Extend NuGet package validation by martincostello · Pull Request #2762 · App-vNext/Polly

martincostello · 2025-10-09T15:32:10Z

Use Meziantou.Framework.NuGetPackageValidation.Tool to extend NuGet package validation.

codecov · 2025-10-09T15:46:47Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.15%. Comparing base (954ad8d) to head (271578d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2762   +/-   ##
=======================================
  Coverage   96.15%   96.15%           
=======================================
  Files         309      309           
  Lines        7123     7123           
  Branches     1005     1005           
=======================================
  Hits         6849     6849           
  Misses        221      221           
  Partials       53       53

Flag	Coverage Δ
linux	`96.15% <ø> (ø)`
macos	`96.15% <ø> (ø)`
windows	`96.14% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copilot

Pull Request Overview

This PR adds the Meziantou.Framework.NuGetPackageValidation.Tool to extend NuGet package validation capabilities beyond the existing dotnet-validate tool.

Adds Meziantou NuGet package validation tool alongside existing validation
Integrates GitHub token support for enhanced validation features
Updates workflow to install and use both validation tools

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/build.yml	Updates workflow to install and use the new Meziantou validation tool with GitHub token support
.config/dotnet-tools.json	Adds the Meziantou NuGet package validation tool and sets rollForward to false for dotnet-validate

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

.github/workflows/build.yml

Updated [Polly.Core](https://github.com/App-vNext/Polly) from 8.6.4 to 8.6.5. <details> <summary>Release notes</summary> _Sourced from [Polly.Core's releases](https://github.com/App-vNext/Polly/releases)._ ## 8.6.5 ## What's Changed * Extend NuGet package validation by @martincostello in App-vNext/Polly#2762 * Suppress S2094 warning by @martincostello in App-vNext/Polly#2765 * Refactor cake script by @martincostello in App-vNext/Polly#2769 * Pass timeout to `TimeoutRejectedException` by @martincostello in App-vNext/Polly#2827 **Full Changelog**: App-vNext/Polly@8.6.4...8.6.5 Commits viewable in [compare view](App-vNext/Polly@8.6.4...8.6.5). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Polly.Core&package-manager=nuget&previous-version=8.6.4&new-version=8.6.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Gunn <james@gunn.io>

[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Updated [Polly](https://github.com/App-vNext/Polly) from 8.5.2 to 8.6.5. <details> <summary>Release notes</summary> _Sourced from [Polly's releases](https://github.com/App-vNext/Polly/releases)._ ## 8.6.5 ## What's Changed * Extend NuGet package validation by @martincostello in App-vNext/Polly#2762 * Suppress S2094 warning by @martincostello in App-vNext/Polly#2765 * Refactor cake script by @martincostello in App-vNext/Polly#2769 * Pass timeout to `TimeoutRejectedException` by @martincostello in App-vNext/Polly#2827 **Full Changelog**: App-vNext/Polly@8.6.4...8.6.5 ## 8.6.4 ## What's Changed * Fix after-release and update CHANGELOG by @martincostello in App-vNext/Polly#2714 * Use collection expressions by @martincostello in App-vNext/Polly#2715 * Fix flaky mutants by @martincostello in App-vNext/Polly#2717 * fix documentation for ExecuteOutcomeAsync by @carvex21 in App-vNext/Polly#2710 * Bump MartinCostello.WaitForNuGetPackage by @martincostello in App-vNext/Polly#2721 * Bump sign tool by @martincostello in App-vNext/Polly#2722 * xunit v3 preparation by @martincostello in App-vNext/Polly#2723 * Add summary NuGet badges by @martincostello in App-vNext/Polly#2724 * Delete actionlint config by @martincostello in App-vNext/Polly#2730 * RateLimiting: add typed builder/guard tests and external limiter lifetime test by @mohammed-saalim in App-vNext/Polly#2711 * Update Dependabot auto-merge conditions by @martincostello in App-vNext/Polly#2736 * Bump NuGet packages by @martincostello in App-vNext/Polly#2738 * Bump dotnet-stryker to 4.8.1 by @martincostello in App-vNext/Polly#2739 * Simplify code by @martincostello in App-vNext/Polly#2740 * Update zizmor by @martincostello in App-vNext/Polly#2746 * Use NuGet Trusted Publishing by @martincostello in App-vNext/Polly#2751 * Respect override for PipelineExecuting and PipelineExecuted by @peter-csala in App-vNext/Polly#2752 ## New Contributors * @carvex21 made their first contribution in App-vNext/Polly#2710 * @mohammed-saalim made their first contribution in App-vNext/Polly#2711 **Full Changelog**: App-vNext/Polly@8.6.3...8.6.4 ## 8.6.3 ## What's Changed * Add release notes configuration by @martincostello in App-vNext/Polly#2678 * Simplify release workflow by @martincostello in App-vNext/Polly#2679 * Sign-off commits by @martincostello in App-vNext/Polly#2694 * Add GitHub sponsorship by @martincostello in App-vNext/Polly#2695 * Refactor project dependencies by @martincostello in App-vNext/Polly#2696 * Add zizmor by @martincostello in App-vNext/Polly#2698 * Update benchmarks by @martincostello in App-vNext/Polly#2712 * Reduce async overhead by @pentp in App-vNext/Polly#2664 * Update benchmarks by @martincostello in App-vNext/Polly#2713 ## New Contributors * @pentp made their first contribution in App-vNext/Polly#2664 **Full Changelog**: App-vNext/Polly@8.6.2...8.6.3 ## 8.6.2 ## What's Changed * Performance tweaks by @martincostello in App-vNext/Polly#2667 * Update dependencies by @martincostello in App-vNext/Polly#2668 * Update benchmark results by @martincostello in App-vNext/Polly#2669 ## New Contributors * @pentp made their first contribution in App-vNext/Polly#2667 **Full Changelog**: App-vNext/Polly@8.6.1...8.6.2 ## 8.6.1 ## What's Changed * Fix integer overflow in `BulkheadSemaphoreFactory` by @ahusseini in App-vNext/Polly#2638 * Generate SBOM by @martincostello in App-vNext/Polly#2640 * Attest artifacts by @martincostello in App-vNext/Polly#2647 ## New Contributors * @ahusseini made their first contribution in App-vNext/Polly#2638 **Full Changelog**: App-vNext/Polly@8.6.0...8.6.1 ## 8.6.0 ## What's Changed * Bump Stryker by @martincostello in App-vNext/Polly#2476 * Fix chaos example issue and enrich notes & diagram by @caigen in App-vNext/Polly#2482 * Add diagram for the main chaos page sample by @peter-csala in App-vNext/Polly#2484 * Fix broken CI by @martincostello in App-vNext/Polly#2497 * Remove .NET 6 SDK by @martincostello in App-vNext/Polly#2501 * Use Stryker Mutator Dashboard by @martincostello in App-vNext/Polly#2500 * Fix Polly.Testing mutations by @martincostello in App-vNext/Polly#2503 * Lint PowerShell scripts by @martincostello in App-vNext/Polly#2504 * Improve Polly coverage by @martincostello in App-vNext/Polly#2505 * Improve mutation score by @martincostello in App-vNext/Polly#2506 * Run CodeQL for GitHub Actions by @martincostello in App-vNext/Polly#2498 * Add missing mutations by @martincostello in App-vNext/Polly#2508 * Remove dotnet tool restore by @martincostello in App-vNext/Polly#2513 * Add missing coverage by @martincostello in App-vNext/Polly#2514 * Improve mutation test perf by @slang25 in App-vNext/Polly#2520 * Improve coverage by @martincostello in App-vNext/Polly#2526 * Remove System.Text.Json reference by @martincostello in App-vNext/Polly#2532 * Fix test summary reliability by @martincostello in App-vNext/Polly#2543 * Use AuthenticodeLint by @martincostello in App-vNext/Polly#2553 * Use actions/create-github-app-token by @martincostello in App-vNext/Polly#2572 * Fix Retry strategy ShouldHandle in example code by @marcrocny in App-vNext/Polly#2527 * Tweak docs formatting by @martincostello in App-vNext/Polly#2575 * Dispose registry which contains rate limiters by @peter-csala in App-vNext/Polly#2578 * Improve mutation tests performance by ensuring solution file isn't discovered by @slang25 in App-vNext/Polly#2589 * Update LICENSE metadata by @martincostello in App-vNext/Polly#2590 * Add HTTP client integration samples by @peter-csala in App-vNext/Polly#2587 * Dedupe links by @martincostello in App-vNext/Polly#2592 * Add test analytics by @martincostello in App-vNext/Polly#2593 * Add note about context/state mix-ups by @martincostello in App-vNext/Polly#2598 * Emit annotation for packages by @martincostello in App-vNext/Polly#2601 * Add `AttemptNumber` to `HedgingPredicateArguments` by @peter-csala in App-vNext/Polly#2603 * .NET 10 preparation by @martincostello in App-vNext/Polly#2620 * Migrate to slnx by @martincostello in App-vNext/Polly#2623 * Fix `OnRetryArguments` comments by @lchaoer in App-vNext/Polly#2627 * Fix package signing by @martincostello in App-vNext/Polly#2631 ## New Contributors * @caigen made their first contribution in App-vNext/Polly#2482 * @slang25 made their first contribution in App-vNext/Polly#2520 * @marcrocny made their first contribution in App-vNext/Polly#2527 * @lchaoer made their first contribution in App-vNext/Polly#2627 **Full Changelog**: App-vNext/Polly@8.5.2...8.6.0 Commits viewable in [compare view](App-vNext/Polly@8.5.2...8.6.5). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Polly&package-manager=nuget&previous-version=8.5.2&new-version=8.6.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Extend NuGet package validation

271578d

Use Meziantou.Framework.NuGetPackageValidation.Tool to extend NuGet package validation.

martincostello added enhancement CI/build dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Oct 9, 2025

martincostello marked this pull request as ready for review October 9, 2025 16:03

Copilot AI review requested due to automatic review settings October 9, 2025 16:03

martincostello enabled auto-merge (rebase) October 9, 2025 16:03

Copilot AI reviewed Oct 9, 2025

View reviewed changes

.github/workflows/build.yml Show resolved Hide resolved

martincostello merged commit 537d9fc into main Oct 9, 2025
34 of 35 checks passed

martincostello deleted the extend-package-validation branch October 9, 2025 16:09

This was referenced Jan 26, 2026

Bump Polly.Core from 8.6.4 to 8.6.5 DFE-Digital/teaching-record-system#3041

Merged

Bump the patch group with 13 updates mm-psy/AAS.TwinEngine.DataEngine#19

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Extend NuGet package validation#2762

Extend NuGet package validation#2762
martincostello merged 1 commit intomainfrom
extend-package-validation

martincostello commented Oct 9, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 9, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

martincostello commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

martincostello commented Oct 9, 2025 •

edited

Loading

codecov bot commented Oct 9, 2025 •

edited

Loading