release: FixedWidthParser 2.0.0

.editorconfig

@@ -1,72 +1,93 @@
-# EditorConfig — https://editorconfig.org
-# Top-most file; stops the search here.
 root = true
 
-##########################################
-# All files
-##########################################
 [*]
 charset = utf-8
+# lf, not crlf: every tracked file is committed LF. Demanding crlf here would only hold on Windows,
+# where core.autocrlf converts on checkout and hides the mismatch. See .gitattributes, which pins
+# eol=lf so no contributor's autocrlf setting can change what lands in a blob.
 end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 indent_style = space
 indent_size = 4
 
-[*.{yml,yaml,json,md}]
+[*.{yml,yaml,json,md,csproj,props,targets,slnx}]
 indent_size = 2
 
+# Two trailing spaces are a hard line break in Markdown.
 [*.md]
-trim_trailing_whitespace = false   # trailing spaces are significant (hard line breaks)
+trim_trailing_whitespace = false
 
-[*.{csproj,props,targets,slnx}]
-indent_size = 2
-
-##########################################
-# C# files
-##########################################
 [*.cs]
-indent_size = 4
 max_line_length = 120
 
-# --- Language conventions ---------------------------------------------------
+# The code is block-scoped throughout; switching styles file by file would make every diff a reindent.
 csharp_style_namespace_declarations = block_scoped:suggestion
 csharp_using_directive_placement = outside_namespace:suggestion
 dotnet_sort_system_directives_first = true
 dotnet_separate_import_directive_groups = false
 
-# var usage — prefer explicit types except when obvious from the right-hand side.
 csharp_style_var_for_built_in_types = false:suggestion
 csharp_style_var_when_type_is_apparent = true:suggestion
 csharp_style_var_elsewhere = false:suggestion
 
-# Expression-bodied members.
-csharp_style_expression_bodied_methods = false:suggestion
+# STYLEGUIDE.md: "Every method ... must use a block body. Expression bodies (=>) are forbidden on
+# methods, no matter how short." Properties are exempted here (project preference overrides the
+# guide for the common one-line forwarding getter).
+csharp_style_expression_bodied_methods = false:warning
+csharp_style_expression_bodied_constructors = false:warning
+csharp_style_expression_bodied_operators = false:warning
+csharp_style_expression_bodied_local_functions = false:warning
 csharp_style_expression_bodied_properties = true:suggestion
 csharp_style_expression_bodied_accessors = false:suggestion
+# Accessors (get/set/init) are part of the property exemption: either body form is fine, so IDE0027
+# reports nothing.
+dotnet_diagnostic.IDE0027.severity = none
+
+# STYLEGUIDE.md: "Always use braces on `if`, even single-line bodies. The linter enforces this."
+csharp_prefer_braces = true:warning
+
+# STYLEGUIDE.md ternary rule ("nested ternary" / "branches contain logic" forbidden) has no direct
+# analyzer id; IDE0045/IDE0046 (convert if to/from ternary) would fight that rule, so both are off.
+dotnet_diagnostic.IDE0045.severity = none
+dotnet_diagnostic.IDE0046.severity = none
 
-# Modern C# preferences.
-csharp_prefer_braces = true:suggestion
 csharp_style_prefer_pattern_matching = true:suggestion
 csharp_style_prefer_switch_expression = true:suggestion
 csharp_style_throw_expression = true:suggestion
 csharp_prefer_simple_using_statement = true:suggestion
 csharp_style_prefer_range_operator = true:suggestion
 csharp_style_prefer_index_operator = true:suggestion
 
-# --- Naming: private fields use _camelCase --------------------------------
-dotnet_naming_rule.private_fields_underscore.severity = suggestion
-dotnet_naming_rule.private_fields_underscore.symbols = private_fields
-dotnet_naming_rule.private_fields_underscore.style = underscore_prefix
+dotnet_style_qualification_for_field = false:suggestion
+dotnet_style_qualification_for_property = false:suggestion
+dotnet_style_qualification_for_method = false:suggestion
+dotnet_style_qualification_for_event = false:suggestion
+
+# Naming: private fields _camelCase, private consts PascalCase, everything else PascalCase/camelCase
+# per STYLEGUIDE.md.
+dotnet_naming_style.underscore_camel_case.capitalization = camel_case
+dotnet_naming_style.underscore_camel_case.required_prefix = _
+dotnet_naming_style.pascal_case.capitalization = pascal_case
+
+# Consts first — more specific than the general private-field rule below, so it must win. Rule order
+# matters: the first matching rule applies.
+dotnet_naming_symbols.private_consts.applicable_kinds = field
+dotnet_naming_symbols.private_consts.applicable_accessibilities = private
+dotnet_naming_symbols.private_consts.required_modifiers = const
+
+dotnet_naming_rule.private_consts_pascal_case.symbols = private_consts
+dotnet_naming_rule.private_consts_pascal_case.style = pascal_case
+dotnet_naming_rule.private_consts_pascal_case.severity = warning
 
 dotnet_naming_symbols.private_fields.applicable_kinds = field
 dotnet_naming_symbols.private_fields.applicable_accessibilities = private
+dotnet_naming_symbols.private_fields.required_modifiers =
 
-dotnet_naming_style.underscore_prefix.required_prefix = _
-dotnet_naming_style.underscore_prefix.capitalization = camel_case
+dotnet_naming_rule.private_fields_underscore_camel_case.symbols = private_fields
+dotnet_naming_rule.private_fields_underscore_camel_case.style = underscore_camel_case
+dotnet_naming_rule.private_fields_underscore_camel_case.severity = warning
 
-# --- 'this.' qualification --------------------------------------------------
-dotnet_style_qualification_for_field = false:suggestion
-dotnet_style_qualification_for_property = false:suggestion
-dotnet_style_qualification_for_method = false:suggestion
-dotnet_style_qualification_for_event = false:suggestion
+dotnet_diagnostic.MA0051.severity = warning
+MA0051.maximum_lines_per_method = 90
+MA0051.maximum_statements_per_method = 50

.gitattributes

@@ -0,0 +1,4 @@
+# Line endings are pinned here rather than left to each contributor's core.autocrlf, so what lands in
+# a blob never depends on who committed it. Every tracked text file is already LF, and
+# .editorconfig's end_of_line matches.
+* text=auto eol=lf

.github/dependabot.yml

@@ -21,8 +21,15 @@ updates:
       test:
         patterns:
           - "xunit*"
-          - "Microsoft.NET.Test.Sdk"
-          - "coverlet.*"
+          - "Microsoft.Testing.*"
+          - "CsCheck"
+      # The libraries the comparison benchmarks measure against.
+      benchmarks:
+        patterns:
+          - "BenchmarkDotNet"
+          - "FileHelpers"
+          - "FlatFiles"
+          - "RecordParser"
     labels:
       - dependencies
 

.github/pull_request_template.md

@@ -15,7 +15,9 @@
 - [ ] Tests added/updated for the change
 - [ ] `dotnet build --configuration Release` is warning-clean
 - [ ] `dotnet test --configuration Release` passes
-- [ ] Public API changes are documented (XML docs + README if relevant)
+- [ ] Public API changes are documented (XML docs, plus `docs/guide/` if relevant) and recorded in `PublicAPI.Unshipped.txt`
+- [ ] User-visible changes are in `CHANGELOG.md`
+- [ ] Native, Python or C++ changes: the Python, C and C++ tests pass (see CONTRIBUTING.md)
 - [ ] For performance-sensitive changes: benchmark numbers included below
 
 ## Benchmark impact (if applicable)

.github/scripts/promote_public_api.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Moves every entry out of each PublicAPI.Unshipped.txt into its PublicAPI.Shipped.txt.
+
+Run after a release ships: everything that was "unshipped" at release time is now part of
+the public API contract. Operates on every src/*/PublicAPI.Unshipped.txt.
+
+Exit codes: 0 = promoted something, 2 = nothing needed promoting (not an error — the caller
+skips the rest of the job), 1 = an actual failure (an uncaught exception, same as Python's
+default for any unhandled error). 2 is deliberately not 1 - an uncaught exception used
+to exit 1 exactly like the intentional "nothing to promote" case, so release.yml's `if
+python3 ...; then changed=true; else changed=false; fi` silently treated a crash (missing
+file, permission error) the same as a no-op success, disarming the next release's
+breaking-change detection instead of failing the job.
+"""
+
+import glob
+import os
+import sys
+
+HEADER = "#nullable enable"
+
+
+def read_entries(path):
+    with open(path, encoding="utf-8") as f:
+        return [line.strip() for line in f if line.strip() and line.strip() != HEADER]
+
+
+def write_entries(path, entries):
+    with open(path, "w", encoding="utf-8", newline="\n") as f:
+        f.write(HEADER + "\n")
+        f.writelines(entry + "\n" for entry in sorted(entries))
+
+
+REMOVED_PREFIX = "*REMOVED*"
+
+
+def promote_one(unshipped_path, shipped_path):
+    """Applies unshipped_path's entries onto shipped_path and clears unshipped_path.
+
+    A plain entry is added to Shipped. A `*REMOVED*Foo` entry deletes the plain `Foo` entry
+    from Shipped (an API removal is meaningful only for one release cycle) and is itself
+    discarded rather than copied - RS0024 forbids a *REMOVED* line inside Shipped.txt, since
+    Shipped is the current API surface, not a removal history.
+
+    Returns the number of entries read from unshipped_path (0 if there was nothing to do).
+    """
+    new_entries = read_entries(unshipped_path)
+    if not new_entries:
+        return 0
+
+    shipped_entries = set(read_entries(shipped_path)) if os.path.exists(shipped_path) else set()
+    for entry in new_entries:
+        if entry.startswith(REMOVED_PREFIX):
+            shipped_entries.discard(entry[len(REMOVED_PREFIX):])
+        else:
+            shipped_entries.add(entry)
+
+    write_entries(shipped_path, shipped_entries)
+    write_entries(unshipped_path, [])
+    return len(new_entries)
+
+
+def main():
+    unshipped_files = sorted(glob.glob("src/*/PublicAPI.Unshipped.txt"))
+    if not unshipped_files:
+        print("No src/*/PublicAPI.Unshipped.txt files found.")
+        return 2
+
+    promoted_any = False
+    for unshipped_path in unshipped_files:
+        shipped_path = unshipped_path.replace("Unshipped.txt", "Shipped.txt")
+        count = promote_one(unshipped_path, shipped_path)
+        if count == 0:
+            print(f"{unshipped_path}: nothing to promote.")
+            continue
+        print(f"{unshipped_path}: promoted {count} entries to {shipped_path}.")
+        promoted_any = True
+
+    return 0 if promoted_any else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/test_promote_public_api.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Unit tests for promote_public_api.py.
+
+Run: python3 .github/scripts/test_promote_public_api.py
+"""
+
+import os
+import tempfile
+import unittest
+
+import promote_public_api as promote
+
+
+class PromoteTests(unittest.TestCase):
+    def _write(self, path, lines):
+        with open(path, "w", encoding="utf-8", newline="\n") as f:
+            f.write(promote.HEADER + "\n")
+            f.writelines(line + "\n" for line in lines)
+
+    def _read(self, path):
+        with open(path, encoding="utf-8") as f:
+            return {line.strip() for line in f if line.strip() and line.strip() != promote.HEADER}
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.shipped = os.path.join(self._tmp.name, "PublicAPI.Shipped.txt")
+        self.unshipped = os.path.join(self._tmp.name, "PublicAPI.Unshipped.txt")
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_plain_entry_is_added_to_shipped(self):
+        self._write(self.shipped, ["Foo.Bar() -> void"])
+        self._write(self.unshipped, ["Foo.Baz() -> void"])
+
+        promote.promote_one(self.unshipped, self.shipped)
+
+        self.assertEqual(self._read(self.shipped), {"Foo.Bar() -> void", "Foo.Baz() -> void"})
+        self.assertEqual(self._read(self.unshipped), set())
+
+    def test_removed_entry_deletes_the_plain_entry_from_shipped(self):
+        self._write(self.shipped, ["Foo.Bar() -> void", "Foo.Baz() -> void"])
+        self._write(self.unshipped, ["*REMOVED*Foo.Bar() -> void"])
+
+        promote.promote_one(self.unshipped, self.shipped)
+
+        self.assertEqual(self._read(self.shipped), {"Foo.Baz() -> void"})
+        self.assertEqual(self._read(self.unshipped), set())
+
+    def test_removed_entry_is_never_written_to_shipped(self):
+        self._write(self.shipped, ["Foo.Bar() -> void"])
+        self._write(self.unshipped, ["*REMOVED*Foo.Bar() -> void"])
+
+        promote.promote_one(self.unshipped, self.shipped)
+
+        for entry in self._read(self.shipped):
+            self.assertFalse(entry.startswith("*REMOVED*"), entry)
+
+    def test_removed_entry_with_no_matching_shipped_entry_is_a_noop_delete(self):
+        self._write(self.shipped, ["Foo.Bar() -> void"])
+        self._write(self.unshipped, ["*REMOVED*Foo.NeverShipped() -> void"])
+
+        promote.promote_one(self.unshipped, self.shipped)
+
+        self.assertEqual(self._read(self.shipped), {"Foo.Bar() -> void"})
+
+    def test_mixed_add_and_remove_in_the_same_promotion(self):
+        self._write(self.shipped, ["Foo.Old() -> void"])
+        self._write(self.unshipped, ["*REMOVED*Foo.Old() -> void", "Foo.New() -> void"])
+
+        promote.promote_one(self.unshipped, self.shipped)
+
+        self.assertEqual(self._read(self.shipped), {"Foo.New() -> void"})
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/audit.yml

@@ -0,0 +1,48 @@
+name: Dependency audit
+
+# A newly published advisory flags a package without any change here, so the audit runs weekly as well as when
+# the dependencies change.
+on:
+  pull_request:
+    branches: [ master, develop ]
+    paths:
+      - '**/*.csproj'
+      - 'Directory.Build.props'
+      - 'global.json'
+      - '.github/workflows/audit.yml'
+  push:
+    branches: [ master ]
+    paths:
+      - '**/*.csproj'
+      - 'Directory.Build.props'
+      - 'global.json'
+      - '.github/workflows/audit.yml'
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+
+      - name: Restore
+        run: dotnet restore FixedWidthParser.slnx
+
+      - name: Check for vulnerable packages
+        run: |
+          output=$(dotnet list FixedWidthParser.slnx package --vulnerable --include-transitive)
+          echo "$output"
+          if echo "$output" | grep -q -E '\b(High|Critical)\b'; then
+            echo "::error::High or Critical severity vulnerability found in dependencies."
+            exit 1
+          fi