Project initialization

.github/CONTRIBUTING.md

@@ -0,0 +1,66 @@
+# How to contribute
+
+We would like to start with saying thank you for wanting to contribute to the X-Splinter codebase. We want to keep it as easy as possible to contribute changes that get things working in your environment. There are a few guidelines that we need contributors to follow so that we have a chance of keeping on top of things.
+
+- [Making Changes](#making-changes)
+  - [Handling Updates from Upstream/Development](#handling-updates-from-upstreamdevelopment)
+  - [Sending a Pull Request](#sending-a-pull-request)
+- [Style Guidelines](#style-guidelines)
+
+## Making Changes
+
+1. [Fork](http://help.github.com/forking/) on GitHub
+1. Clone your fork locally
+1. Configure the upstream repo (`git remote add upstream git://github.com/STARIONGROUP/X-Splinter`) 
+1. Checkout development
+1. Create a local branch (`git checkout -b myBranch`) from development
+1. Work on your feature
+1. Rebase if required (see below)
+1. Push the branch up to GitHub (`git push origin myBranch`)
+1. Send a Pull Request on GitHub
+
+You should **never** work on a clone of master or development, and you should **never** send a pull request from master or development - always from a branch. The reasons for this are detailed below.
+
+### Handling Updates from Upstream/Development
+
+While you're working away in your branch it's quite possible that your upstream development (most likely the canonical X-Splinter version) may be updated. If this happens you should:
+
+1. [Stash](http://git-scm.com/book/en/Git-Tools-Stashing) any un-committed changes you need to
+1. `git checkout development`
+1. `git pull upstream development`
+1. `git checkout myBranch`
+1. `git rebase development myBranch`
+1. `git push origin development` - (optional) this makes sure your remote development is up to date
+
+This ensures that your history is "clean" i.e. you have one branch off from development followed by your changes in a straight line. Failing to do this ends up with several "messy" merges in your history, which we don't want. This is the reason why you should always work in a branch and you should never be working in, or sending pull requests from, development.
+
+If you're working on a long running feature then you may want to do this quite often, rather than run the risk of potential merge issues further down the line.
+
+### Sending a Pull Request
+
+While working on your feature you may well create several branches, which is fine, but before you send a pull request you should ensure that you have rebased back to a single "Feature branch". We care about your commits, and we care about your feature branch; but we don't care about how many or which branches you created while you were working on it :smile:.
+
+When you're ready to go you should confirm that you are up to date and rebased with upstream/development (see "Handling Updates from Upstream/development" above), and then:
+
+1. `git push origin myBranch`
+1. Send a descriptive [Pull Request](https://help.github.com/articles/creating-a-pull-request/) on GitHub - making sure you have selected the correct branch in the GitHub UI!
+1. Wait for a maintainer to merge your changes in.
+
+And remember; **A pull-request with tests is a pull-request that's likely to be pulled in.** :grin:
+
+## Style Guidelines
+
+- Indent with 4 spaces, **not** tabs.
+- No underscore (`_`) prefix for member names.
+- Use `this` when accessing instance members, e.g. `this.Name = "X-Splinter";`.
+- Use the `var` keyword unless the inferred type is not obvious.
+- Use the C# type aliases for types that have them, e.g. `int` instead of `Int32`, `string` instead of `String` etc.
+- Use meaningful names (no hungarian notation), we like long descriptive names of methods, variables and parameters.
+- Wrap `if`, `else` and `using` blocks (or blocks in general, really) in curly braces, even if it's a single line.
+- Put `using` statements inside namespace.
+- One type per file.
+- Add the Starion Group copyright header to every file.
+- Pay attention to whitespace and extra blank lines
+- Absolutely **no** regions
+
+> Please pay attention to the style of existing code and keep new contributions consistent with it.

.github/ISSUE_TEMPLATE/bug_or_feature.md

@@ -0,0 +1,34 @@
+---
+name: "Bug or Feature Report"
+about: "Report a bug or request a feature for X-Splinter"
+title: "[Bug|Feature]: "
+labels: []
+assignees: []
+---
+
+### What type of issue is this?
+
+- [ ] Bug report
+- [ ] Feature request
+
+### Prerequisites
+
+- [ ] I have written a descriptive issue title
+- [ ] I have verified that I am running the latest version of the X-Splinter
+- [ ] I have searched [open](https://github.com/STARIONGROUP/X-Splinter/issues) and [closed](https://github.com/STARIONGROUP/X-Splinter/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported
+
+### Description
+<!-- A description of the bug or feature -->
+
+### Steps to Reproduce
+<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior -->
+
+### System Configuration
+<!-- Tell us about the environment where you are experiencing the bug -->
+
+- X-Splinter version:   
+- Environment (Operating system, version and so on):
+- .NET version:
+- Additional information:
+
+<!-- Thanks for reporting the issue to X-Splinter! -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+### Prerequisites
+
+- [ ] I have written a descriptive pull-request title
+- [ ] I have verified that there are no overlapping [pull-requests](https://github.com/STARIONGROUP/X-Splinter/pulls) open
+- [ ] I have verified that I am following the X-Splinter [code style guidelines](https://raw.githubusercontent.com/STARIONGROUP/X-Splinter/development/.github/CONTRIBUTING.md)
+- [ ] I have provided test coverage for my change (where applicable)
+
+### Description
+<!-- A description of the changes proposed in the pull-request -->
+
+<!-- Thanks for contributing to X-Splinter! -->

.github/workflows/CodeQuality.yml

@@ -0,0 +1,54 @@
+name: Build & Test & SonarQube
+
+on:
+  push:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5.2.0
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          overwrite-settings: false
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v5.1.0
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Restore dependencies
+        run: dotnet restore X-Splinter.sln
+
+      - name: Sonarqube Begin
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_SCANNER_OPTS: "-Xmx4096m"
+        run: |
+          dotnet tool install --global dotnet-sonarscanner
+          dotnet tool install --global dotnet-coverage
+          dotnet sonarscanner begin /k:"STARIONGROUP_X-Splinter" /o:"stariongroup" /d:sonar.token="$SONAR_TOKEN" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml
+
+      - name: Build
+        run: dotnet build --no-restore --no-incremental /p:ContinuousIntegrationBuild=true
+
+      - name: Run Tests and Compute Coverage
+        run: dotnet-coverage collect "dotnet test X-Splinter.sln --no-restore --no-build --verbosity normal" -f xml -o "coverage.xml"
+
+      - name: Sonarqube end
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,39 @@
+name: "Code scanning - action"
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 18 * * 1'
+
+jobs:
+  CodeQL-Build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6.0.2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      # Override language selection by uncommenting this and choosing your languages
+      with:
+        languages: csharp
+
+    - name: Setup .NET Core
+      uses: actions/setup-dotnet@v5.1.0
+      with:
+        dotnet-version: '10.0.x'
+    - name: Install dependencies
+      run: dotnet restore
+    - name: Build
+      run: dotnet build --configuration Release --no-restore
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3

.github/workflows/nuget-reference-check.yml

@@ -0,0 +1,138 @@
+name: "nuget package reference check"
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 8 * * *'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6.0.2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    - name: Setup .NET Environment
+      uses: actions/setup-dotnet@v5.1.0
+      with:
+        dotnet-version: 10.0.x
+
+    - name: Check for outdated packages
+      id: outdated
+      run: |
+        set -e
+
+        # Packages to ignore: SDK/runtime-managed, plus deliberately low-floored stable abstractions.
+        IGNORE_PACKAGES="Microsoft\.NETCore\.Platforms|Microsoft\.NETCore\.Targets|Microsoft\.Extensions\.Logging\.Abstractions"
+
+        dotnet list X-Splinter.sln package --outdated --include-transitive > outdated-raw.log
+
+        # Filter out ignored core packages
+        grep -v -E "$IGNORE_PACKAGES" outdated-raw.log > outdated.log || true
+
+        # Print full outdated report (including test projects) to action log
+        echo "=== Full outdated packages report ==="
+        cat outdated.log
+
+        # Build issue log: exclude test project sections
+        # dotnet list output groups packages under project headers like:
+        #   Project `ProjectName` has the following updates available:
+        # We remove sections for *.Tests projects
+        awk '
+          /^Project .*.Tests/ { skip=1; next }
+          /^Project / { skip=0 }
+          !skip { print }
+        ' outdated.log > outdated-issue.log
+
+        # Check if non-test outdated packages exist (look for > lines indicating actual packages)
+        if grep -q ">" outdated-issue.log; then
+          echo "Outdated packages found (non-test)"
+          echo "outdated=true" >> $GITHUB_OUTPUT
+        else
+          echo "No outdated packages found in non-test projects"
+          echo "outdated=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Check for deprecated packages
+      id: deprecated
+      run: |
+        set -e
+        dotnet list X-Splinter.sln package --deprecated --include-transitive > deprecated.log
+        if [ -s deprecated.log ]; then
+          echo "Deprecated packages found"
+          echo "deprecated=true" >> $GITHUB_OUTPUT
+        else
+          echo "No deprecated packages found"
+          echo "deprecated=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Check for vulnerable packages
+      id: vulnerable
+      run: |
+        set -e
+        dotnet list X-Splinter.sln package --vulnerable --include-transitive > vulnerabilities.log
+        if grep -q -i "\bcritical\b\|\bhigh\b\|\bmoderate\b\|\blow\b" vulnerabilities.log; then
+          echo "Security Vulnerabilities found"
+          echo "vulnerable=true" >> $GITHUB_OUTPUT
+        else
+          echo "No Security Vulnerabilities found"
+          echo "vulnerable=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Create GitHub Issue if issues found
+      if: steps.outdated.outputs.outdated == 'true' || steps.deprecated.outputs.deprecated == 'true' || steps.vulnerable.outputs.vulnerable == 'true'
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+          const fs = require('fs');
+
+          let issueBody = `### NuGet Package Issues Detected in [X-Splinter](${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY})\n\n`;
+
+          if ('${{ steps.outdated.outputs.outdated }}' === 'true') {
+            const outdatedLog = fs.readFileSync('outdated-issue.log', 'utf8');
+            issueBody += `#### Outdated Packages\n\`\`\`\n${outdatedLog}\n\`\`\`\n\n`;
+          }
+
+          if ('${{ steps.deprecated.outputs.deprecated }}' === 'true') {
+            const deprecatedLog = fs.readFileSync('deprecated.log', 'utf8');
+            issueBody += `#### Deprecated Packages\n\`\`\`\n${deprecatedLog}\n\`\`\`\n\n`;
+          }
+
+          if ('${{ steps.vulnerable.outputs.vulnerable }}' === 'true') {
+            const vulnerabilitiesLog = fs.readFileSync('vulnerabilities.log', 'utf8');
+            issueBody += `#### Vulnerable Packages\n\`\`\`\n${vulnerabilitiesLog}\n\`\`\`\n\n`;
+          }
+
+          issueBody += '**Action Required:** Please review and update the affected packages.';
+
+          const issueTitle = 'NuGet Package Issues Detected';
+          const { data: issues } = await github.rest.issues.listForRepo({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            state: 'open',
+          });
+
+          const existingIssue = issues.find(issue => issue.title === issueTitle);
+
+          if (existingIssue) {
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: existingIssue.number,
+              body: `New check results:\n${issueBody}`,
+            });
+          } else {
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: issueTitle,
+              body: issueBody,
+              labels: ['dependencies', 'maintenance'],
+            });
+          }

.gitignore

@@ -427,3 +427,5 @@ FodyWeavers.xsd
 *.msix
 *.msm
 *.msp
+
+.idea/