cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build(dotnet): lock SDK and packages

Browse Source 
Pin the SDK feature band and commit transitive NuGet content hashes so CI fails on unreviewed dependency drift.
This commit is contained in:
cesnimda
2026-08-30 11:17:32 +02:00
parent 19c5251612
commit 16ef3b9463
10 changed files with 1246 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-programmes/master-progress.md
+2 -1
View File
@@ -41,6 +41,7 @@ Updated: 2026-08-30
- Localized the pre-authentication security-check label and the embedded Turnstile challenge language, so switching to Bokmål no longer leaves the verification widget in English.
- Localized the remaining active helper defaults in the admin SMTP test form, pasted-email importer, and image-crop alternative text.
- Restored the local Python 3.12 toolchain and both virtual environments; the AI sidecar now passes 26/26 tests. Added a Next.js-compatible ESLint 9 flat configuration, strict zero-warning scripts, and a patched CommonJS-compatible `brace-expansion` override. The lint gate passes with zero findings and npm audit reports zero vulnerabilities.
- Pinned the repository to .NET SDK 9.0.317, generated content-hashed transitive NuGet locks for the API and test project, and made CI restores fail on lock drift. Locked restore and backend 719/719 pass; the current NuGet graph has no known vulnerable packages.
### In progress
@@ -109,7 +110,7 @@ Updated: 2026-08-30
- Manual desktop browser review: webpack development server rendered the new Career navigation and Overview correctly in dark mode; API-dependent profile status remained unavailable because the backend was not running for that isolated UI review.
- **Overall programme status:** Active but externally blocked. Eight packages are locally verified and twenty-seven are implemented with verification incomplete. The prioritized admin-only version indicator, every immediate repository/browser item, SEC-006/SEC-007 repository boundaries, SEC-009, the PROD-001 read-only inventory, and the PROD-003 safe benchmark harness are complete on the feature branch.
- **Current work package:** Reconcile the next safe repository item while SEC-006/SEC-007 await Linux image/runtime proof.
- **Current work package:** JT-017/JT-018 supply-chain and developer-documentation hardening while external runtime gates remain blocked.
- **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
- **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002, DEP-001 and VER-001 (`VERIFIED LOCALLY`).
- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-006, SEC-007, SEC-008, SEC-009, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001, JOBS-001/002 and PRODUCT-001 (`IMPLEMENTED — NOT VERIFIED`). Their safe repository/browser scope is implemented; production/native-device/provider/retention gates remain where recorded.
docs/work-programmes/master-work-plan.md
+3 -3
View File
@@ -565,10 +565,10 @@ This queue records the highest-value work that can proceed without production cr
- **Required browser verification:** synthetic CV first; authorized private file via temporary local copy only, never logged/committed/external.
- **Required production verification:** synthetic/local-only canary, no external payload, restart recovery.
- **Status:** `IMPLEMENTED — NOT VERIFIED`.
- **Blocker:** SEC-006 dependency upgrades need internet permission; browser/private-file/MariaDB/production reproduction remains unavailable. Synthetic repository work can continue.
- **Evidence:** `docs/verification/ai-004-cv-processing-queue.md`; V-104–V-107/V-180/V-181; real SQLite synthetic integration proves 202/active deduplication/owner-scoped handler/retry provenance/notification/review gate, usage reservation and pre-claim cancellation/deadline synchronization; focused accounting/operation/lifecycle 28/28; backend 663/663; frontend 161/161 and build.
- **Blocker:** browser localhost policy, selected-model execution, MariaDB and production reproduction remain unavailable. SEC-006/007 repository hardening is implemented; its Linux image/runtime proof is separately gated by the offline Docker daemon.
- **Evidence:** `docs/verification/ai-004-cv-processing-queue.md`; `docs/verification/sec-006-parser-dependencies.md`; `docs/verification/sec-007-parser-isolation.md`; V-104–V-107/V-180/V-181/V-190/V-191; real SQLite synthetic integration proves 202/active deduplication/owner-scoped handler/retry provenance/notification/review gate, usage reservation and pre-claim cancellation/deadline synchronization; backend 719/719; parser 37/37.
- **Commit:** `c3c5af8` (`feat(cv)!: queue durable processing`).
- **Remaining work:** SEC-006/007 parser dependency/isolation and complete parser-child cancellation; browser synthetic upload/refresh/retry/cancel/review at required widths/themes/keyboard; selected-model and worker-restart canary; MariaDB/production rollout. Do not use the private CV before safeguards.
- **Remaining work:** browser synthetic upload/refresh/retry/cancel/review at required widths/themes/keyboard; Linux parser image/runtime proof; selected-model and worker-restart canary; MariaDB/production rollout. Do not use the private CV for external/provider processing.
### UX-001 — Unified authentication page