CI-Analysis runs with repository secrets on artifacts that a pull request controls, and it trusted the pull request number, branch name and comment body in them. A pull request could therefore comment on any pull request, overwrite the mutation score of `main` or mention users. The pull request and the dashboard version now come from the `workflow_run` event alone, artifacts are checked for symbolic links, the report is validated before the upload, comment content is defused, and only comments of the pipeline are updated. The mutation job of CI-Analysis now also publishes pull request reports to the dashboard, which the comment's badge links to.
A release tag that is no valid version now fails the build instead of producing an odd package version. Stryker is pinned to 5.0.0 through the build project so that Dependabot updates it, GitVersion and ReportGenerator run on .NET 10 like in the other repositories, Sonar reads the generic coverage format, which keeps the lines of lambdas in generic classes, the mutation targets follow the names of aweXpect, and all actions are pinned to a commit. Dependabot no longer bumps Roslyn, because the analyzers and the source generator only load in compilers at least as new as the Roslyn they reference.
The repositories tracked different sets of Rider files, among them the settings of the repository they were created from, a root
.ideafolder that Rider does not use for a solution, and the state of a Copilot plugin from a single machine. Every repository now tracks the same shared settings for its solution, and their.gitignorekeeps the plugin state out. The sponsor link and the categories of the generated release notes are the same everywhere.