Update to .NET 10, adapt code style to Steeltoe conventions

.config/dotnet-tools.json

@@ -0,0 +1,20 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "jetbrains.resharper.globaltools": {
+      "version": "2026.1.3",
+      "commands": [
+        "jb"
+      ],
+      "rollForward": false
+    },
+    "regitlint": {
+      "version": "6.3.13",
+      "commands": [
+        "regitlint"
+      ],
+      "rollForward": false
+    }
+  }
+}

.github/workflows/build-and-stage.yml

@@ -24,9 +24,8 @@ jobs:
     name: Build and push image
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
-      with:
-        fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
+    - name: Git checkout
+      uses: actions/checkout@v6
 
     - name: Detect template source from PR body
       env:

.github/workflows/scan-vulnerable-dependencies.yml

@@ -0,0 +1,81 @@
+name: Scan vulnerable dependencies
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+    - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  DOTNET_NOLOGO: true
+  SOLUTION_FILE: 'Steeltoe.NetCoreToolService.slnx'
+
+jobs:
+  scan:
+    name: Scan
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: |
+          10.0.*
+
+    - name: Git checkout
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+
+    - name: Report vulnerable dependencies
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        $PSNativeCommandUseErrorActionPreference = $true
+
+        $output = dotnet list ${{ env.SOLUTION_FILE }} package --vulnerable --include-transitive --format json --output-version 1 2>&1
+        $text = ($output | Out-String).TrimEnd()
+        $json = $text | ConvertFrom-Json
+        $hasVulnerabilities = $false
+
+        foreach ($project in $json.projects) {
+          if (-not $project.frameworks) {
+            continue
+          }
+
+          $isTestProject = $project.path -like '*/test/*'
+
+          foreach ($framework in $project.frameworks) {
+            foreach ($package in $framework.topLevelPackages) {
+              $hasVulnerabilities = $true
+
+              foreach ($vulnerability in $package.vulnerabilities) {
+                Write-Host "$($project.path) ($($framework.framework)): top-level $($package.id) $($package.resolvedVersion) – $($vulnerability.severity): $($vulnerability.advisoryurl)"
+              }
+            }
+
+            if (-not $isTestProject) {
+              foreach ($package in $framework.transitivePackages) {
+                $hasVulnerabilities = $true
+
+                foreach ($vulnerability in $package.vulnerabilities) {
+                  Write-Host "$($project.path) ($($framework.framework)): transitive $($package.id) $($package.resolvedVersion) – $($vulnerability.severity): $($vulnerability.advisoryurl)"
+                }
+              }
+            }
+          }
+        }
+
+        if ($hasVulnerabilities) {
+          exit 1
+        }

.github/workflows/verify-code-style.yml

@@ -0,0 +1,68 @@
+name: Cleanup Code
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+    - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_CLI_TELEMETRY_OPTOUT: 1
+  DOTNET_NOLOGO: true
+  SOLUTION_FILE: 'Steeltoe.NetCoreToolService.slnx'
+
+jobs:
+  verify:
+    name: Verify Code Style
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: |
+          10.0.*
+
+    - name: Git checkout
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+        fetch-depth: 2
+
+    - name: Restore tools
+      run: dotnet tool restore --verbosity minimal
+
+    - name: Restore packages
+      run: dotnet restore ${{ env.SOLUTION_FILE }} /p:Configuration=Release /p:NuGetAudit=false --verbosity minimal
+
+    - name: Build
+      run: dotnet build ${{ env.SOLUTION_FILE }} --no-restore --configuration Release /p:RunAnalyzers=false
+
+    - name: CleanupCode (on PR diff)
+      if: ${{ github.event_name == 'pull_request' }}
+      shell: pwsh
+      run: |
+        # Not using the environment variables for SHAs, because they may be outdated. This may happen on force-push after the build is queued, but before it starts.
+        # The below works because HEAD is detached (at the merge commit), so HEAD~1 is at the base branch. When a PR contains no commits, this job will not run.
+        $headCommitHash = git rev-parse HEAD
+        $baseCommitHash = git rev-parse HEAD~1
+
+        Write-Output "Running code cleanup on commit range $baseCommitHash..$headCommitHash in pull request."
+        dotnet jb cleanupcode --version
+        dotnet regitlint -s $env:SOLUTION_FILE --print-command --skip-tool-check --max-runs=5 --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --no-updates --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN -f commits -a $headCommitHash -b $baseCommitHash --fail-on-diff --print-diff
+
+    - name: CleanupCode (on branch)
+      if: ${{ github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch' }}
+      shell: pwsh
+      run: |
+        Write-Output 'Running code cleanup on all files.'
+        dotnet jb cleanupcode --version
+        dotnet regitlint -s $env:SOLUTION_FILE --print-command --skip-tool-check --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --no-updates --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN --fail-on-diff --print-diff

Directory.Build.props

@@ -11,6 +11,7 @@
     <GenerateAssemblyProductAttribute>false</GenerateAssemblyProductAttribute>
     <GenerateNeutralResourcesLanguageAttribute>false</GenerateNeutralResourcesLanguageAttribute>
     <IsPackable>false</IsPackable>
+    <VersionPrefix>1.1.0</VersionPrefix>
   </PropertyGroup>
 
   <PropertyGroup>
@@ -47,7 +48,6 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Nerdbank.GitVersioning" Version="$(NerdbankVersion)" PrivateAssets="All" />
     <PackageReference Include="SonarAnalyzer.CSharp" Version="$(SonarAnalyzerVersion)" PrivateAssets="All" />
     <PackageReference Include="StyleCop.Analyzers" Version="$(StyleCopVersion)" PrivateAssets="All" />
   </ItemGroup>

Dockerfile

@@ -1,8 +1,7 @@
-
 FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine AS build
 WORKDIR /source
 COPY . .
-RUN dotnet restore /p:Configuration=Release
+RUN dotnet restore /p:Configuration=Release /p:NuGetAudit=false
 RUN dotnet build --no-restore --configuration Release
 RUN dotnet test --no-build --configuration Release
 RUN dotnet publish --no-build src/NetCoreToolService --output /srv
@@ -15,5 +14,6 @@ COPY --from=build /srv .
 COPY install-template.sh /srv/install-template.sh
 RUN chmod +x /srv/install-template.sh
 RUN /srv/install-template.sh
+ENV DOTNET_ENVIRONMENT=Docker
 ENV HTTP_PORTS=8080
 ENTRYPOINT ["dotnet", "Steeltoe.NetCoreToolService.dll"]

Version.props

@@ -11,7 +11,6 @@
     <MicrosoftAspNetCoreMvcTestingVersion>10.0.*</MicrosoftAspNetCoreMvcTestingVersion>
     <MicrosoftNetTestSdkVersion>18.6.*</MicrosoftNetTestSdkVersion>
     <MoqVersion>4.20.69</MoqVersion>
-    <NerdbankVersion>3.9.*</NerdbankVersion>
     <ScalarVersion>2.16.*</ScalarVersion>
     <SonarAnalyzerVersion>10.25.0.139117</SonarAnalyzerVersion>
     <SteeltoeVersion>4.2.*</SteeltoeVersion>

cleanupcode.ps1

@@ -0,0 +1,37 @@
+#Requires -Version 7.4
+
+# This script reformats (part of) the codebase to make it compliant with our coding guidelines.
+
+param(
+    # Git branch name or base commit hash to reformat only the subset of changed files. Omit for all files.
+    [string] $revision
+)
+
+$ErrorActionPreference = "Stop"
+$PSNativeCommandUseErrorActionPreference = $true
+$solutionFile = 'Steeltoe.NetCoreToolService.slnx'
+
+dotnet tool restore
+dotnet restore $solutionFile /p:NuGetAudit=false
+dotnet build $solutionFile --no-restore --configuration Release /p:RunAnalyzers=false
+
+if ($revision) {
+    $headCommitHash = git rev-parse HEAD
+    $baseCommitHash = git rev-parse $revision
+
+    if ($baseCommitHash -eq $headCommitHash) {
+        Write-Output "Running code cleanup on staged/unstaged files."
+        dotnet jb cleanupcode --version
+        dotnet regitlint -s $solutionFile --print-command --skip-tool-check --max-runs=5 --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --no-updates --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN -f staged,modified
+    }
+    else {
+        Write-Output "Running code cleanup on commit range $baseCommitHash..$headCommitHash, including staged/unstaged files."
+        dotnet jb cleanupcode --version
+        dotnet regitlint -s $solutionFile --print-command --skip-tool-check --max-runs=5 --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --no-updates --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN -f staged,modified,commits -a $headCommitHash -b $baseCommitHash
+    }
+}
+else {
+    Write-Output "Running code cleanup on all files."
+    dotnet jb cleanupcode --version
+    dotnet regitlint -s $solutionFile --print-command --skip-tool-check --jb --dotnetcoresdk=$(dotnet --version) --jb-profile="Steeltoe Full Cleanup" --jb --no-updates --jb --properties:Configuration=Release --jb --properties:RunAnalyzers=false --jb --properties:NuGetAudit=false --jb --verbosity=WARN
+}

docker-compose.yaml

@@ -1,7 +1,5 @@
 services:
   net-core-tool-service:
     build: .
-    environment:
-      DOTNET_ENVIRONMENT: Development
     ports:
       - "1922:8080"

src/NetCoreToolService/AsyncLock.cs

@@ -0,0 +1,29 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the Apache 2.0 License.
+// See the LICENSE file in the project root for more information.
+
+namespace Steeltoe.NetCoreToolService;
+
+internal sealed class AsyncLock : IDisposable
+{
+    private readonly SemaphoreSlim _semaphore = new(1, 1);
+
+    public async Task<IDisposable> AcquireAsync()
+    {
+        await _semaphore.WaitAsync();
+        return new ReleaseOnDispose(this);
+    }
+
+    public void Dispose()
+    {
+        _semaphore.Dispose();
+    }
+
+    private sealed class ReleaseOnDispose(AsyncLock owner) : IDisposable
+    {
+        public void Dispose()
+        {
+            owner._semaphore.Release();
+        }
+    }
+}