Merge to V 1.0.0

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: msallin # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]

.github/dependabot.yml

@@ -0,0 +1,36 @@
+# Dependabot keeps the .NET SDK (global.json), NuGet packages and GitHub Actions versions up to date.
+#
+# Minor and patch updates are grouped into a single PR per ecosystem to cut noise; major updates open
+# their own PR so the breaking-change surface stays visible. Updates are proposed as PRs and merged
+# manually after the CI "Build & Test" check passes.
+version: 2
+updates:
+  # Bumps the SDK version pinned in global.json, which setup-dotnet installs in CI. The dotnet-sdk
+  # ecosystem only does version updates (no security updates) and targets global.json files.
+  - package-ecosystem: dotnet-sdk
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: nuget
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      nuget-minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor-and-patch:
+        update-types:
+          - minor
+          - patch

.github/workflows/cd.yml

@@ -0,0 +1,136 @@
+name: CD
+
+# Builds, tests and packs the NuGet package on a version tag (v1.2.3) or manual run.
+# Publishing to NuGet uses Trusted Publishing (OIDC) and runs only on a v*.*.* tag push; a manual
+# run packs and uploads the artifact as a dry run without publishing (see the step comments below).
+
+on:
+  push:
+    tags: [ 'v*.*.*' ]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Package version, e.g. 1.2.3. Defaults to a dev version when omitted.'
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  pack-publish:
+    name: Pack & Publish
+    # Windows is required: the library multi-targets net40/net45 and the demo targets net48, which
+    # need the .NET Framework reference assemblies / targeting packs available on the Windows runners.
+    runs-on: windows-latest
+    timeout-minutes: 15
+    permissions:
+      id-token: write     # Required for NuGet Trusted Publishing; without it NuGet/login fails with 403.
+      contents: write     # Required to create the GitHub Release; a job-level block drops inherited defaults.
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          # Install the exact SDK pinned in global.json; Dependabot's dotnet-sdk updater keeps it current.
+          global-json-file: global.json
+          # Cache the restored NuGet packages, keyed on the committed lock files.
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Resolve version
+        id: version
+        shell: bash
+        # The manual input is read through an env var, not interpolated into the script, so a crafted
+        # value cannot inject shell. It is then validated as SemVer before anything downstream uses it.
+        env:
+          VERSION_INPUT: ${{ github.event.inputs.version }}
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          elif [[ -n "${VERSION_INPUT}" ]]; then
+            VERSION="${VERSION_INPUT}"
+            if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
+              echo "Invalid version '${VERSION}'; expected SemVer such as 1.2.3 or 1.2.3-rc.1." >&2
+              exit 1
+            fi
+          else
+            VERSION="0.0.0-dev.${GITHUB_RUN_NUMBER}"
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Resolved package version: ${VERSION}"
+
+      - name: Restore
+        # Locked-mode restore fails the build if any packages.lock.json is missing or out of date, so the
+        # restore is reproducible and a forgotten lock-file update cannot slip through.
+        run: dotnet restore SQLite.CodeFirst.slnx --locked-mode
+
+      - name: Build
+        run: dotnet build SQLite.CodeFirst.slnx -c Release --no-restore -p:Version=${{ steps.version.outputs.version }}
+
+      - name: Test
+        # The test project runs on Microsoft.Testing.Platform (opted in via global.json), so target the
+        # solution with the native MTP dotnet test syntax.
+        run: dotnet test --solution SQLite.CodeFirst.slnx -c Release --no-build
+
+      - name: Pack
+        run: >
+          dotnet pack SQLite.CodeFirst/SQLite.CodeFirst.csproj -c Release --no-build
+          -p:Version=${{ steps.version.outputs.version }}
+          -o ${{ github.workspace }}/artifacts
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: nuget-package
+          path: |
+            ${{ github.workspace }}/artifacts/*.nupkg
+            ${{ github.workspace }}/artifacts/*.snupkg
+
+      # --- NuGet publishing via Trusted Publishing (OIDC). ---
+      # No long-lived API key: NuGet/login swaps the GitHub OIDC token for a short-lived key, authorized
+      # by the trusted publishing policy on nuget.org (the policy must name this workflow file, cd.yml).
+      # Gated to tag pushes so a manual run stays a dry run and never pushes the 0.0.0-dev.* version.
+      # https://learn.microsoft.com/nuget/nuget-org/trusted-publishing
+      - name: NuGet login (OIDC)
+        id: nuget-login
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: NuGet/login@v1
+        with:
+          user: ${{ secrets.NUGET_USER }}   # nuget.org account/profile name, NOT the email address.
+
+      - name: Publish to NuGet
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: pwsh
+        # Resolve the package explicitly: on the Windows runner the default PowerShell shell does not
+        # expand a "*.nupkg" wildcard for dotnet, so a literal glob path is passed through and not found.
+        # Pushing the .nupkg also pushes the sibling .snupkg symbol package to nuget.org automatically.
+        run: |
+          $package = Get-ChildItem -Path "${{ github.workspace }}/artifacts/*.nupkg" | Select-Object -First 1
+          dotnet nuget push $package.FullName `
+            --api-key "${{ steps.nuget-login.outputs.NUGET_API_KEY }}" `
+            --source https://api.nuget.org/v3/index.json `
+            --skip-duplicate
+
+      # --- GitHub Release. ---
+      # Created only on tag pushes, after a successful NuGet publish, so the Release reflects what was
+      # actually shipped. Uses the gh CLI (preinstalled on the runner) rather than a third-party action.
+      # --generate-notes builds the notes from commits/PRs since the previous tag; --verify-tag guards
+      # against creating a release for a tag the runner cannot see. The .nupkg/.snupkg are attached so
+      # the package is downloadable straight from the Release page, not just the workflow run.
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: pwsh
+        # The tag is passed through an env var rather than interpolated into the script, matching the
+        # version step above. Assets are resolved with Get-ChildItem so the wildcards expand on the
+        # Windows runner (bash would mangle the backslashes in the workspace path).
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          $assets = Get-ChildItem -Path "${{ github.workspace }}/artifacts/*.nupkg", "${{ github.workspace }}/artifacts/*.snupkg" | ForEach-Object { $_.FullName }
+          # SemVer pre-release tags carry a hyphen (e.g. v1.2.3-rc.1); mark those as GitHub pre-releases.
+          $ghArgs = @($env:TAG, '--title', $env:TAG, '--generate-notes', '--verify-tag')
+          if ($env:TAG -like '*-*') { $ghArgs += '--prerelease' }
+          $ghArgs += $assets
+          gh release create $ghArgs

.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  build-test:
+    name: Build & Test
+    # Windows is required: the library multi-targets net40/net45 and the demo targets net48, which
+    # need the .NET Framework reference assemblies / targeting packs available on the Windows runners.
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v5
+        with:
+          # Install the exact SDK pinned in global.json; Dependabot's dotnet-sdk updater keeps it current.
+          global-json-file: global.json
+          # Cache the restored NuGet packages, keyed on the committed lock files.
+          cache: true
+          cache-dependency-path: '**/packages.lock.json'
+
+      - name: Restore
+        # Locked-mode restore fails the build if any packages.lock.json is missing or out of date, so the
+        # restore is reproducible and a forgotten lock-file update cannot slip through.
+        run: dotnet restore SQLite.CodeFirst.slnx --locked-mode
+
+      - name: Build
+        run: dotnet build SQLite.CodeFirst.slnx -c Release --no-restore
+
+      - name: Test
+        # The test project runs on Microsoft.Testing.Platform (opted in via global.json), so this uses the
+        # native MTP dotnet test syntax: --solution, and the TRX report flags instead of --logger trx.
+        run: >
+          dotnet test --solution SQLite.CodeFirst.slnx -c Release --no-build
+          --report-trx --report-trx-filename test-results.trx
+          --results-directory ${{ github.workspace }}/TestResults
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results
+          path: ${{ github.workspace }}/TestResults/*.trx
+          if-no-files-found: ignore

.gitignore

@@ -155,7 +155,6 @@ ClientBin/
 *~
 *.dbmdl
 *.dbproj.schemaview
-*.pfx
 *.publishsettings
 node_modules/
 
@@ -184,3 +183,4 @@ FakesAssemblies/
 
 # Custom
 *.GhostDoc.xml
+/.vs/*

.nuget/NuGet.Config

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
-  <solution>
-    <add key="disableSourceControlIntegration" value="true" />
-  </solution>
+  <packageSources>
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
+  </packageSources>
 </configuration>