ci: pin actions, add Dependabot, CodeQL, multi-runtime tests and package metadata

.gitattributes

@@ -42,3 +42,6 @@
 
 # Razor files
 *.razor linguist-language=C#
+
+# The NuGet icon is packed from a plain checkout, so keep it out of LFS.
+assets/icon.png !filter !diff !merge binary

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; Dependabot keeps the SHA and the version comment in step.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      test-dependencies:
+        patterns: ["Microsoft.NET.Test.Sdk", "xunit*"]

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - 'src/**'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '17 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      # build-mode none analyzes C# from source, so no SDK setup or build is needed.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: csharp
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3

.github/workflows/publish.yml

@@ -44,10 +44,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: |
             8.0.x
@@ -76,12 +76,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
         with:
           dotnet-version: |
             8.0.x
@@ -183,7 +183,7 @@ jobs:
 
       - name: Log in to NuGet
         id: nuget
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         with:
           user: solrevdev
 

CHANGELOG.md

@@ -0,0 +1,74 @@
+# Changelog
+
+All notable changes to ytx are listed here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
+[Semantic Versioning](https://semver.org/). GitHub Releases carry the full commit notes.
+
+## [Unreleased]
+
+### Added
+
+- NuGet package icon, symbols package (`.snupkg`) and SourceLink metadata.
+- Dependabot for GitHub Actions and NuGet, and a CodeQL workflow.
+
+### Changed
+
+- GitHub Actions are pinned to commit SHAs.
+- Tests run on .NET 8, 9 and 10.
+
+## [1.0.8] - 2026-10-08
+
+### Changed
+
+- JSON uses source generation and streams to stdout, which makes startup faster and allocates less.
+- Transcript building no longer allocates for every caption.
+- Trim and AOT analyzers run in every build.
+
+## [1.0.7] - 2026-08-24
+
+### Changed
+
+- Releases use NuGet Trusted Publishing instead of a stored API key.
+
+## [1.0.6] - 2026-07-16
+
+### Added
+
+- Tests for command-line parsing and formatting.
+
+## [1.0.5] - 2026-07-16
+
+### Added
+
+- `--help`, `--version`, `--url`, `--language`, `--metadata-only` and `--compact`.
+
+## [1.0.4] - 2026-07-16
+
+### Changed
+
+- Modernized the NuGet publishing workflow.
+
+## [1.0.3] - 2025-11-17
+
+### Added
+
+- .NET 10 target.
+
+### Changed
+
+- YoutubeExplode 6.5.6.
+
+## [1.0.1] - 2025-08-30
+
+### Added
+
+- First release: title, description, raw transcript and Markdown transcript as JSON.
+
+[Unreleased]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.8...HEAD
+[1.0.8]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.7...v1.0.8
+[1.0.7]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.6...v1.0.7
+[1.0.6]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.5...v1.0.6
+[1.0.5]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.4...v1.0.5
+[1.0.4]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.3...v1.0.4
+[1.0.3]: https://github.com/solrevdev/solrevdev.ytx/compare/v1.0.1...v1.0.3
+[1.0.1]: https://github.com/solrevdev/solrevdev.ytx/releases/tag/v1.0.1

README.md

@@ -163,7 +163,7 @@ dotnet restore src/Ytx
 # Build
 dotnet build src/Ytx -c Release
 
-# Run the unit tests
+# Run the unit tests (on .NET 8, 9 and 10; add -f net8.0 to use one runtime)
 dotnet test tests/Ytx.Tests -c Release
 
 # Test locally (choose an installed target framework)
@@ -182,6 +182,9 @@ dotnet tool install -g solrevdev.ytx --add-source ./nupkg
 ├── src/Ytx/Ytx.csproj              # Package and target-framework metadata
 ├── tests/Ytx.Tests/                 # CLI parsing and formatting unit tests
 ├── .github/workflows/publish.yml   # Validation and release automation
+├── .github/workflows/codeql.yml    # CodeQL analysis
+├── assets/icon.svg                  # Package icon source (icon.png is rendered from it)
+├── CHANGELOG.md                     # Release history
 └── README.md                        # User and maintainer documentation
 ```
 

src/Ytx/Ytx.csproj

@@ -23,6 +23,13 @@
     <PackageProjectUrl>https://github.com/solrevdev/solrevdev.ytx</PackageProjectUrl>
     <PackageLicenseExpression>MIT</PackageLicenseExpression>
     <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageIcon>icon.png</PackageIcon>
+
+    <!-- The SDK adds SourceLink for GitHub; these publish the matching symbols to NuGet. -->
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <IncludeSymbols>true</IncludeSymbols>
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
 
     <!-- where pack puts .nupkg -->
     <PackageOutputPath>../../nupkg</PackageOutputPath>
@@ -34,6 +41,7 @@
 
   <ItemGroup>
     <None Include="../../README.md" Pack="true" PackagePath="\" />
+    <None Include="../../assets/icon.png" Pack="true" PackagePath="\" />
   </ItemGroup>
 
   <ItemGroup>

tests/Ytx.Tests/Ytx.Tests.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFrameworks>net8.0;net9.0;net10.0</TargetFrameworks>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>