Standardise on NuGet Trusted Publishing, align with XWiki.Api pattern, fix analyzer warnings

davidnmbond · davidnmbond · commit cea0daae6153 · 2026-03-30T16:46:09.000+01:00
diff --git a/.editorConfig b/.editorConfig
@@ -150,6 +150,25 @@ csharp_style_prefer_top_level_statements = true:silent
 dotnet_diagnostic.CA1050.severity = error
 #dotnet_naming_style.constant_field_style.required_prefix = _ NOPE.
 
+# CA1848: Use the LoggerMessage delegates
+dotnet_diagnostic.CA1848.severity = none
+# CA1873: Avoid unnecessary string evaluation for logging
+dotnet_diagnostic.CA1873.severity = none
+# CA5350: SHA1 is required by SSH protocol (diffie-hellman-group1-sha1)
+dotnet_diagnostic.CA5350.severity = none
+# CA5351: MD5 is required for SSH fingerprint computation
+dotnet_diagnostic.CA5351.severity = none
+# CA5384: DSA is required for SSH DSS key support
+dotnet_diagnostic.CA5384.severity = none
+# CA1305: string.Format locale - SSH protocol messages are not user-facing
+dotnet_diagnostic.CA1305.severity = none
+# CA1051: Protected fields in abstract base classes are part of the library API
+dotnet_diagnostic.CA1051.severity = none
+# CA1001: Disposable ownership patterns are managed via CloseService/ForceClose
+dotnet_diagnostic.CA1001.severity = none
+# CA1711: CipherModeEx is an established name in the codebase
+dotnet_diagnostic.CA1711.severity = none
+
 vsspell_section_id = 24bfe3a339004957ab34f7654481307f
 vsspell_spell_check_as_you_type = true
 vsspell_ignore_words_with_digits = true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,12 +3,14 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ['[0-9]*.[0-9]*.[0-9]*']
   pull_request:
     branches: [main]
 
 jobs:
   build:
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -19,11 +21,46 @@ jobs:
         with:
           dotnet-version: '10.0.x'
 
-      - name: Restore dependencies
+      - name: Restore
         run: dotnet restore
 
       - name: Build
         run: dotnet build --no-restore --configuration Release
 
-      - name: Test
-        run: dotnet test --no-build --configuration Release --verbosity normal
+      - name: Pack
+        run: dotnet pack PanoramicData.SshServer/PanoramicData.SshServer.csproj --no-build --configuration Release --output ./artifacts
+
+      - name: Upload NuGet artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuget
+          path: |
+            ./artifacts/*.nupkg
+            ./artifacts/*.snupkg
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: nuget
+          path: ./artifacts
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: NuGet login (Trusted Publishing)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: david_n_m_bond
+
+      - name: Publish to NuGet
+        run: dotnet nuget push ./artifacts/*.nupkg --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -1,11 +1,15 @@
 <Project>
 	<PropertyGroup>
-		<Company>Panoramic Data Limited</Company>
 		<Authors>Panoramic Data Limited</Authors>
-		<Copyright>Copyright © $([System.DateTime]::Now.Year) Panoramic Data Limited</Copyright>
-		<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+		<Company>Panoramic Data Limited</Company>
+		<Copyright>Copyright © Panoramic Data Limited $([System.DateTime]::Now.Year)</Copyright>
+		<LangVersion>latest</LangVersion>
 		<Nullable>enable</Nullable>
-		<NuGetAuditMode>All</NuGetAuditMode>
+		<ImplicitUsings>enable</ImplicitUsings>
+		<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+		<AnalysisMode>All</AnalysisMode>
+		<AnalysisLevel>latest-recommended</AnalysisLevel>
+		<NuGetAuditMode>all</NuGetAuditMode>
 		<!-- Nullable warnings kept as warnings (not errors) for gradual adoption in existing codebase -->
 		<WarningsNotAsErrors>$(WarningsNotAsErrors);CS8600;CS8601;CS8602;CS8603;CS8604;CS8610;CS8618;CS8619;CS8620;CS8622;CS8625;CS8631;CS8634;CS8714;CS8765;CS8767</WarningsNotAsErrors>
 	</PropertyGroup>
diff --git a/PanoramicData.SshServer.Test/ExampleKeyManager.cs b/PanoramicData.SshServer.Test/ExampleKeyManager.cs
@@ -8,10 +8,10 @@
 
 namespace ExampleApp;
 
-internal class ExampleKeyManager : IKeyManager
+internal sealed class ExampleKeyManager : IKeyManager
 {
 	public async Task<Dictionary<string, string>> GetHostKeysAsync(CancellationToken cancellationToken)
-		=> new Dictionary<string, string>
+		=> new()
 		{
 			{ "rsa-sha2-256", await GetPrivateKeyBase64Async("rsa-sha2-256", cancellationToken) },
 			{ "ssh-dss", await GetPrivateKeyBase64Async("ssh-dss", cancellationToken) },
diff --git a/PanoramicData.SshServer.Test/ExampleSshApplication.cs b/PanoramicData.SshServer.Test/ExampleSshApplication.cs
@@ -7,7 +7,7 @@
 using System;
 
 namespace ExampleApp;
-internal class ExampleSshApplication(
+internal sealed class ExampleSshApplication(
 	IOptions<ExampleSshApplicationConfiguration> options,
 	ILogger<Program> logger) : ISshApplication
 {
diff --git a/PanoramicData.SshServer.Test/ExampleSshApplicationConfiguration.cs b/PanoramicData.SshServer.Test/ExampleSshApplicationConfiguration.cs
@@ -1,6 +1,6 @@
 ﻿namespace ExampleApp;
 
-internal class ExampleSshApplicationConfiguration
+internal sealed class ExampleSshApplicationConfiguration
 {
 	/// <summary>
 	/// Whether to permit TCP forwarding.
diff --git a/PanoramicData.SshServer.Test/MiniTerm/Processes/Process.cs b/PanoramicData.SshServer.Test/MiniTerm/Processes/Process.cs
@@ -14,7 +14,7 @@ internal sealed class Process(Native.ProcessApi.STARTUPINFOEX startupInfo, Nativ
 
 	#region IDisposable Support
 
-	private bool _disposedValue = false; // To detect redundant calls
+	private bool _disposedValue; // To detect redundant calls
 
 	void Dispose(bool disposing)
 	{
diff --git a/PanoramicData.SshServer.Test/Program.cs b/PanoramicData.SshServer.Test/Program.cs
@@ -12,6 +12,7 @@
 
 namespace ExampleApp;
 
+#pragma warning disable CA1852 // Partial Program class cannot be sealed
 partial class Program
 {
 	static async Task Main()
diff --git a/PanoramicData.SshServer.Test/TcpForwardService.cs b/PanoramicData.SshServer.Test/TcpForwardService.cs
@@ -12,7 +12,7 @@ public class TcpForwardService(
 {
 	private readonly Socket _socket = new(SocketType.Stream, ProtocolType.Tcp);
 	private readonly List<byte> _blocked = [];
-	private bool _connected = false;
+	private bool _connected;
 
 	public event EventHandler<byte[]> DataReceived;
 	public event EventHandler CloseReceived;
diff --git a/PanoramicData.SshServer/Algorithms/CtrModeCryptoTransform.cs b/PanoramicData.SshServer/Algorithms/CtrModeCryptoTransform.cs
@@ -65,5 +65,9 @@ public byte[] TransformFinalBlock(byte[] inputBuffer, int inputOffset, int input
 		return output;
 	}
 
-	public void Dispose() => _transform.Dispose();
+	public void Dispose()
+	{
+		_transform.Dispose();
+		GC.SuppressFinalize(this);
+	}
 }
diff --git a/PanoramicData.SshServer/Algorithms/DiffieHellman.cs b/PanoramicData.SshServer/Algorithms/DiffieHellman.cs
@@ -24,13 +24,13 @@ public class DiffieHellman : AsymmetricAlgorithm
 
 	private static readonly RandomNumberGenerator _rng = RandomNumberGenerator.Create();
 
-	private BigInteger _p;
-	private BigInteger _g;
-	private BigInteger _x;
+	private readonly BigInteger _p;
+	private readonly BigInteger _g;
+	private readonly BigInteger _x;
 
 	public DiffieHellman(int bitlen)
 	{
-		Contract.Requires(bitlen == 1024 || bitlen == 2048 || bitlen == 4096 || bitlen == 8192);
+		Contract.Requires(bitlen is 1024 or 2048 or 4096 or 8192);
 
 		switch (bitlen)
 		{
@@ -55,7 +55,7 @@ public DiffieHellman(int bitlen)
 				break;
 
 			default:
-				throw new ArgumentException("bitlen", "bitlen must equal 1024, 2048, 4096, or 8192");
+				throw new ArgumentException("bitlen must equal 1024, 2048, 4096, or 8192", nameof(bitlen));
 		}
 
 		var bytes = new byte[80]; // 80 * 8 = 640 bits
@@ -80,12 +80,12 @@ public byte[] DecryptKeyExchange(byte[] keyEx)
 		return bytes;
 	}
 
-	private BigInteger BytesToBigint(byte[] bytes) => new([.. bytes.Reverse(), .. new byte[] { 0 }]);
+	private static BigInteger BytesToBigint(byte[] bytes) => new([.. bytes.Reverse(), .. new byte[] { 0 }]);
 
-	private byte[] BigintToBytes(BigInteger bigint)
+	private static byte[] BigintToBytes(BigInteger bigint)
 	{
 		var bytes = bigint.ToByteArray();
-		if (bytes.Length > 1 && bytes[bytes.Length - 1] == 0)
+		if (bytes.Length > 1 && bytes[^1] == 0)
 		{
 			return [.. bytes.Reverse().Skip(1)];
 		}
diff --git a/PanoramicData.SshServer/Config/SshServerConfiguration.cs b/PanoramicData.SshServer/Config/SshServerConfiguration.cs
@@ -27,5 +27,5 @@ public class SshServerConfiguration
 	/// The number of seconds of inactivity before the server disconnects the client.
 	/// Leave as null (the default) to never time out
 	/// </summary>
-	public int? InactivityTimeoutSeconds { get; set; } = null;
+	public int? InactivityTimeoutSeconds { get; set; }
 }
diff --git a/PanoramicData.SshServer/Messages/Connection/PtyRequestMessage.cs b/PanoramicData.SshServer/Messages/Connection/PtyRequestMessage.cs
@@ -4,12 +4,12 @@ namespace PanoramicData.SshServer.Messages.Connection;
 
 public class PtyRequestMessage : ChannelRequestMessage
 {
-	public string Terminal = "";
-	public uint widthChars = 0;
-	public uint heightRows = 0;
-	public uint widthPx = 0;
-	public uint heightPx = 0;
-	public string modes = "";
+	public string Terminal { get; set; } = "";
+	public uint widthChars { get; set; }
+	public uint heightRows { get; set; }
+	public uint widthPx { get; set; }
+	public uint heightPx { get; set; }
+	public string modes { get; set; } = "";
 
 	protected override void OnLoad(SshDataWorker reader)
 	{
diff --git a/PanoramicData.SshServer/Services/ConnectionService.cs b/PanoramicData.SshServer/Services/ConnectionService.cs
@@ -14,7 +14,7 @@ public class ConnectionService : SshService
 {
 	private readonly Lock _lock = new();
 	private readonly List<Channel> _channels = [];
-	private readonly UserAuthArgs? _auth = null;
+	private readonly UserAuthArgs? _auth;
 	private readonly BlockingCollection<ConnectionServiceMessage> _messageQueue = new(new ConcurrentQueue<ConnectionServiceMessage>());
 	private readonly CancellationTokenSource _messageCts = new();
 
diff --git a/PanoramicData.SshServer/Session.cs b/PanoramicData.SshServer/Session.cs
@@ -40,8 +40,8 @@ public partial class Session
 	private uint _inboundPacketSequence;
 	private uint _outboundFlow;
 	private uint _inboundFlow;
-	private Algorithms? _algorithms = null;
-	private ExchangeContext? _exchangeContext = null;
+	private Algorithms? _algorithms;
+	private ExchangeContext? _exchangeContext;
 	private readonly List<SshService> _services = [];
 	private readonly ConcurrentQueue<Message> _blockedMessages = new();
 	private readonly ManualResetEvent _hasBlockedMessagesWaitHandle = new(true);
@@ -765,7 +765,7 @@ private static byte[] ComputeHmac(HmacAlgorithm alg, byte[] payload, uint seq)
 		return service;
 	}
 
-	private class Algorithms
+	private sealed class Algorithms
 	{
 		public KexAlgorithm KeyExchange;
 		public PublicKeyAlgorithm PublicKey;
@@ -777,7 +777,7 @@ private class Algorithms
 		public CompressionAlgorithm ServerCompression;
 	}
 
-	private class ExchangeContext
+	private sealed class ExchangeContext
 	{
 		public string? KeyExchange;
 		public string? PublicKey;
diff --git a/PanoramicData.SshServer/SshServer.cs b/PanoramicData.SshServer/SshServer.cs
@@ -20,7 +20,7 @@ public class SshServer(
 	private readonly List<Session> _sessions = [];
 	private readonly Dictionary<string, string> _hostKey = [];
 	private bool _started;
-	private TcpListener? _listener = null;
+	private TcpListener? _listener;
 	private bool _disposedValue;
 
 	public Guid Id { get; } = Guid.NewGuid();
diff --git a/Publish.ps1 b/Publish.ps1

Original file line number	Diff line number	Diff line change
`@@ -8,10 +8,10 @@`
`8`	`8`
`9`	`9`	`namespace ExampleApp;`
`10`	`10`
`11`		`-internal class ExampleKeyManager : IKeyManager`
	`11`	`+internal sealed class ExampleKeyManager : IKeyManager`
`12`	`12`	`{`
`13`	`13`	`public async Task<Dictionary<string, string>> GetHostKeysAsync(CancellationToken cancellationToken)`
`14`		`- => new Dictionary<string, string>`
	`14`	`+ => new()`
`15`	`15`	`{`
`16`	`16`	`{ "rsa-sha2-256", await GetPrivateKeyBase64Async("rsa-sha2-256", cancellationToken) },`
`17`	`17`	`{ "ssh-dss", await GetPrivateKeyBase64Async("ssh-dss", cancellationToken) },`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`using System;`
`8`	`8`
`9`	`9`	`namespace ExampleApp;`
`10`		`-internal class ExampleSshApplication(`
	`10`	`+internal sealed class ExampleSshApplication(`
`11`	`11`	`IOptions<ExampleSshApplicationConfiguration> options,`
`12`	`12`	`ILogger<Program> logger) : ISshApplication`
`13`	`13`	`{`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`namespace ExampleApp;`
`2`	`2`
`3`		`-internal class ExampleSshApplicationConfiguration`
	`3`	`+internal sealed class ExampleSshApplicationConfiguration`
`4`	`4`	`{`
`5`	`5`	`/// <summary>`
`6`	`6`	`/// Whether to permit TCP forwarding.`
Original file line number	Diff line number	Diff line change
`@@ -14,7 +14,7 @@ internal sealed class Process(Native.ProcessApi.STARTUPINFOEX startupInfo, Nativ`
`14`	`14`
`15`	`15`	`#region IDisposable Support`
`16`	`16`
`17`		`- private bool _disposedValue = false; // To detect redundant calls`
	`17`	`+ private bool _disposedValue; // To detect redundant calls`
`18`	`18`
`19`	`19`	`void Dispose(bool disposing)`
`20`	`20`	`{`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@`
`12`	`12`
`13`	`13`	`namespace ExampleApp;`
`14`	`14`
	`15`	`+#pragma warning disable CA1852 // Partial Program class cannot be sealed`
`15`	`16`	`partial class Program`
`16`	`17`	`{`
`17`	`18`	`static async Task Main()`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ public class TcpForwardService(`
`12`	`12`	`{`
`13`	`13`	`private readonly Socket _socket = new(SocketType.Stream, ProtocolType.Tcp);`
`14`	`14`	`private readonly List<byte> _blocked = [];`
`15`		`- private bool _connected = false;`
	`15`	`+ private bool _connected;`
`16`	`16`
`17`	`17`	`public event EventHandler<byte[]> DataReceived;`
`18`	`18`	`public event EventHandler CloseReceived;`
Original file line number	Diff line number	Diff line change
`@@ -65,5 +65,9 @@ public byte[] TransformFinalBlock(byte[] inputBuffer, int inputOffset, int input`
`65`	`65`	`return output;`
`66`	`66`	`}`
`67`	`67`
`68`		`- public void Dispose() => _transform.Dispose();`
	`68`	`+ public void Dispose()`
	`69`	`+ {`
	`70`	`+ _transform.Dispose();`
	`71`	`+ GC.SuppressFinalize(this);`
	`72`	`+ }`
`69`	`73`	`}`