Remediate the 2026-09-22 audit and overhaul CI/CD

.coderabbit.yaml

@@ -5,7 +5,7 @@ early_access: false
 
 reviews:
   # Assertive and advisory: CodeRabbit reviews thoroughly but never approves, requests changes or sets a required
-  # status. The only merge requirement is the CI / Gate check.
+  # status. The merge requirement is the CI / Gate check; there is no merge queue.
   profile: assertive
   request_changes_workflow: false
   review_details: false
@@ -39,11 +39,12 @@ reviews:
       mode: warning
       requirements: >-
         Pull requests are squash-merged and the title becomes the commit subject: a short imperative sentence such as
-        "Fix CI validation findings", at most 72 characters, no trailing period.
+        "Fix CI validation findings", at most 72 characters, no trailing period, no Conventional Commit or area prefix,
+        starting with an uppercase letter.
     description:
       mode: warning
     issue_assessment:
-      mode: 'off' # issues are disabled on this repository
+      mode: 'off' # pull requests are not required to link an issue
     docstrings:
       mode: 'off' # CS1591 already fails the build for undocumented public APIs
     custom_checks:
@@ -68,6 +69,23 @@ reviews:
           path (conversion failure, callback exception, protected-call error) and that registry references and
           callbacks are released. Fail when such code changes without those assertions, or when a raw Lua call that
           can raise is added outside a protected boundary.
+      - name: Lua concurrency contract
+        mode: warning
+        instructions: >-
+          Applies only when the pull request changes libs/CheatEngine.SDK.Lua/Runtime/**; otherwise pass. Fail when
+          worker-thread Lua admission is widened, exposed or defaulted to on without staying behind
+          `[Experimental("CESDK5001")]`, when a comment or doc claims worker-thread admission is qualified before the
+          Q19 C3 and C4 receipts both pass, or when new code assumes the SDK serializes two plugins or two SDK copies
+          against each other (ADR-07: admission protects only this copy's attach/reset/detach transitions, never the
+          shared Lua heap). Otherwise pass.
+      - name: Native host emulator evidence
+        mode: warning
+        instructions: >-
+          Applies only when the pull request changes tests/native-host-emulator/** or
+          tests/CheatEngine.SDK.Hosting.Tests/Coexistence/**; otherwise pass. Fail when a description, comment or test
+          name presents the emulator's facts as live Cheat Engine host behavior or as a C4 (two-copy) qualification
+          receipt, rather than C2 hostfxr component-route evidence; or when an absolute path can reach the emitted
+          `--facts` output. Otherwise pass.
       - name: Public API documentation and changelog
         mode: warning
         instructions: >-
@@ -88,12 +106,28 @@ reviews:
         mode: warning
         instructions: >-
           Applies only to changes under .github/; otherwise pass. Fail when an action is referenced by tag or branch
-          instead of a full 40-character commit SHA with a version comment; pull_request_target is used;
-          actions/checkout omits persist-credentials: false; a permission is widened without a comment giving the
-          reason; a PowerShell step runs a native command (dotnet, xmake, git, gh, tar, actionlint) without checking
-          $LASTEXITCODE; SONAR_TOKEN or NUGET_USER can reach fork or Dependabot runs; a job added to ci.yml is missing
-          from the Gate's needs; or NuGet/login moves out of the release.yml publish job that uses environment nuget.
-          Otherwise pass.
+          instead of a full 40-character commit SHA with a version comment; pull_request_target or a merge_group
+          trigger is used; a job runs on a -latest label or on any label other than windows-2025 or ubuntu-24.04, or
+          has no timeout-minutes; actions/checkout omits persist-credentials: false; a permission is widened without a
+          comment giving the reason; a PowerShell step runs a native command (dotnet, xmake, git, gh, tar, actionlint)
+          without checking $LASTEXITCODE; a restore is not locked, or a job of ci.yml, sonar.yml, codeql.yml or
+          release.yml enables a package cache; SONAR_TOKEN or NUGET_USER can reach fork or Dependabot runs; a job added
+          to ci.yml is missing from the Gate's needs (WorkflowContractTests also fails; only the advisory client-canary
+          job may stay out); a zizmor finding is ignored in .github/zizmor.yml without a reason; or NuGet/login moves
+          out of the release.yml publish job that uses environment nuget. scorecard.yml is exempt from the pwsh
+          defaults and run-step rules, because Scorecard's publication verifier rejects them. The advisory workflows
+          (codeql, scorecard, zizmor-online, dependency-submission) stay outside the Gate. Otherwise pass.
+      - name: Public API and compatibility
+        mode: warning
+        instructions: >-
+          Applies when the pull request changes public or protected API under libs/ or src/, a PublicAPI.Shipped.txt
+          or PublicAPI.Unshipped.txt file, src/CheatEngine.SDK/CompatibilitySuppressions.xml, or a packages.lock.json
+          file; otherwise pass. Pass when every public API change is recorded in the owning library's
+          PublicAPI.Unshipped.txt (a changed or removed shipped declaration also gets a *REMOVED* line);
+          PublicAPI.Shipped.txt changes only in a release pull request that moves Unshipped into it;
+          CompatibilitySuppressions.xml changes only together with an intentional break that the description and the
+          CHANGELOG declare; and every packages.lock.json change comes from a CLI restore (never a hand edit)
+          together with the package, project or global.json change that caused it. Fail otherwise.
   finishing_touches:
     docstrings:
       enabled: false
@@ -157,29 +191,51 @@ reviews:
     - path: 'tests/**'
       instructions: >-
         Tests use xUnit v3 with Microsoft.Testing.Platform. CI runs the whole solution once in Debug and once in
-        Release with --fail-skips on, so a skipped test fails both. Distinguish fixture, package and NativeAOT probes
-        from actual live Cheat Engine host qualification.
+        Release with --fail-skips on, so a skipped test fails both. Debug excludes the packaging tests by the trait
+        Category=Packaging (never by Skip); Release runs them against the exact nupkg it packed
+        (CESDK_PACKAGED_UMBRELLA_NUPKG). A test that evidences a qualification scenario carries
+        [Trait("Qualification", "Qxx")] naming the C0-C4 level it reaches; a C1/C2 success is never presented as
+        host-qualified. Distinguish fixture, package and NativeAOT probes from actual live Cheat Engine host
+        qualification.
     - path: 'CHANGELOG.md'
       instructions: >-
         Keep a Changelog 1.1.0. The release workflow publishes the body of the "## [X.Y.Z]" section (or [Unreleased]
         for a prerelease) as the GitHub release notes, so keep version headings exact and link references at the end.
     - path: '.github/**'
       instructions: >-
-        pull-request-ci.yml, main-ci.yml and release.yml are thin callers of the reusable ci.yml (native, build-test
-        matrix Debug/Release, aot, sonar through sonar.yml, lint, gate) and must stay thin. Jobs exchange artifacts
-        instead of redoing work: lua-protection-bridge and classic-abi-fixture-facts from native; nuget-package,
-        coverage and test-results-<configuration> from build-test; release-notes from the release verify job. Do not
-        reintroduce per-project test matrices, a second test run of the same configuration, or rebuilds of what an
-        upstream job produced. NativeBridgePeAuditTests asserts the native job text. The Gate evaluates toJSON(needs)
-        and only sonar may be skipped. NuGet/login stays in release.yml with environment nuget (trusted publishing
-        binding). Require SHA-pinned actions, least privilege, persist-credentials: false and $LASTEXITCODE checks.
-        actionlint already runs in CI; do not ask for a duplicate CodeRabbit actionlint run. Never use
-        pull_request_target. Sonar secrets must stay unavailable to forks and Dependabot.
+        pull-request-ci.yml and main-ci.yml are thin callers of the reusable ci.yml (native, build-test matrix
+        Debug/Release, aot, sonar through sonar.yml, lint, format, dependency-review, lock-files, gate) and must stay
+        thin. Jobs exchange artifacts instead of redoing work: lua-protection-bridge and classic-abi-fixture-facts from
+        native; nuget-package, coverage and test-results-<configuration> from build-test.
+        The Release leg packs before it tests, and the packaging tests consume that exact nupkg. Do not reintroduce
+        per-project test matrices, a second test run of the same configuration, or rebuilds of what an upstream job
+        produced. NativeBridgePeAuditTests asserts the native job text, and WorkflowContractTests freezes job ids and
+        names, gate.needs, runners, pins, locked restores and the reserved artifact names. Every job runs on
+        windows-2025 or ubuntu-24.04 (never -latest) with a timeout, restores with --locked-mode, and no job of ci.yml,
+        sonar.yml, codeql.yml or release.yml uses a package cache. The Gate evaluates toJSON(needs): every job must
+        succeed, and sonar must match SONAR_EXPECTED (it runs exactly when expected and is skipped only for forks,
+        Dependabot, the dormant merge_group clause and release runs); no other job may be skipped. The required check
+        is CI / Gate. CodeQL, Scorecard, zizmor-online and dependency-submission are advisory and stay out of the
+        Gate; scorecard.yml keeps no defaults, env or run steps. release.yml is draft-first (verify, ci, attest,
+        draft-release, publish, verify-publication, finalize-release); publication jobs run only for v* tags of this
+        repository, never upload to a published release, and keep NuGet/login in the publish job with environment
+        nuget (trusted publishing binding). Require SHA-pinned actions, least privilege, persist-credentials: false,
+        user-controlled values only through env, and $LASTEXITCODE checks. actionlint and zizmor already run in the
+        lint job; do not ask for a duplicate CodeRabbit run. Never use pull_request_target. Sonar secrets must stay
+        unavailable to forks and Dependabot. No custom PowerShell/Python/JSON governance or evidence tooling under
+        eng/: a genuine build necessity currently wrapped in a bespoke script gets inlined as direct run: lines using
+        standard actions and CLI calls instead.
+    - path: '**/*.md'
+      instructions: >-
+        Never restore or link the retired documentations/ tree. Narrative documentation (qualification protocol,
+        catalogues, migration guides) lives outside both repositories, under the maintainer's local docs/ tree, not
+        in a repository docs/ folder: flag a pull request that recreates one. Relative links keep the exact case of
+        the target; READMEs packed into the NuGet package use absolute links only.
   tools:
     # CodeRabbit is used as the GitHub App; pipeline failures are surfaced through its GitHub Checks integration.
     github-checks:
       enabled: true
-    # The ci.yml lint job is the deterministic actionlint owner.
+    # actionlint and zizmor run in the lint job of ci.yml, the deterministic owner of both.
     actionlint:
       enabled: false
 

.config/dotnet-tools.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-coverage": {
+      "version": "18.11.2",
+      "commands": [
+        "dotnet-coverage"
+      ],
+      "rollForward": true
+    }
+  }
+}

.editorconfig

@@ -10,6 +10,8 @@ indent_size = 4
 tab_width = 4
 max_line_length = 120
 trim_trailing_whitespace = true
+# Matches .gitattributes (eol=crlf): dotnet format and the IDE0055 build check agree on CRLF.
+end_of_line = crlf
 
 [*.{csproj,props,targets,slnx,config,json,yml,yaml}]
 # YAML cannot use tabs for indentation. Keep project and configuration files
@@ -75,24 +77,22 @@ csharp_style_prefer_top_level_statements = false
 # blockers because Directory.Build.props treats warnings as errors.
 dotnet_diagnostic.IDE0079.severity = error
 
-# Migration rules: surface the historical backlog in every Roslyn-aware editor
-# and participate in code cleanup without breaking the currently dirty tree.
-# Promote these to warning/error in a dedicated cleanup change once the existing
-# source has been reformatted and explicit types have been introduced.
+# Style rules enforced since the repository-wide reformat of the audit remediation branch
+# (see .git-blame-ignore-revs). EnforceCodeStyleInBuild plus TreatWarningsAsErrors turns them into build errors,
+# and CI also runs `dotnet format --verify-no-changes`.
 dotnet_diagnostic.IDE0007.severity = none
-dotnet_diagnostic.IDE0008.severity = suggestion
-dotnet_diagnostic.IDE0011.severity = suggestion
+dotnet_diagnostic.IDE0008.severity = warning
+dotnet_diagnostic.IDE0011.severity = warning
 dotnet_diagnostic.IDE0033.severity = suggestion
-dotnet_diagnostic.IDE0040.severity = suggestion
-dotnet_diagnostic.IDE0044.severity = suggestion
-# The formatter still follows the tab contract above. Do not flood every open
-# legacy file with a formatting diagnostic before the dedicated reformat pass.
-dotnet_diagnostic.IDE0055.severity = none
+dotnet_diagnostic.IDE0040.severity = warning
+dotnet_diagnostic.IDE0044.severity = warning
+dotnet_diagnostic.IDE0055.severity = warning
 dotnet_diagnostic.IDE0005.severity = suggestion
-dotnet_diagnostic.IDE0065.severity = suggestion
-dotnet_diagnostic.IDE0090.severity = suggestion
+dotnet_diagnostic.IDE0065.severity = warning
+dotnet_diagnostic.IDE0090.severity = warning
 dotnet_diagnostic.IDE0160.severity = none
-dotnet_diagnostic.IDE0161.severity = suggestion
+dotnet_diagnostic.IDE0161.severity = warning
+# Naming fixes rename symbols, which dotnet format cannot apply safely; keep them as editor guidance.
 dotnet_diagnostic.IDE1006.severity = suggestion
 
 # Rider derives its own "var or explicit type" inspections from the shared
@@ -148,3 +148,7 @@ dotnet_diagnostic.IDE0005.severity = error
 
 [src/**.cs]
 dotnet_diagnostic.IDE0005.severity = error
+
+# The native bridge embeds the SHA-256 of these two files; .gitattributes pins them to LF.
+[native/cheatengine-sdk-lua-bridge/{cheatengine_sdk_lua_bridge.c,xmake.lua}]
+end_of_line = lf

.git-blame-ignore-revs

@@ -0,0 +1,5 @@
+# Commits that only reformat code. Enable locally with: git config blame.ignoreRevsFile .git-blame-ignore-revs
+# Apply repository formatting
+0a03dac0cae53d399e89dfb1494ac80843a3ab9a
+# Format the projects that live outside the solution (AotProbe, LiveProbe)
+fc6016532f5f1d963d1cf267a1750bbbfa64cc49

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Informational only: the "Protect main" ruleset does not require a code-owner review (single active maintainer; a
+# required review would block every maintainer and Dependabot pull request). GitHub still requests a review from the
+# owners below. Owners must have write access; confirm co-owners with the maintainer before adding them.
+# Syntax: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# The last matching pattern wins, so the catch-all comes first.
+*                             @AriusII
+
+# Native authority: the protection bridge, the ABI layouts and the build assets consumers import.
+/native/                      @AriusII
+/libs/CheatEngine.SDK.Abi/    @AriusII
+/src/CheatEngine.SDK/build/   @AriusII
+
+# Build, release and governance: workflows, the PR policy code and repository settings.
+/.github/                     @AriusII
+/eng/                         @AriusII
+/SECURITY.md                  @AriusII

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,62 @@
+# Schema: https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-githubs-form-schema
+name: Bug report
+description: An SDK API, analyzer, generator or build asset behaves differently from its documentation.
+title: "[Bug] "
+labels: [ bug ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for a defect in the SDK itself. When a plugin does not load, or works with one Cheat Engine,
+        runtime or package combination and not another, use the **Compatibility report** form instead: it records the
+        exact tuple the problem depends on. Security problems go to private reporting (see SECURITY.md).
+
+  - type: input
+    id: sdk-version
+    attributes:
+      label: CheatEngine.SDK version
+      description: The `resolved` version of `CheatEngine.SDK` in the plugin's `packages.lock.json`, or the commit when you build from source.
+      placeholder: "1.0.0"
+    validations:
+      required: true
+
+  - type: input
+    id: ce-version
+    attributes:
+      label: Cheat Engine build
+      description: The exact file version, or `not involved` for an analyzer, generator or build problem.
+      placeholder: "7.7.0.10621"
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: A minimal plugin or code snippet and the actions that trigger the problem.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected result
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Observed result
+      description: What happened instead, with the exact error text or diagnostic id.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs (optional)
+      description: Relevant, redacted build output or log lines. Remove user names and private paths first.
+      render: text
+    validations:
+      required: false