-coverage
+          dotnet-coverage collect "dotnet test --no-build --verbosity normal --logger trx --framework net9.0" -f cobertura -o coverage/cobertura-net9.xml
+
+      - name: Test with coverage (Ubuntu — net10.0)
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          dotnet tool install --global dotnet-coverage 2>/dev/null || dotnet tool update --global dotnet-coverage
+          dotnet-coverage collect "dotnet test --no-build --verbosity normal --logger trx --framework net10.0" -f cobertura -o coverage/cobertura.xml
+
+      - name: Test (Windows — all TFMs including net48)
+        if: matrix.os == 'windows-latest'
+        run: dotnet test --no-build --verbosity normal --logger trx
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-${{ runner.os }}
+          path: '**/TestResults/*.trx'
+          retention-days: 30
+
+      - name: Upload coverage results
+        if: matrix.os == 'ubuntu-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-${{ github.sha }}
+          path: coverage/
+          retention-days: 30
+
+  coverage-report:
+    needs: build
+    if: github.event_name == 'pull_request' && needs.build.result == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: coverage-${{ github.sha }}
+          path: coverage/
+          merge-multiple: true
+      - name: Generate coverage badge
+        uses: danielpalme/ReportGenerator-GitHub-Action@v5
+        with:
+          reports: coverage/*.xml
+          targetdir: coveragereport
+          reporttypes: MarkdownSummary
+      - name: Post coverage summary
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          header: Code Coverage
+          path: coveragereport/Summary.md

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: '31 15 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: csharp
+          build-mode: autobuild
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+
+    - name: Setup .NET SDK
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: 10.0.x
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        queries: security-extended,security-and-quality
+        config-file: ./.github/codeql/codeql-config.yml
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -0,0 +1,28 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Review dependencies
+        uses: actions/dependency-review-action@v4
+        continue-on-error: true
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: true
+          # Suppress "unknown license" warnings — they are false positives:
+          #   1) GitHub Actions don't carry SPDX metadata the tool can read
+          #   2) Some preview NuGet packages lack modern <license> in nuspec
+          #   3) The NetDuid smoke test references a placeholder version not on NuGet.org
+          allow-unknown-licenses: true