From d058b75b1eab26d8dd7adb9fda0dfdbd66ae96b8 Mon Sep 17 00:00:00 2001 From: John Smith Date: Thu, 8 Oct 2026 22:20:19 +0100 Subject: [PATCH 1/5] ci: pin actions to SHAs, add Dependabot and CodeQL Tag-pinned actions can be moved under us; Dependabot keeps the SHAs and version comments current. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb --- .github/dependabot.yml | 18 ++++++++++++++++++ .github/workflows/codeql.yml | 34 ++++++++++++++++++++++++++++++++++ .github/workflows/publish.yml | 10 +++++----- 3 files changed, 57 insertions(+), 5 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5772e33 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: + # Actions are pinned to commit SHAs; Dependabot keeps the SHA and the version comment in step. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: ["*"] + + - package-ecosystem: nuget + directory: / + schedule: + interval: weekly + groups: + test-dependencies: + patterns: ["Microsoft.NET.Test.Sdk", "xunit*"] diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..8809ec7 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,34 @@ +name: CodeQL + +on: + pull_request: + branches: [master] + paths: + - 'src/**' + - '.github/workflows/codeql.yml' + schedule: + - cron: '17 6 * * 1' + workflow_dispatch: + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + + # build-mode none analyzes C# from source, so no SDK setup or build is needed. + - name: Initialize CodeQL + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + with: + languages: csharp + build-mode: none + + - name: Analyze + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 838ea7a..671d1e0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -44,10 +44,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: | 8.0.x @@ -76,12 +76,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: fetch-depth: 0 - name: Setup .NET - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: | 8.0.x @@ -183,7 +183,7 @@ jobs: - name: Log in to NuGet id: nuget - uses: NuGet/login@v1 + uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0 with: user: solrevdev From 242664d0e0f6cc560495f70f2319745c57f9407f Mon Sep 17 00:00:00 2001 From: John Smith Date: Thu, 8 Oct 2026 22:20:19 +0100 Subject: [PATCH 2/5] test: run tests on .NET 8, 9 and 10 The tool ships for all three, but tests only ran on net8.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb --- README.md | 5 ++++- tests/Ytx.Tests/Ytx.Tests.csproj | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f92d407..b39c4d5 100644 --- a/README.md +++ b/README.md @@ -105,7 +105,7 @@ dotnet restore src/Ytx # Build dotnet build src/Ytx -c Release -# Run the unit tests +# Run the unit tests (on .NET 8, 9 and 10; add -f net8.0 to use one runtime) dotnet test tests/Ytx.Tests -c Release # Test locally (choose an installed target framework) @@ -124,6 +124,9 @@ dotnet tool install -g solrevdev.ytx --add-source ./nupkg ├── src/Ytx/Ytx.csproj # Package and target-framework metadata ├── tests/Ytx.Tests/ # CLI parsing and formatting unit tests ├── .github/workflows/publish.yml # Validation and release automation +├── .github/workflows/codeql.yml # CodeQL analysis +├── assets/icon.svg # Package icon source (icon.png is rendered from it) +├── CHANGELOG.md # Release history ├── docs/ # Additional project documentation └── README.md # User and maintainer documentation ``` diff --git a/tests/Ytx.Tests/Ytx.Tests.csproj b/tests/Ytx.Tests/Ytx.Tests.csproj index 927eecd..d6ffa8f 100644 --- a/tests/Ytx.Tests/Ytx.Tests.csproj +++ b/tests/Ytx.Tests/Ytx.Tests.csproj @@ -1,6 +1,6 @@ - net8.0 + net8.0;net9.0;net10.0 enable enable false From 2f97b22968d16ccd7d666f7abbdb549592f39e6c Mon Sep 17 00:00:00 2001 From: John Smith Date: Thu, 8 Oct 2026 22:20:19 +0100 Subject: [PATCH 3/5] build(pack): add package icon, symbols and SourceLink metadata Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb --- assets/icon.png | 3 +++ assets/icon.svg | 8 ++++++++ src/Ytx/Ytx.csproj | 8 ++++++++ 3 files changed, 19 insertions(+) create mode 100644 assets/icon.png create mode 100644 assets/icon.svg diff --git a/assets/icon.png b/assets/icon.png new file mode 100644 index 0000000..ec222af --- /dev/null +++ b/assets/icon.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:9237b1c72d7bba1e342896310fd2b8003061c04a3bc221a0a47146c5925cded5 +size 2589 diff --git a/assets/icon.svg b/assets/icon.svg new file mode 100644 index 0000000..e4edf59 --- /dev/null +++ b/assets/icon.svg @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/src/Ytx/Ytx.csproj b/src/Ytx/Ytx.csproj index 1cf65d4..b5c9277 100644 --- a/src/Ytx/Ytx.csproj +++ b/src/Ytx/Ytx.csproj @@ -23,6 +23,13 @@ https://github.com/solrevdev/solrevdev.ytx MIT README.md + icon.png + + + true + true + snupkg + true ../../nupkg @@ -34,6 +41,7 @@ + From 762ad1a2ce39a6ffb89f7c80e0697407f55153a2 Mon Sep 17 00:00:00 2001 From: John Smith Date: Thu, 8 Oct 2026 22:20:19 +0100 Subject: [PATCH 4/5] docs: add CHANGELOG Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb --- CHANGELOG.md | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..0e03ee0 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,74 @@ +# Changelog + +All notable changes to ytx are listed here. The format follows +[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow +[Semantic Versioning](https://semver.org/). GitHub Releases carry the full commit notes. + +## [Unreleased] + +### Added + +- NuGet package icon, symbols package (`.snupkg`) and SourceLink metadata. +- Dependabot for GitHub Actions and NuGet, and a CodeQL workflow. + +### Changed + +- GitHub Actions are pinned to commit SHAs. +- Tests run on .NET 8, 9 and 10. + +## [1.0.8] - 2026-10-08 + +### Changed + +- JSON uses source generation and streams to stdout, which makes startup faster and allocates less. +- Transcript building no longer allocates for every caption. +- Trim and AOT analyzers run in every build. + +## [1.0.7] - 2026-08-24 + +### Changed + +- Releases use NuGet Trusted Publishing instead of a stored API key. + +## [1.0.6] - 2026-07-16 + +### Added + +- Tests for command-line parsing and formatting. + +## [1.0.5] - 2026-07-16 + +### Added + +- `--help`, `--version`, `--url`, `--language`, `--metadata-only` and `--compact`. + +## [1.0.4] - 2026-07-16 + +### Changed + +- Modernized the NuGet publishing workflow. + +## [1.0.3] - 2025-11-17 + +### Added + +- .NET 10 target. + +### Changed + +- YoutubeExplode 6.5.6. + +## [1.0.1] - 2025-08-30 + +### Added + +- First release: title, description, raw transcript and Markdown transcript as JSON. + +[Unreleased]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.8...HEAD +[1.0.8]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.7...v1.0.8 +[1.0.7]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.6...v1.0.7 +[1.0.6]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.5...v1.0.6 +[1.0.5]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.4...v1.0.5 +[1.0.4]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.3...v1.0.4 +[1.0.3]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.1...v1.0.3 +[1.0.1]: https://github.com/solrevdev/solrevdev.ytx/releases/tag/v1.0.1 From f60b3d889cafcfc882607f7bf3c83ef6a7affa5a Mon Sep 17 00:00:00 2001 From: John Smith Date: Thu, 8 Oct 2026 22:20:38 +0100 Subject: [PATCH 5/5] build(pack): keep the package icon out of Git LFS CI checkouts do not fetch LFS objects, so pack would ship the pointer file as the icon. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPou7f8nRjX78T2qR7hTjb --- .gitattributes | 3 +++ assets/icon.png | Bin 129 -> 2589 bytes 2 files changed, 3 insertions(+) diff --git a/.gitattributes b/.gitattributes index 02a2eb7..e00b2be 100644 --- a/.gitattributes +++ b/.gitattributes @@ -42,3 +42,6 @@ # Razor files *.razor linguist-language=C# + +# The NuGet icon is packed from a plain checkout, so keep it out of LFS. +assets/icon.png !filter !diff !merge binary diff --git a/assets/icon.png b/assets/icon.png index ec222afbdeccf27ad86c80b595d097be69cda90b..c366ae6023629a98496f39d7b3b8460e876a77fc 100644 GIT binary patch literal 2589 zcmV+&3gY#NP)uP zBoLC2EROG<{Sn+Hki@a?ouP#e1=WnO5&*>j zTmUiwqylhi{+ZSi1aKQb4}f+6KEjAsrf6u-mYPssAJX!}h!zVeEiFyxSMK|U0=9|( zj{!*2V!6USdKqvCpxe{wjemMPo}k(VstUmDxl6JVo$MtB_AG!IYKsw~(#^oO$#TLQ z9WC`;u`VR00A!WcrcP6WzXZry04cG4xS)yKAlN)4rEIu%_Q36EXO21mdGnThn?TtN zATQc^1^qA}0K#5uJJ^BM5sj`tk(hukwgWhvGrwlS z9rkepP*_--L@3=0pir;c1cMOflH|}o=Fa_k;&^Y58vrFa_=ecwvl3D^`uTlIW(Pz|*Dku!Xiu)k;|Wp#=$A8>Lu`CInc0iXWx$=E0EJ*B-+Bb25oKhX z6V%p9`PYWK0i<)TNibGVpgCtIExa~d4zcm=C^N6P;~~lzsp4IUzzM|?st`7hcO3#B zgs>7yMy}fzY=|%vQ;giSA=nTD$)^xIfOeKfAx{6=SsDe9z`F{8o5TsP2^8!>QoDen z0v8^ssX$_4bYCPxLqUA>@p1TD+trp}YP{DU$)8unVx4)_51vHb`gM>Tj+o{T$ujCT zY{K^Ucg0$Qsl~(ki#Y&A1uh)gvm@r>!$Pu*$Cf{ByKjPcS${F_11x>GQg!hFAUPaZ z`f#P{<(N&ptiPB8ke()v9^-|YZNdF0ASBB;aAc=$`@_KP@9#px@soI@rUKbnGbf$)%Vi5t zUiKx;YtSVC4aZO7Pk(+}k3~;t+X_E^b0`-bz2-Wx>2Ga^fBVje)4lxsk8}wD_k94Z z)XuquJZzY000O9o+!P6eQTQWy$8EMGUj1r2-ueCod~x~^ z?{eafi3_$0Kv;fe z5P$v7XV|vFk6CHMyvyOrmH`N>opTGjS9|fph1cPr_B?lB>i_^iTB3|smR`o+R-VWF z*;9JDs-@UI0AUZz8o+xi&*K-5wj(*gK0Apb0Ha8RVO3cd_C3>#Z zI*i{w9>BI0e&nR99+V@li2zK(4h<#|fC#MKU=jhCBC9r-L;#{-#RiiIKn$$ZU=jgP z!3qr~5df9U-e3{|(1=+ZOdymw{>HXX~sKu`q0Ry19k@$K zigHv}lt-Ly{m<8mv4d5N9jpbeXG0{119j`yp{T&cvkWeZ3S8VbJ`e{thl;U-`HDFJ zy?y;!)*+~%W?RG@0IkNp6=Mghqjvo{GP3gPVwth$RxfVeyoH+T#h^5{9EHaYKI%RZ z)BI)@FYAxw&#O{(hCF;26KU+*yNR)bNAO;MsskXH8~39CfiDWc+9M(elNq7_#POVc z^-%!5ysHqn>7xMby&G<01S~)SczG8h@WB}IQpQ*_??MDl2)vY0>gHXCzzHMAXnVHQ z1hFG%M?C@W7e1w^uMaWc5btUP!yN#2$`k-7$h*9&5e&vgwmAiWRC;qSfNrh@35FrS z^{kY^{lJ|7cs!mU1KY;8EWs#@kT;u}nudW<%^-z^HbI;gwu9TDkhC@Y$L9gK>^;#9 zf-QV%5{$xtKX$a#cZL5R(+&em25?6Aq6DLy zN(iO@Y`ixnyoENexGINGxB(RERh3`}KLM?3Z9aBoyf-JjCa}%t?r&1G*x%VZNpyec@*(r}R}co<-(wX03g z*(m~A>G!#PktUqdW#Mf;cSpi-MkN@zXD?ESGladBFq~dJ+1LJ<$)jC!0%X}@>JW!^5%BW@tB7t*W^)JrKP0_y~tcf6s!dB z6#&*BX@QTM01kqYce7Fk_lH}$YUuDRweLFeN-vi|A=QMi62ef-2+0FOCV*6kpNvR? z0Qy1D!x#dDuof`V%oH@V`Et$xJJml_V3hv>FnpT;``UDJ00000NkvXXu0mjfd!4&2 literal 129 zcmWN?%MrpL5CG6SRnUNeUH<6?79z~3WL(U_>h)dT)!sbjOZK%+-j%wKb$cAV{qLW$ z(R?aC8>tJ#99449==`40gaQ<>hEg&#V=*RgKpz!L)Y@ndq-{2Z5FzVq16WTkp`+TW M6Fk06qKirV0GT)@egFUf