Skip to content

chore(deps): coordinate .NET 10.0.13 and OpenTelemetry 1.20.0 with locked restore evidence - #343

Merged
akhiabanchian merged 5 commits into
mainfrom
chore/deps-oct21-atomic-dotnet-otel-lockfiles
Oct 21, 2026
Merged

chore(deps): coordinate .NET 10.0.13 and OpenTelemetry 1.20.0 with locked restore evidence#343
akhiabanchian merged 5 commits into
mainfrom
chore/deps-oct21-atomic-dotnet-otel-lockfiles

Conversation

@ammarheidari

@ammarheidari ammarheidari commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Governed resolution for #336, #338, #339, #340

These four standalone Dependabot PRs fail NU1004 because their Central Package Management versions differ from versioned transitive references in multiple project-level packages.lock.json files. This is a draft review candidate, not yet admitted to protected main.

  • Coordinate Microsoft.Data.Sqlite and Microsoft.AspNetCore.Authentication.OpenIdConnect to 10.0.13, and both OpenTelemetry hosting/exporter dependencies to 1.20.0.
  • Temporarily add a read-only, pinned, pull-request-only Actions job that runs dotnet restore Kafdeck.slnx --force-evaluate -p:RestoreLockedMode=false, followed by mandatory dotnet restore Kafdeck.slnx --locked-mode, then uploads only solution lockfiles. The temporary workflow must be removed before this PR is ready to merge.
  • The exact resulting lockfile graph will be inspected and committed on this branch, followed by all exact-head C#/JS CodeQL, Quality, Kafka, Keycloak, PostgreSQL, dependency and supply-chain tests plus CODEOWNER/Codex.

Do not merge any individual obsolete PR or relax --locked-mode. Once atomic replacement is accepted, close the four superseded Dependabot PRs without merge.

No release/tag or v0.8 scope change.

@ammarheidari
chore(deps): coordinate .NET patch and OpenTelemetry 1.20.0 upgrades
5479252 
Stage aligned central references before trusted lockfile regeneration; no locked-mode bypass in release gates.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>
@ammarheidari
ci(deps): generate reviewable NuGet lock candidates with pinned read-…
a397d1f 
…only .NET 10 job

Temporary PR-only job, removed before protected-main merge.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>
@ammarheidari ChatGPT Codex Connector

ammarheidari commented Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

NuGet regeneration job SUCCESS on head a397d1f54098540a69a751b9de67cd1e4c41868a, workflow run 39555690416. A read-only, pinned .NET 10 runner ran dotnet restore Kafdeck.slnx --force-evaluate -p:RestoreLockedMode=false followed by successful dotnet restore Kafdeck.slnx --locked-mode. It generated artifact full-solution-lockfiles-candidate (ID 12325317151), 20 project lockfiles, with 17 changed and 175 insertions/175 deletions. This proves the coordinated package set is solvable without bypass. Artifact lockfiles are not yet committed on the PR branch; temporary workflow remains and PR must stay DRAFT/UNMERGED until exact generated files are applied, workflow removed, full CI/CodeQL passed and CODEOWNER approves. Supersedes #336/#338/#339/#340 only after clean guarded merge.

@ammarheidari ammarheidari mentioned this pull request Oct 21, 2026
Open
8 of 11 tasks
@ammarheidari
chore(deps): commit exact regenerated NuGet lock graphs for .NET/OTel
7fb6c8b 
Reproduced 17 tracked lockfiles byte-for-byte from pinned read-only .NET 10 GitHub Actions artifact 12325317151, verified all 17 Git blob SHA values match the artifact. Removed temporary regeneration workflow before admission. Locked-mode restore must remain mandatory.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>
@ammarheidari
chore(deps): integrate exact NuGet lock graph with protected CodeQL main
4d66d68 
Preserve atomic CodeQL v4.39.0 upgrade from protected main. Stage exact .NET 10 generated dependency lock graphs for four coordinated upgrades; remove temporary lockfile generator before protected admission.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>
@ammarheidari
ammarheidari marked this pull request as ready for review October 21, 2026 07:27
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-21T07:55:25.797150Z 0392b0f Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@ammarheidari ChatGPT Codex Connector

ammarheidari commented Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Full-scope dependency PR prepared for admission — signed exact head 4d66d68ed753f26c11ff3467a0f86f63dae9be70, based on protected main b38da4696e95a93a777a84893181949e00c6f7ad (atomic CodeQL #342). Reconstructed all 17 tracked changed packages.lock.json blobs byte-for-byte from real .NET 10 dotnet restore --force-evaluate GitHub Actions artifact 12325317151; every Git blob SHA matched source artifact SHA before staging. dotnet restore Kafdeck.slnx --locked-mode succeeded during candidate generation. Temporary nuget-lockfile-regeneration-review.yml was deleted before latest PR head. No workflow token write privileges, no relaxed restore gates, no release change.

Current-head Quality, C#/JS CodeQL, Dependency, Kafka tiers, Keycloak, PostgreSQL HA and Windows/macOS/Linux loops must pass again. Fresh CODEOWNER and latest Codex review requested. @codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 4d66d68ed7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@ammarheidari
chore(deps): synchronize full lock graph with protected main React up…
0392b0f 
…date

Maintain exact .NET 10 and OTel lockfile artifacts, preserve protected-main React runtime upgrade and repeat exact-head gates.

Signed-off-by: Ammar Heidari <ammar@arad-itc.org>
@ammarheidari ChatGPT Codex Connector

ammarheidari commented Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Synced protected-main React #341 merge d9f483610526527483b59ce2486ee28a2f68c781 into coordinated dependency candidate via signed two-parent commit 0392b0fb9b7c4b303f14b6e5c0d7036313f3c95d. Tree copies only the 18 previously reviewed .NET/OTel central+project lockfile blobs on top of latest main. Re-run all exact-head CI/CodeQL/Codex and fresh CODEOWNER; previous SHA checks/approvals cannot be reused. @codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 0392b0fb9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@akhiabanchian
akhiabanchian merged commit affed95 into main Oct 21, 2026
22 checks passed
@akhiabanchian
akhiabanchian deleted the chore/deps-oct21-atomic-dotnet-otel-lockfiles branch October 21, 2026 08:03
This was referenced Oct 21, 2026
Closed
Closed
Closed
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@akhiabanchian akhiabanchian akhiabanchian approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ammarheidari @akhiabanchian