Promote develop to main: template sync (merge-bot pull_request_target fix), nuget bumps

.editorconfig

@@ -44,6 +44,10 @@ end_of_line = crlf
 [*.sh]
 end_of_line = lf
 
+# Dockerfiles - CRLF breaks RUN heredocs and line continuations
+[{Dockerfile,*.Dockerfile}]
+end_of_line = lf
+
 # Windows scripts
 [*.{cmd,bat,ps1}]
 end_of_line = crlf
@@ -60,6 +64,8 @@ end_of_line = crlf
 dotnet_diagnostic.IDE0055.severity = none
 dotnet_analyzer_diagnostic.severity = suggestion
 
+# PlexCleaner adaptation: repo-wide CA relaxations that apply to every project here (a console app, not a
+# reusable library). Per CODESTYLE.md these are justified repo-wide because they hold for all projects.
 # Public API surface rules: not applicable, this is a console app not a reusable library
 dotnet_diagnostic.CA1002.severity = none  # Do not expose List<T>
 dotnet_diagnostic.CA1024.severity = none  # Use properties where appropriate

.gitattributes

@@ -1,5 +1,20 @@
-# Leave line endings alone
+# Default: do not normalize line endings (`* -text`); .editorconfig end_of_line rules guide what the editor writes.
+# The exception pins below are git's own enforcement - they force LF for execution-sensitive classes regardless of editor.
 # git config --global core.autocrlf false
 # git add --renormalize .
 # git ls-files --eol
 * -text
+
+# Exception: scripts must stay LF regardless of the `* -text` default - a CRLF shebang breaks execution. `.editorconfig`
+# covers `*.sh`, but extensionless executables match no extension rule, so pin them here so git enforces LF on checkout
+# and `--renormalize`. Any repo whose tooling ships extensionless scripts adds the matching path pin, e.g. s6-overlay
+# init `Docker/s6-overlay/** text eol=lf` or husky/git hooks `.husky/pre-commit text eol=lf`.
+*.sh text eol=lf
+.husky/pre-commit text eol=lf
+
+# Dockerfiles must be LF - a CRLF breaks RUN heredocs and line continuations.
+Dockerfile text eol=lf
+*.Dockerfile text eol=lf
+
+# m4 README source is rendered on Linux; keep it LF.
+Docker/README.m4 text eol=lf

.github/dependabot.yml

@@ -1,43 +1,43 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
-  # main
-  - package-ecosystem: "nuget"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-  - package-ecosystem: "github-actions"
-    target-branch: "main"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
-
-  # develop
-  - package-ecosystem: "nuget"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      nuget-deps:
-        patterns:
-          - "*"
-  - package-ecosystem: "github-actions"
-    target-branch: "develop"
-    directory: "/"
-    schedule:
-      interval: "daily"
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  # main
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  # develop
+  - package-ecosystem: "nuget"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    target-branch: "develop"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"

.github/workflows/build-datebadge-task.yml

@@ -1,35 +1,29 @@
-name: Build BYOB date badge task
-
-on:
-  workflow_call:
-    inputs:
-      # Logical branch this badge run is for. The badge only updates on
-      # `main`; the publisher passes the branch explicitly so a scheduled run
-      # building `develop` doesn't try to write the main badge. Required (no
-      # `github.ref_name` fallback) so the gate can't silently misfire.
-      branch:
-        required: true
-        type: string
-
-jobs:
-
-  date-badge:
-    name: Build BYOB date badge job
-    runs-on: ubuntu-latest
-
-    steps:
-
-      - name: Get current date step
-        id: date
-        run: echo "date=$(date)" >> $GITHUB_OUTPUT
-
-      - name: Build BYOB date badge step
-        if: ${{ inputs.branch == 'main' }}
-        uses: RubbaBoy/BYOB@24f464284c1fd32028524b59607d417a2e36fee7 # v1.3.0
-        with:
-          name: lastbuild
-          label: "Last Build"
-          icon: "github"
-          status: ${{ steps.date.outputs.date }}
-          color: "blue"
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+name: Build BYOB date badge task
+
+# Caller-gated: the publisher invokes this only when main is published - the badge has no per-branch context, it tracks
+# the last main build.
+
+on:
+  workflow_call:
+
+jobs:
+
+  date-badge:
+    name: Build BYOB date badge job
+    runs-on: ubuntu-latest
+
+    steps:
+
+      - name: Get current date step
+        id: date
+        run: echo "date=$(date)" >> "$GITHUB_OUTPUT"
+
+      - name: Build BYOB date badge step
+        uses: RubbaBoy/BYOB@24f464284c1fd32028524b59607d417a2e36fee7 # v1.3.0
+        with:
+          name: lastbuild
+          label: "Last Build"
+          icon: "github"
+          status: ${{ steps.date.outputs.date }}
+          color: "blue"
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-executable-task.yml

@@ -1,101 +1,101 @@
-name: Build executable task
-
-on:
-  workflow_call:
-    inputs:
-      # Git ref to check out / version (empty = default checkout ref).
-      ref:
-        required: false
-        type: string
-        default: ''
-      # Logical branch driving build configuration (`main` => Release, else
-      # Debug). Required (no `github.ref_name` fallback, which would mislabel
-      # the develop leg of the publisher's matrix); the orchestrator passes it.
-      branch:
-        required: true
-        type: string
-      # Smoke mode: build a representative runtime subset (linux-x64 +
-      # win-x64) instead of the full 7-runtime matrix, and skip the zip /
-      # artifact aggregation. Used for fast PR feedback.
-      smoke:
-        required: false
-        type: boolean
-        default: false
-
-jobs:
-
-  get-version:
-    name: Get version information job
-    uses: ./.github/workflows/get-version-task.yml
-    secrets: inherit
-    with:
-      ref: ${{ inputs.ref }}
-
-  build-executable-matrix:
-    name: Build executable project matrix job
-    runs-on: ubuntu-latest
-    needs: [get-version]
-    strategy:
-      matrix:
-        runtime: ${{ fromJSON(inputs.smoke && '["linux-x64","win-x64"]' || '["win-x64","linux-x64","linux-musl-x64","linux-arm","linux-arm64","osx-x64","osx-arm64"]') }}
-
-    steps:
-
-      - name: Setup .NET SDK step
-        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
-        with:
-          dotnet-version: 10.x
-
-      - name: Checkout code step
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          ref: ${{ inputs.ref }}
-
-      - name: Build executable project step
-        run: |
-          dotnet publish ./PlexCleaner/PlexCleaner.csproj \
-            --runtime ${{ matrix.runtime }} \
-            -property:PublishDir=${{ runner.temp }}/publish/${{ matrix.runtime }}/ \
-            --configuration ${{ inputs.branch == 'main' && 'Release' || 'Debug' }} \
-            -property:PublishAot=false \
-            -property:Version=${{ needs.get-version.outputs.AssemblyVersion }} \
-            -property:FileVersion=${{ needs.get-version.outputs.AssemblyFileVersion }} \
-            -property:AssemblyVersion=${{ needs.get-version.outputs.AssemblyVersion }} \
-            -property:InformationalVersion=${{ needs.get-version.outputs.AssemblyInformationalVersion }} \
-            -property:PackageVersion=${{ needs.get-version.outputs.SemVer2 }}
-
-      - name: Upload matrix build artifacts step
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: publish-${{ inputs.branch }}-${{ matrix.runtime }}
-          path: ${{ runner.temp }}/publish
-          retention-days: 1
-
-  # Smoke builds only need the per-runtime compile to succeed (fast PR
-  # feedback) - the zipped, downloadable artifact is a release concern, so
-  # skip the aggregation entirely on smoke. The release job collects the
-  # release-asset-<branch>-* artifacts by pattern, so no artifact-id is needed.
-  upload-build-artifacts:
-    name: Upload matrix build artifacts job
-    if: ${{ !inputs.smoke }}
-    runs-on: ubuntu-latest
-    needs: [ build-executable-matrix ]
-
-    steps:
-
-      - name: Download matrix build artifacts step
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: publish-${{ inputs.branch }}-*
-          merge-multiple: true
-          path: ${{ runner.temp }}/publish
-
-      - name: Zip build output step
-        run: 7z a -t7z ${{ runner.temp }}/PlexCleaner.7z ${{ runner.temp }}/publish/*
-
-      - name: Upload build artifacts step
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: release-asset-${{ inputs.branch }}-executable
-          path: ${{ runner.temp }}/PlexCleaner.7z
-          retention-days: 1
+name: Build executable task
+
+on:
+  workflow_call:
+    inputs:
+      # Git ref to check out / version (empty = default checkout ref).
+      ref:
+        required: false
+        type: string
+        default: ''
+      # Logical branch driving build configuration (`main` => Release, else
+      # Debug). Required (no `github.ref_name` fallback, which would mislabel
+      # the develop leg of the publisher's matrix); the orchestrator passes it.
+      branch:
+        required: true
+        type: string
+      # Smoke mode: build a representative runtime subset (linux-x64 +
+      # win-x64) instead of the full 7-runtime matrix, and skip the zip /
+      # artifact aggregation. Used for fast PR feedback.
+      smoke:
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+
+  get-version:
+    name: Get version information job
+    uses: ./.github/workflows/get-version-task.yml
+    secrets: inherit
+    with:
+      ref: ${{ inputs.ref }}
+
+  build-executable-matrix:
+    name: Build executable project matrix job
+    runs-on: ubuntu-latest
+    needs: [get-version]
+    strategy:
+      matrix:
+        runtime: ${{ fromJSON(inputs.smoke && '["linux-x64","win-x64"]' || '["win-x64","linux-x64","linux-musl-x64","linux-arm","linux-arm64","osx-x64","osx-arm64"]') }}
+
+    steps:
+
+      - name: Setup .NET SDK step
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        with:
+          dotnet-version: 10.x
+
+      - name: Checkout code step
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Build executable project step
+        run: |
+          dotnet publish ./PlexCleaner/PlexCleaner.csproj \
+            --runtime ${{ matrix.runtime }} \
+            -property:PublishDir=${{ runner.temp }}/publish/${{ matrix.runtime }}/ \
+            --configuration ${{ inputs.branch == 'main' && 'Release' || 'Debug' }} \
+            -property:PublishAot=false \
+            -property:Version=${{ needs.get-version.outputs.AssemblyVersion }} \
+            -property:FileVersion=${{ needs.get-version.outputs.AssemblyFileVersion }} \
+            -property:AssemblyVersion=${{ needs.get-version.outputs.AssemblyVersion }} \
+            -property:InformationalVersion=${{ needs.get-version.outputs.AssemblyInformationalVersion }} \
+            -property:PackageVersion=${{ needs.get-version.outputs.SemVer2 }}
+
+      - name: Upload matrix build artifacts step
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: publish-${{ inputs.branch }}-${{ matrix.runtime }}
+          path: ${{ runner.temp }}/publish
+          retention-days: 1
+
+  # Smoke builds only need the per-runtime compile to succeed (fast PR
+  # feedback) - the zipped, downloadable artifact is a release concern, so
+  # skip the aggregation entirely on smoke. The release job collects the
+  # release-asset-<branch>-* artifacts by pattern, so no artifact-id is needed.
+  upload-build-artifacts:
+    name: Upload matrix build artifacts job
+    if: ${{ !inputs.smoke }}
+    runs-on: ubuntu-latest
+    needs: [ build-executable-matrix ]
+
+    steps:
+
+      - name: Download matrix build artifacts step
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: publish-${{ inputs.branch }}-*
+          merge-multiple: true
+          path: ${{ runner.temp }}/publish
+
+      - name: Zip build output step
+        run: 7z a -t7z ${{ runner.temp }}/PlexCleaner.7z ${{ runner.temp }}/publish/*
+
+      - name: Upload build artifacts step
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-asset-${{ inputs.branch }}-executable
+          path: ${{ runner.temp }}/PlexCleaner.7z
+          retention-days: 1