[tomasr78]

Moves the library from GitFlow (develop → master, hand-made "build 3.1.x" commits, tags pushed by hand) to trunk-based development on a single main, where merging builds but never publishes. A release is a GitHub Release v{semver}, because nuget.org versions are public and permanent. The first release through it is v3.1.19, which carries the security fix below.

Security fix

Microsoft.OpenApi.Readers 1.6.23 → 1.6.31 (GHSA-7pxr-59rr-hqj2, high: YAML alias-expansion DoS, patched in 1.6.30). It is the parser behind ConverterCatalog and GetConverterInfo, so it stays. Checked against the live /info/openapi: the catalog's full output (328 converters, 29 tags, search results) is byte-identical between 1.6.23 and 1.6.31. The nuspec diff against the published 3.1.18 shows only the version, the dependency, and the metadata changes listed below.

Pipeline

• build.yml (new, job build = the required check): on every PR to main and every push to main, it restores, builds the library and all 21 examples, and packs ConvertApi 0.0.0-ci.{run}.g{sha} as a 14-day artifact. Nothing is published.
• publish.yml (replaces release.yml): runs on release: published in the nuget environment.
  • Refuses any publisher or re-runner other than tomasr78.
  • Requires a SemVer tag (v3.1.19, v3.2.0-preview.1). The pre-release tick must match the version.
  • A stable version must be on main. Pre-releases may come from any branch.
  • Fails if nuget.org has ever had the version.
  • Packs with -p:Version=${tag#v}, checks that the nupkg records the version and the commit, and pushes without --skip-duplicate. Then it waits until nuget.org serves the package.
  • Ready for nuget.org Trusted Publishing: setting the repo variable NUGET_USER switches from the NUGET_API_KEY secret to NuGet/login (OIDC).
• Actions are pinned to commit SHAs (checkout v7.0.1, setup-dotnet v6.0.0, upload-artifact v7.0.1, NuGet/login v1.2.0), replacing checkout@master / setup-dotnet@v1. global.json pins the SDK to the 10.0.4xx band, patch roll-forward only.
• The build now fails on any high or critical NuGet advisory, direct or transitive (NU1903/NU1904 as errors). This PR's Microsoft.OpenApi.Readers 1.6.23 fails exactly that way.
• The csproj version is a 0.0.0-local placeholder. GeneratePackageOnBuild, AssemblyVersion, FileVersion and PackageVersion are gone, because they come from the tag.
• Removed Dockerfile, an old manual publish path on the .NET Core 3.1 SDK image.

Package metadata

• Description: ".NET Standard 2.0+ / .NET Core 5-9" → "targets .NET Standard 2.0, so it runs on .NET Framework 4.6.2+ and every modern .NET".
• RepositoryUrl now points to convertapi-library-dotnet.
• Release notes link to GitHub Releases instead of the stale "-dev snapshot" text.
• Copyright updated to 2026.
• A .snupkg symbol package is published alongside.
• README links point to convertapi-library-dotnet/tree/main.

Repository changes that go with it (separate, need Tomas's OK)

master → main rename (GitHub redirects the web tree/master links used by ca-web docs); delete develop and release/3.1.6 (neither has commits outside master); repo ruleset for main (merge commits only, build required, admin bypass); v* tag ruleset (admins only); nuget environment limited to v* tags.

build.yml triggers on main, so the check first runs once master is renamed and this PR is retargeted.

See RELEASING.md for how to release.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.