ci: Adopt atelier-store's CI, release and lint setup

[mpaulosky]

Summary

Brings IssueTracker onto atelier-store's hardened workflow baseline, adapted to this repo.

CI

• ci.yml replaces test.yml and main-validation.yml. It builds once, discovers test projects (IsTestProject only, so TestingSupport.Library is skipped), and runs them as a matrix. It also produces coverage (60% gate, as before) and ends with a Test Suite gate job.
• IssueTracker.PlugIns.Tests.Unit now runs in CI for the first time (37 tests, passing).
• The Auth0/Mongo secrets are scoped to the test job only. AppHost.Tests keeps its UI publish and its Docker pre-pull.
• Builds use -warnaserror, with documented NoWarn entries (CS0618/CS0067 until the bUnit TestContext migration, and ASPIRE010).

Security and lint

• Every action is pinned to a commit SHA, with persist-credentials: false.
• New lint-actions.yml runs actionlint, zizmor and shellcheck. CodeQL adds the actions language.
• One .markdownlint-cli2.jsonc replaces .markdownlint.json and .markdownlintignore, and one .yamllint.yml replaces .yamllint. Six docs were fixed to pass it. The legacy Copilot guidance is excluded until the follow-up PR rewrites it.
• .github/hooks (pre-commit Markdown lint, pre-push branch-name check plus scripts/gate.sh) runs the same checks locally. To set it up: git config core.hooksPath .github/hooks.

Releases and automation

• release.yml cuts a semver tag per merged PR (semver:major/semver:minor labels, patch by default) and opens a [skip-release] blog-post PR. release_post.py no longer creates docs/README.md in repos that don't publish one.
• pr-automerge.yml squash-merges same-repo PRs once the checks pass, Copilot has reviewed and all threads are resolved.
• code-metrics.yml keeps its push/PR triggers (IssueTracker has no primary constructors), opens its PR only from main, and marks it [skip-release].
• Dependabot adds dotnet-sdk updates and keeps the Radzen/MessagePack/Testcontainers rules.
• Dropped: docs.yml (Pages builds docs/ in legacy mode anyway), .copilot/mcp-config.json.

SDK pin

• Global.json → global.json: on Linux the SDK resolver only reads the lowercase name, so the pin was being ignored locally.
• Pinned to 10.0.300 with rollForward: latestPatch. SDK 10.0.4xx fails to compile the Razor pages (251 RZ/CS errors), so that upgrade needs its own PR.

Before / after merge

• Add the RELEASE_PR_PAT secret (needed so auto-merged PRs trigger releases and blog PRs don't need approval). ANTHROPIC_API_KEY is optional.
• Switch the main-rules required checks from CI build + Test Suite to Build Solution + Test Suite.
• Push a v0.1.0 tag so the new semver releases start there.

Validation

• dotnet build IssueTracker.slnx -c Release -warnaserror: 0 warnings, 0 errors (SDK 10.0.303)
• scripts/gate.sh via the pre-push hook: lint plus all test projects pass
• Python tests: 124 passed, 1 skipped. Hook tests: 35 passed.
• yamllint, markdownlint-cli2, actionlint, zizmor, shellcheck: clean

Follow-ups

• Agent guidance PR (CLAUDE.md and instructions rewritten for IssueTracker)
• bUnit TestContext migration (removes CS0618/CS0067 NoWarn)
• Razor fixes for SDK 10.0.4xx, and ASPIRE010

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Test Results Summary

449 tests  +37   449 ✅ +37   15s ⏱️ -1s
  9 suites + 1     0 💤 ± 0 
  9 files   + 1     0 ❌ ± 0 

Results for commit 0a79b48. ± Comparison against base commit d1a214c.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.13%. Comparing base (d1a214c) to head (0a79b48).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #140      +/-   ##
==========================================
+ Coverage   84.82%   85.13%   +0.31%     
==========================================
  Files          77       77              
  Lines        1562     1561       -1     
  Branches      143      143              
==========================================
+ Hits         1325     1329       +4     
- Misses        180      189       +9     
+ Partials       57       43      -14     

see 9 files with indirect coverage changes

[Copilot]

Copilot review overview

🟡 Changes recommended

Release ordering, coverage gating, fork PR reporting, staged-file linting, and Markdown-rule conflicts remain unresolved.

Review effort: Balanced
Findings: 3 · 2 · 1

Open (6)

• Test Suite does not wait for or enforce Coverage Analysis · New
• Fork pull requests fail when publishing with a read-only token · New
• Concurrent releases can assign versions out of merge order · New
• Markdownlint checks working-tree files instead of staged content · New
• Matrix tests rebuild projects instead of reusing build outputs · New
• Markdownlint MD041 conflicts with the repository's H2 heading policy · New

What changed in this PR

Adopts a hardened CI, release, linting, and local quality-gate baseline for IssueTracker.

Changes:

• Consolidates builds, tests, coverage, and reporting into ci.yml.
• Adds automated releases, release blogs, auto-merge, and backfill tooling.
• Pins Actions, standardizes linting, adds hooks, and fixes documentation formatting.

File	Description
tests/​IssueTracker.UI.Tests.Unit/​IssueTracker.UI.Tests.Unit.csproj	Temporarily suppresses bUnit migration warnings.
src/​AppHost/​AppHost.csproj	Temporarily suppresses ASPIRE010.
scripts/​gate.sh	Adds the local lint, build, and test gate.
README.md	Updates badges and documents hook setup.
global.json	Pins the .NET SDK patch band.
docs/​Running-Aspire-Locally.md	Reworks heading hierarchy.
docs/​project-structure.md	Corrects the SDK configuration filename.
docs/​Production-Readiness.md	Reworks heading hierarchy.
docs/​index.md	Adjusts last-updated formatting.
docs/​Health-Checks.md	Reworks heading hierarchy.
docs/​Cache-Strategy.md	Reworks heading hierarchy.
docs/​Aspire.md	Reworks heading hierarchy.
.yamllint.yml	Adds consolidated YAML lint configuration.
.yamllint	Removes the legacy YAML lint configuration.
.markdownlintignore	Removes the legacy ignore file.
.markdownlint.json	Removes the legacy Markdown configuration.
.markdownlint-cli2.jsonc	Adds consolidated Markdown lint configuration.
.gitignore	Ignores local Claude and pytest artifacts.
.github/​workflows/​test.yml	Removes the former test workflow.
.github/​workflows/​release.yml	Adds per-PR semantic releases and blog PRs.
.github/​workflows/​pr-automerge.yml	Adds guarded same-repository PR auto-merge.
.github/​workflows/​main-validation.yml	Removes the superseded validation workflow.
.github/​workflows/​lint-yaml.yml	Pins actions and uses shared YAML configuration.
.github/​workflows/​lint-markdown.yml	Uses pinned markdownlint-cli2 automation.
.github/​workflows/​lint-actions.yml	Adds actionlint, zizmor, and shellcheck.
.github/​workflows/​docs.yml	Removes the explicit Pages workflow.
.github/​workflows/​dependabot-auto-merge.yml	Pins its action and updates formatting.
.github/​workflows/​codeql-analysis.yml	Adds Actions analysis and SHA pinning.
.github/​workflows/​code-metrics.yml	Hardens metrics and PR generation.
.github/​workflows/​ci.yml	Adds build, test discovery, matrix tests, and coverage.
.github/​workflows/​backfill-blog-posts.yml	Adds historical release-blog generation.
.github/​scripts/​tests/​test_release_post.py	Adds release-post generator coverage.
.github/​scripts/​tests/​test_backfill_blog_posts.py	Adds backfill generator coverage.
.github/​scripts/​tests/​conftest.py	Configures Python test imports.
.github/​scripts/​backfill_blog_posts.py	Implements release-blog backfilling.
.github/​hooks/​tests/​pre-push.test.sh	Tests pre-push gate behavior.
.github/​hooks/​pre-push	Enforces branch names and local gates.
.github/​hooks/​pre-commit	Adds staged Markdown linting.
.github/​hooks/​post-checkout	Maintains hook configuration and permissions.
.github/​dependabot.yml	Adds .NET SDK updates.
.github/​agents/​beast.agent.md	Reformats and updates agent guidance.
.copilot/​mcp-config.json	Removes the example MCP configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.