Sync upstream 1.9.0 and preserve fork Home Assistant advice

.github/CI.md

@@ -1,8 +1,8 @@
 # Pull request CI
 
 The local workflow `workflows/pr-build-test.yml` restores and builds the application and runs the
-existing regression suites on GitHub-hosted Windows 2025. The fork's PR #8 run passed on
-20 October 2026. Logs and test results are retained for seven days.
+existing regression suites on GitHub-hosted Windows 2025. Publication is separately authorized;
+these local definitions have not run on GitHub. Logs and test results are retained for seven days.
 Official checkout, setup-dotnet, and upload-artifact actions are pinned to immutable commit hashes.
 
 It uses only `pull_request`, `contents: read`, and checkout with persisted credentials disabled.
@@ -14,22 +14,3 @@ The engine console runner runs on both net48 and net10.0. The speed-test console
 net48 with local fixtures only, without --worker or --internet. They use dotnet run because they
 are executable regression suites. Isolated WPF checks are distinct from interactive UI automation.
 The build SDK is .NET 10; the application and desktop runner continue targeting net48.
-
-## Release-channel verification
-
-`workflows/release-sync.yml` checks the upstream publisher's GitHub release, Chocolatey and
-WinGet channels. Its `verify` job runs only in `SteveTheKiller/KillerScan`, for both scheduled
-and manual invocations. Development forks intentionally skip this job, even if they have
-their own releases: the configured marketplace identifiers belong to the upstream publisher.
-This does not disable `pr-build-test.yml` or change any publishing workflow.
-
-On 23 October 2026, investigation found eleven scheduled failures in the fork after the
-upstream sync: the fork has no published releases, so `/releases/latest` returned HTTP 404.
-The script previously continued to an empty release tag and obscured the original error.
-The job guard prevents the inapplicable fork check; failed release API calls now stop with
-an explicit metadata-fetch error. Missing releases in the publisher's repository remain failures.
-
-Validation: actionlint and PowerShell syntax checks, plus isolated release-lookup cases
-(latest, explicit version, API failure and invalid tag). The patched workflow must reach
-the fork's default branch before scheduled runs use the guard. Old failed runs remain in
-history; rerunning their old revisions does not test this fix. No package was published.

.github/workflows/chocolatey-release.yml

@@ -9,27 +9,56 @@ on:
         description: 'Release tag (e.g. v1.0.0)'
         required: true
 
+# Nothing here writes to the repository; the token is read-only and not left in the checkout.
+permissions:
+  contents: read
+
 jobs:
   push:
+    # A prerelease is not published to Chocolatey. The manual retry path still runs.
+    if: >-
+      github.repository == 'SteveTheKiller/KillerScan' &&
+      (github.event_name == 'workflow_dispatch' || !github.event.release.prerelease)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      # The released tag's nuspec and install script, also for a manual retry of an older tag.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}
+          persist-credentials: false
 
       - name: Build and push Chocolatey package
         shell: pwsh
         env:
           CHOCO_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          # Event values reach the script as data, never as script text.
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          $releaseTag = if ("${{ github.event_name }}" -eq "workflow_dispatch") { "${{ github.event.inputs.tag }}" } else { "${{ github.event.release.tag_name }}" }
+          $releaseTag = if ($env:EVENT_NAME -eq 'workflow_dispatch') { $env:INPUT_TAG } else { $env:RELEASE_TAG }
+          if ($releaseTag -notmatch '^v\d+\.\d+\.\d+$') { throw "Release tag '$releaseTag' is not vMAJOR.MINOR.PATCH." }
           $version = $releaseTag.TrimStart('v')
-          $exeUrl  = "https://github.com/SteveTheKiller/KillerScan/releases/download/$releaseTag/KillerScan.exe"
+          $base    = "https://github.com/SteveTheKiller/KillerScan/releases/download/$releaseTag"
+          $exeUrl  = "$base/KillerScan.exe"
 
           # Download release EXE and compute hash
           Write-Host "Downloading $exeUrl..."
           Invoke-WebRequest -Uri $exeUrl -OutFile "$env:RUNNER_TEMP\KillerScan.exe"
           $hash = (Get-FileHash "$env:RUNNER_TEMP\KillerScan.exe" -Algorithm SHA256).Hash
           Write-Host "SHA256: $hash"
 
+          # The package pins whatever was downloaded, so check it is the release release.ps1 built:
+          # the published checksum and a valid signature from the release certificate.
+          $sums = (Invoke-WebRequest -Uri "$base/SHA256SUMS.txt" -UseBasicParsing).Content
+          if ($sums -is [byte[]]) { $sums = [Text.Encoding]::UTF8.GetString($sums) }
+          $listed = [regex]::Match($sums, '(?m)^KillerScan\.exe\s+([0-9A-Fa-f]{64})\s*$').Groups[1].Value
+          if ($listed -ne $hash) { throw "KillerScan.exe does not match SHA256SUMS.txt (listed '$listed', downloaded $hash)." }
+          $signature = Get-AuthenticodeSignature "$env:RUNNER_TEMP\KillerScan.exe"
+          if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.GetNameInfo([Security.Cryptography.X509Certificates.X509NameType]::SimpleName, $false) -ne 'Open Source Developer Stephen Riley') {
+              throw "KillerScan.exe is not validly signed by the release certificate ($($signature.Status), $($signature.SignerCertificate.Subject))."
+          }
+
           # Stamp version and hash into package files
           $nuspec  = "choco\killerscan.nuspec"
           $install = "choco\tools\chocolateyInstall.ps1"
@@ -99,6 +128,7 @@ jobs:
           $feed = "https://community.chocolatey.org/api/v2/Packages(Id='killerscan',Version='$env:CHOCO_VERSION')"
           $repushed = $false
           $pendingSinceRepush = $false
+          $lastKnownState = ''
           $deadline = (Get-Date).AddMinutes(160)
           while ((Get-Date) -lt $deadline) {
               Start-Sleep -Seconds 300
@@ -109,6 +139,7 @@ jobs:
                   continue
               }
               $state = [regex]::Match($entry, '<d:PackageValidationResultStatus>(\w+)</d:PackageValidationResultStatus>').Groups[1].Value
+              if ($state) { $lastKnownState = $state }
               Write-Host "$(Get-Date -Format HH:mm:ss) validation: $(if ($state) { $state } else { 'not shown' })"
               if ($state -like 'Pass*') { exit 0 }
               if ($repushed -and $state -and $state -notlike 'Fail*') { $pendingSinceRepush = $true }
@@ -122,6 +153,9 @@ jobs:
                   throw "Chocolatey validation failed twice. See $page"
               }
           }
+          if ($lastKnownState -like 'Fail*') {
+              throw "Chocolatey validation remained failed after re-push. See $page"
+          }
           # Chocolatey's queue often takes longer than this. The package is already pushed, so a
           # validation that is still pending is a warning, not a failed release.
           Write-Host "::warning::Chocolatey validation was still pending after 160 minutes. The package was pushed. See $page"

.github/workflows/nuget-engine-release.yml

@@ -24,8 +24,8 @@ concurrency:
 jobs:
   publish:
     if: >-
-      (github.event_name == 'release' && !github.event.release.prerelease) ||
-      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+      github.repository == 'SteveTheKiller/KillerScan' &&
+      ((github.event_name == 'release' && !github.event.release.prerelease) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
     # Windows, so the net48 build and its regression run sit beside net10.0.
     runs-on: windows-latest
     permissions:
@@ -41,7 +41,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -62,6 +62,22 @@ jobs:
             if ($LASTEXITCODE -ne 0) { throw 'Repair commit must be on main.' }
             git diff --exit-code $tag $source -- Engine Resources/oui.txt ':!Engine/KillerScan.Engine.csproj' ':!Engine/README.md' ':!Engine/icon.png'
             if ($LASTEXITCODE -ne 0) { throw 'Engine code differs from the released source.' }
+            # The project file decides what is compiled and which dependency versions ship, so only
+            # its package metadata may change in a repair. Everything else must match the tag.
+            $metadata = 'Title', 'Authors', 'Copyright', 'Description', 'PackageTags', 'PackageProjectUrl',
+              'RepositoryUrl', 'RepositoryType', 'PackageReleaseNotes'
+            function Get-BuildShape([string]$ref) {
+              [xml]$project = (git show "$($ref):Engine/KillerScan.Engine.csproj") -join "`n"
+              if ($LASTEXITCODE -ne 0) { throw "The engine project is missing at $ref." }
+              foreach ($name in $metadata) {
+                foreach ($node in @($project.SelectNodes("/Project/PropertyGroup/$name"))) { [void]$node.ParentNode.RemoveChild($node) }
+              }
+              foreach ($node in @($project.SelectNodes('//comment()'))) { [void]$node.ParentNode.RemoveChild($node) }
+              $project.OuterXml
+            }
+            if ((Get-BuildShape $tag) -ne (Get-BuildShape $source)) {
+              throw 'The engine project differs from the released source beyond package metadata.'
+            }
           }
           git checkout --detach $source
           if ($LASTEXITCODE -ne 0) { throw 'Release source checkout failed.' }
@@ -73,7 +89,7 @@ jobs:
           }
           "version=$version" >> $env:GITHUB_OUTPUT
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
 
@@ -82,6 +98,8 @@ jobs:
 
       - name: Test
         run: |
+          # The hosted image includes IIS, which can reserve the loopback HTTP fixture's port.
+          Get-Service W3SVC, WAS -ErrorAction SilentlyContinue | Stop-Service -Force -ErrorAction Stop
           dotnet build tests/KillerScan.Engine.Tests/KillerScan.Engine.Tests.csproj -c Release --no-restore
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           foreach ($tfm in 'net48', 'net10.0') {
@@ -93,15 +111,15 @@ jobs:
         run: dotnet pack Engine/KillerScan.Engine.csproj -c Release -o artifacts/nuget
 
       - name: Preserve packages
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: engine-${{ steps.release.outputs.version }}
           path: artifacts/nuget/*
           if-no-files-found: error
 
       - name: Sign in to NuGet
         id: nuget-login
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         with:
           user: StevetheKiller
 

.github/workflows/pr-build-test.yml

@@ -26,26 +26,33 @@ jobs:
             project: KillerScan.csproj
             mode: build
             framework: ''
+            suite: ''
           - name: engine-net48
             project: tests/KillerScan.Engine.Tests/KillerScan.Engine.Tests.csproj
             mode: console
             framework: 'net48'
+            suite: engine
           - name: engine-net10
             project: tests/KillerScan.Engine.Tests/KillerScan.Engine.Tests.csproj
             mode: console
             framework: 'net10.0'
+            suite: engine
           - name: speed-test-fixtures
             project: tests/SpeedTest.Tests/SpeedTest.Tests.csproj
             mode: console
             framework: 'net48'
+            suite: app
     name: ${{ matrix.name }}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
+      - name: Isolate fork test data
+        run: |
+          "KILLERSCAN_DATA_ROOT=$env:RUNNER_TEMP\KillerScan-ci-data" >> $env:GITHUB_ENV
       - name: Restore and build
         env:
           PROJECT: ${{ matrix.project }}
@@ -59,28 +66,43 @@ jobs:
           if ($env:FRAMEWORK) { $buildArgs += @('--framework', $env:FRAMEWORK) }
           & dotnet @buildArgs 2>&1 | Tee-Object ci-results/build.log
           if ($LASTEXITCODE -ne 0) { throw 'Build failed. See build.log.' }
-      - name: Run tests
-        if: matrix.mode == 'test'
-        env:
-          PROJECT: ${{ matrix.project }}
-        run: |
-          # WPF FontCache requires WINDIR even for isolated resource tests.
-          if (!$env:WINDIR) { $env:WINDIR = $env:SYSTEMROOT }
-          dotnet test $env:PROJECT --no-build --no-restore --configuration Release --logger 'trx;LogFileName=tests.trx' --results-directory ci-results --verbosity normal 2>&1 | Tee-Object ci-results/test.log
-          if ($LASTEXITCODE -ne 0) { throw 'Tests failed. See test.log and tests.trx.' }
       - name: Run console regression checks
         if: matrix.mode == 'console'
         env:
           PROJECT: ${{ matrix.project }}
           FRAMEWORK: ${{ matrix.framework }}
         run: |
           if (!$env:WINDIR) { $env:WINDIR = $env:SYSTEMROOT }
+          Get-Service W3SVC, WAS -ErrorAction SilentlyContinue | Stop-Service -Force -ErrorAction Stop
           # No --worker or --internet: SpeedTest uses local fixtures only.
           dotnet run --project $env:PROJECT --framework $env:FRAMEWORK --configuration Release --no-build --no-restore 2>&1 | Tee-Object ci-results/console.log
           if ($LASTEXITCODE -ne 0) { throw 'Regression checks failed. See console.log.' }
+      # The runners' flag-only groups. tests/suites.json lists every flag, and the script fails
+      # when a runner gains one that is not listed, so a new suite cannot go unrun.
+      - name: Run focused regression suites
+        if: matrix.suite != ''
+        env:
+          SUITE: ${{ matrix.suite }}
+          FRAMEWORK: ${{ matrix.framework }}
+        run: |
+          if (!$env:WINDIR) { $env:WINDIR = $env:SYSTEMROOT }
+          pwsh -NoProfile -NonInteractive -File ./tests/Run-FocusedSuites.ps1 -Suite $env:SUITE -Framework $env:FRAMEWORK -Configuration Release 2>&1 | Tee-Object ci-results/focused.log
+          if ($LASTEXITCODE -ne 0) { throw 'Focused suites failed. See focused.log.' }
+      - name: Check the suite inventory and the PowerShell module contract
+        if: matrix.name == 'application'
+        run: |
+          pwsh -NoProfile -NonInteractive -File ./tests/Release.Tests/PackageChecksum.Tests.ps1
+          if ($LASTEXITCODE -ne 0) { throw 'Package checksum response contract failed.' }
+          pwsh -NoProfile -NonInteractive -File ./tests/Run-FocusedSuites.ps1 -CheckOnly
+          if ($LASTEXITCODE -ne 0) { throw 'tests/suites.json does not match the test runners.' }
+          $exe = 'bin/Release/net48/KillerScan.exe'
+          pwsh -NoProfile -File tests/Module/ModuleContract.ps1 -Exe $exe 2>&1 | Tee-Object ci-results/module-pwsh.log
+          if ($LASTEXITCODE -ne 0) { throw 'Module contract failed on PowerShell 7. See module-pwsh.log.' }
+          powershell -NoProfile -ExecutionPolicy Bypass -File tests/Module/ModuleContract.ps1 -Exe $exe 2>&1 | Tee-Object ci-results/module-desktop.log
+          if ($LASTEXITCODE -ne 0) { throw 'Module contract failed on Windows PowerShell 5.1. See module-desktop.log.' }
       - name: Retain failure diagnostics and test results
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ci-${{ matrix.name }}
           path: ci-results/