chore: update .NET SDK to 10.0.202 and add build log documentation

.github/hooks/pre-push

@@ -11,18 +11,26 @@ RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RE
 
 echo -e "${CYAN}━━━ Pre-Push Gate ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${RESET}"
 
-# ── Gate 0: Enforce squad branch naming (squad/{issue}-{slug}) ─────────────
+# ── Gate 0: Enforce branch naming conventions ──────────────────────────────
+# Merge hierarchy: squad/{issue}-{slug} → sprint/{N}-{slug} → dev → main (release only)
 CURRENT_BRANCH="$(git symbolic-ref --short HEAD 2>/dev/null || echo "")"
 if [[ "$CURRENT_BRANCH" == "main" || "$CURRENT_BRANCH" == "dev" ]]; then
   echo -e "${RED}❌  Direct pushes to '${CURRENT_BRANCH}' are not allowed.${RESET}"
-  echo -e "    Create a feature branch: ${YELLOW}squad/{issue}-{slug}${RESET}"
+  echo -e "    Feature work: ${YELLOW}squad/{issue}-{slug}${RESET} → sprint branch"
+  echo -e "    Sprint close: ${YELLOW}sprint/{N}-{slug}${RESET} → dev (via PR)"
   exit 1
 fi
 
+# sprint/* branches are merge targets (squad PRs land here); skip remaining gates.
+if [[ "$CURRENT_BRANCH" =~ ^sprint/[0-9]+-[a-z0-9-]+$ ]]; then
+  echo -e "${GREEN}✅  Sprint branch '${CURRENT_BRANCH}' — skipping feature gates.${RESET}"
+  exit 0
+fi
+
 if ! [[ "$CURRENT_BRANCH" =~ ^squad/[0-9]+-[a-z0-9-]+$ ]]; then
-  echo -e "${RED}❌  Branch name '${CURRENT_BRANCH}' does not match squad naming convention.${RESET}"
-  echo -e "    Expected format: ${YELLOW}squad/{issue}-{slug}${RESET}"
-  echo -e "    Examples: ${YELLOW}squad/42-fix-login${RESET}, ${YELLOW}squad/123-add-api-docs${RESET}"
+  echo -e "${RED}❌  Branch name '${CURRENT_BRANCH}' does not match naming convention.${RESET}"
+  echo -e "    Feature branch: ${YELLOW}squad/{issue}-{slug}${RESET}  (e.g. squad/42-fix-login)"
+  echo -e "    Sprint branch:  ${YELLOW}sprint/{N}-{slug}${RESET}     (e.g. sprint/3-mongodb-persistence)"
   exit 1
 fi
 

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,58 @@
+---
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - "**.cs"
+      - "**.csproj"
+
+  pull_request:
+    branches:
+      - "**"
+
+  workflow_dispatch:
+
+  schedule:
+    - cron: "31 0 * * 5"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    env:
+      CI: true
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["csharp"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+          dotnet-quality: 'ga'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/project-board-automation.yml

@@ -0,0 +1,113 @@
+name: Project Board Automation
+
+on:
+  pull_request:
+    types: [opened, closed]
+
+# repository-projects: write covers Projects v2 for user-owned repos.
+# If mutations fail with a 403, store a PAT with 'project' scope as
+# secrets.GH_PROJECT_TOKEN and replace secrets.GITHUB_TOKEN below.
+permissions:
+  issues: read
+  pull-requests: read
+  repository-projects: write
+
+env:
+  PROJECT_ID: PVT_kwHOA5k0b84BVFTy
+  STATUS_FIELD_ID: PVTSSF_lAHOA5k0b84BVFTyzhQjgPk
+  IN_REVIEW_OPTION_ID: df73e18b
+  DONE_OPTION_ID: "98236657"
+
+jobs:
+  update-project-board:
+    # Trigger on PR open OR on PR merge (not plain close)
+    if: >
+      github.event.action == 'opened' ||
+      (github.event.action == 'closed' && github.event.pull_request.merged == true)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Move linked issues on project board
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const action = context.payload.action;
+            const pr     = context.payload.pull_request;
+
+            const optionId   = action === 'opened' ? process.env.IN_REVIEW_OPTION_ID : process.env.DONE_OPTION_ID;
+            const columnName = action === 'opened' ? 'In Review' : 'Done';
+
+            // Parse "Closes #N", "Fixes #N", "Resolves #N" (case-insensitive)
+            const body         = pr.body || '';
+            const issueNumbers = [...body.matchAll(/(?:closes|fixes|resolves)\s+#(\d+)/gi)]
+                                   .map(m => parseInt(m[1]));
+
+            if (issueNumbers.length === 0) {
+              core.info(`PR #${pr.number}: no linked issues found — skipping`);
+              return;
+            }
+
+            core.info(`PR #${pr.number} (${action}): moving issues [${issueNumbers.join(', ')}] → ${columnName}`);
+
+            for (const issueNumber of issueNumbers) {
+              // Resolve issue node ID
+              let issueNodeId;
+              try {
+                const { data: issue } = await github.rest.issues.get({
+                  owner: context.repo.owner,
+                  repo:  context.repo.repo,
+                  issue_number: issueNumber,
+                });
+                issueNodeId = issue.node_id;
+              } catch (err) {
+                core.warning(`Could not fetch issue #${issueNumber}: ${err.message}`);
+                continue;
+              }
+
+              // Find the project item for this issue in the MyBlog project board
+              const projectQuery = await github.graphql(`
+                query($nodeId: ID!) {
+                  node(id: $nodeId) {
+                    ... on Issue {
+                      projectItems(first: 20) {
+                        nodes {
+                          id
+                          project { id }
+                        }
+                      }
+                    }
+                  }
+                }
+              `, { nodeId: issueNodeId });
+
+              const projectItem = projectQuery.node?.projectItems?.nodes?.find(
+                item => item.project.id === process.env.PROJECT_ID
+              );
+
+              if (!projectItem) {
+                core.warning(`Issue #${issueNumber} is not on the MyBlog project board — skipping`);
+                continue;
+              }
+
+              // Update the Status field
+              await github.graphql(`
+                mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+                  updateProjectV2ItemFieldValue(input: {
+                    projectId: $projectId
+                    itemId:    $itemId
+                    fieldId:   $fieldId
+                    value:     { singleSelectOptionId: $optionId }
+                  }) {
+                    projectV2Item { id }
+                  }
+                }
+              `, {
+                projectId: process.env.PROJECT_ID,
+                itemId:    projectItem.id,
+                fieldId:   process.env.STATUS_FIELD_ID,
+                optionId:  optionId,
+              });
+
+              core.info(`✅ Issue #${issueNumber} → ${columnName}`);
+            }

.github/workflows/squad-label-enforce.yml

@@ -0,0 +1,176 @@
+---
+name: Squad Label Enforce
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  enforce:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Enforce mutual exclusivity
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const issue = context.payload.issue;
+            const appliedLabel = context.payload.label.name;
+
+            // Namespaces with mutual exclusivity rules
+            const EXCLUSIVE_PREFIXES = ['go:', 'release:', 'type:', 'priority:'];
+
+            // Skip if not a managed namespace label
+            if (!EXCLUSIVE_PREFIXES.some(p => appliedLabel.startsWith(p))) {
+              core.info(`Label ${appliedLabel} is not in a managed namespace — skipping`);
+              return;
+            }
+
+            const allLabels = issue.labels.map(l => l.name);
+
+            // Handle go: namespace (mutual exclusivity)
+            if (appliedLabel.startsWith('go:')) {
+              const otherGoLabels = allLabels.filter(l => 
+                l.startsWith('go:') && l !== appliedLabel
+              );
+
+              if (otherGoLabels.length > 0) {
+                for (const label of otherGoLabels) {
+                  await github.rest.issues.removeLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    name: label
+                  });
+                  core.info(`Removed conflicting label: ${label}`);
+                }
+
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  body: `🏷️ Triage verdict updated → \`${appliedLabel}\``
+                });
+              }
+
+              if (appliedLabel === 'go:yes') {
+                const hasReleaseLabel = allLabels.some(l => l.startsWith('release:'));
+                if (!hasReleaseLabel) {
+                  await github.rest.issues.addLabels({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    labels: ['release:backlog']
+                  });
+
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: `📋 Marked as \`release:backlog\` — assign a release target when ready.`
+                  });
+
+                  core.info('Applied release:backlog for go:yes issue');
+                }
+              }
+
+              if (appliedLabel === 'go:no') {
+                const releaseLabels = allLabels.filter(l => l.startsWith('release:'));
+                if (releaseLabels.length > 0) {
+                  for (const label of releaseLabels) {
+                    await github.rest.issues.removeLabel({
+                      owner: context.repo.owner,
+                      repo: context.repo.repo,
+                      issue_number: issue.number,
+                      name: label
+                    });
+                    core.info(`Removed release label from go:no issue: ${label}`);
+                  }
+                }
+              }
+            }
+
+            // Handle release: namespace (mutual exclusivity)
+            if (appliedLabel.startsWith('release:')) {
+              const otherReleaseLabels = allLabels.filter(l => 
+                l.startsWith('release:') && l !== appliedLabel
+              );
+
+              if (otherReleaseLabels.length > 0) {
+                for (const label of otherReleaseLabels) {
+                  await github.rest.issues.removeLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    name: label
+                  });
+                  core.info(`Removed conflicting label: ${label}`);
+                }
+
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  body: `🏷️ Release target updated → \`${appliedLabel}\``
+                });
+              }
+            }
+
+            // Handle type: namespace (mutual exclusivity)
+            if (appliedLabel.startsWith('type:')) {
+              const otherTypeLabels = allLabels.filter(l => 
+                l.startsWith('type:') && l !== appliedLabel
+              );
+
+              if (otherTypeLabels.length > 0) {
+                for (const label of otherTypeLabels) {
+                  await github.rest.issues.removeLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    name: label
+                  });
+                  core.info(`Removed conflicting label: ${label}`);
+                }
+
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  body: `🏷️ Issue type updated → \`${appliedLabel}\``
+                });
+              }
+            }
+
+            // Handle priority: namespace (mutual exclusivity)
+            if (appliedLabel.startsWith('priority:')) {
+              const otherPriorityLabels = allLabels.filter(l => 
+                l.startsWith('priority:') && l !== appliedLabel
+              );
+
+              if (otherPriorityLabels.length > 0) {
+                for (const label of otherPriorityLabels) {
+                  await github.rest.issues.removeLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    name: label
+                  });
+                  core.info(`Removed conflicting label: ${label}`);
+                }
+
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  body: `🏷️ Priority updated → \`${appliedLabel}\``
+                });
+              }
+            }
+
+            core.info(`Label enforcement complete for ${appliedLabel}`);