Apply open dependency bumps and rename publish workflows after their destination - #54
Merged
Conversation
…bgv 3.10.91) Consolidates the four open Dependabot PRs (#43, #47, #48, #51). Two of them could not be merged as proposed without leaving the tree in a state the existing version-policy comment explicitly forbids, so they are applied together with the rest of their package set. OpenTelemetry -> 1.17.0 (supersedes #47 and #48). #47 bumped only Exporter.OpenTelemetryProtocol and #48 only Instrumentation.Runtime. Taking either alone would split the set: the comment in Directory.Packages.props records that core (Exporter + Extensions.Hosting) tracks a single line, so moving Exporter to 1.17.0 while Extensions.Hosting stayed at 1.16.0 would violate it. A matching 1.17.0 now exists for ALL five packages (verified against nuget.org), so the whole set is unified. This also clears pre-existing drift: Instrumentation.Runtime was still on 1.15.1 while Instrumentation.AspNetCore and .Http had already moved to 1.16.0 -- which the comment claimed was not the case. The comment is rewritten to describe the actual policy: unify when a matching release exists across the set, and let contrib packages sit on their own latest when they lag, rather than forcing a lockstep version that has no matching release. Nerdbank.GitVersioning 3.10.85 -> 3.10.91 (#43). Verified the version scheme is unaffected: packing still yields 0.1.0-alpha.70.g7f3861c59d computed from the head commit. actions/setup-dotnet v5 -> v6 (#51). All four workflows use the global-json-file input, which is unchanged across the major, so the bump is uniform. Build clean, 352 tests passing.
There was a problem hiding this comment.
Pull request overview
Consolidates several Dependabot updates into a single, consistent dependency bump set for this repo, covering NuGet central package versions and GitHub Actions workflows.
Changes:
- Bumped
Nerdbank.GitVersioningfrom3.10.85to3.10.91. - Unified the sample’s OpenTelemetry package set to
1.17.0and updated the accompanying version-policy comment. - Upgraded all workflows from
actions/setup-dotnet@v5to@v6.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| Directory.Packages.props | Updates central NuGet versions (nbgv + OpenTelemetry set) and refreshes the versioning policy comment. |
| .github/workflows/build.yml | Uses actions/setup-dotnet@v6 for CI build. |
| .github/workflows/codeql.yml | Uses actions/setup-dotnet@v6 for CodeQL workflow. |
| .github/workflows/publish.yml | Uses actions/setup-dotnet@v6 for package publishing workflow. |
| .github/workflows/publish-alpha.yml | Uses actions/setup-dotnet@v6 for alpha publishing workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@v6 |
| @@ -20,7 +20,7 @@ jobs: | |||
| fetch-depth: 0 # needed for nbgv | |||
|
|
|||
| - name: Setup .NET | |||
| uses: actions/setup-dotnet@v5 | |||
| uses: actions/setup-dotnet@v6 | |||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v5 | ||
| uses: actions/setup-dotnet@v6 |
| @@ -27,7 +27,7 @@ jobs: | |||
| fetch-depth: 0 # needed for nbgv | |||
|
|
|||
| - name: Setup .NET | |||
| uses: actions/setup-dotnet@v5 | |||
| uses: actions/setup-dotnet@v6 | |||
Mirrors the same change made in the framework repo (xavierjohn/Trellis#700). publish.yml -> publish-nuget-org.yml "Publish to NuGet.org" publish-alpha.yml -> publish-github-packages.yml "Publish to GitHub Packages" Both workflows publish the same version; the only real difference is the feed they push to. The old names implied the distinction was stable vs alpha, so picking the right one from the Actions list meant opening the file to check which feed it targeted. Naming them after the destination removes that step. Cross-references in the header comments were updated to match. Also drops an inert flag from the GitHub Packages workflow: --version-suffix "alpha.${{ github.run_number }}" is silently ignored, because nbgv sets PackageVersion explicitly. Verified by packing with --version-suffix "alpha.999" and still getting 0.1.0-alpha.71.gb09de4b2d0. Since it never had any effect, the step is just "Pack" now. Renaming a workflow file detaches its run history under the old name in the Actions UI. That is expected and cosmetic. Stacked on chore/dependency-bumps (#54) because that PR also edits both of these files; merge #54 first to avoid a rename/modify conflict.
xavierjohn
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates the four open Dependabot version-bump PRs (#43, #47, #48, #51) and renames the publish workflows after their destination.
Dependency bumps
actions/setup-dotnetOpenTelemetry.Exporter.OpenTelemetryProtocolOpenTelemetry.Extensions.HostingOpenTelemetry.Instrumentation.AspNetCoreOpenTelemetry.Instrumentation.HttpOpenTelemetry.Instrumentation.RuntimeNerdbank.GitVersioningWhy consolidate instead of merging the four PRs
#47 and #48 each bumped a single OpenTelemetry package. The repo's documented policy is that the OTel packages move as a set, so merging either one as proposed would have left the set split across versions — the exact state the policy exists to prevent. Bumping all five together is the only way to honour it.
While doing that, the policy comment in
Directory.Packages.propsturned out to be already stale: it claimed the contribInstrumentation.*packages stay on 1.15.x, but.AspNetCoreand.Httpwere both already on 1.16.0 — only.Runtimestill lagged. The comment has been rewritten to describe what the repo actually does.Verification
nbgv3.10.91 leaves the version scheme intact by packing: still0.1.0-alpha.<height>.g<sha>.setup-dotnet@v6is exercised by this PR's own CI run, which is the real proof for that one.Publish workflow rename
publish.ymlpublish-nuget-org.ymlpublish-alpha.ymlpublish-github-packages.ymlMirrors the rename made in the framework repo (xavierjohn/Trellis#700), so both repositories name these workflows the same way.
Both workflows publish the same version — the only real difference is the feed they push to (
api.nuget.orgwithNUGET_API_KEY, vsnuget.pkg.github.comwithGITHUB_TOKEN). The old names implied the distinction was stable-vs-alpha, so choosing the right one from the Actions list meant opening the file to check which feed it actually targeted. Naming them after the destination removes that step. Cross-references in each file's header comment were updated to match.This is folded into this PR rather than stacked on top of it, because both changes touch the same two workflow files and keeping them apart only created a merge-order requirement.
Also: drops an inert flag
The GitHub Packages workflow passed
--version-suffix "alpha.${{ github.run_number }}"todotnet pack. That flag is silently ignored, because nbgv setsPackageVersionexplicitly — a suffix only applies when the version is left open-ended.Verified rather than assumed: packing with
--version-suffix "alpha.999"still producedTrellis.Yarp.0.1.0-alpha.71.gb09de4b2d0.nupkg. Since it never had any effect, the step is now justPack. (Same latent bug the framework repo had.)Notes