Promote develop to main: hub convergence rounds 1-2

[ptr727]

Promotion PR (develop -> main)

Promotes the accumulated develop work to main. Maintainer-gated release merge (merge-commit only per the main ruleset - never squash, never --delete-branch since the head is develop).

What lands on main

• #15 - --apikey-file for trash + dependency updates (SQLite advisory cleared).
• #16 - fleet governance baseline carry.
• #17 - full analyzer enforcement (TreatWarningsAsErrors, xUnit1051/1030 sweep, CS8625).
• #18 - round-2 canonical refresh + CLAUDE.md folded into AGENTS.md.
• #19 - central package management + LangVersion.
• #21 - multi-arch Dockerfile rework.
• #22 - the release pipeline (build tasks, publisher, smoke wiring, Docker Hub README).
• #23 - docker-hub secret mechanism in the audit manifest.

Tracking issue: #14. The full release pipeline is now included; remaining out-of-scope items are the merge-bot and the date-badge.

Release note

The publisher does not auto-run on a human merge (publish-release.yml runs on schedule/dispatch/bot-push only), so this promotion advances main and NBGV versions it from the version.json floor (Version 1.0) but does not itself cut a release. The first real publish is a maintainer workflow_dispatch of publish-release.yml; the ptr727/photocleaner Docker Hub repo should exist before the first push.

Verification

• Trial merge clean (no EOL conflict). develop CI (including the full pipeline smoke build) is green on the head commit.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Promotion PR that advances main to match the accumulated develop convergence work, including governance baseline carry, repo configuration payloads, analyzer/format enforcement, central package management, and the trash command --apikey-file support (with docs + tests) - aligning the release branch with the repo’s intended fleet-standard workflow.

Changes:

• Add --apikey-file support for trash (mutual exclusivity + validation), update docs, and expand CLI tests for API-key resolution.
• Adopt centralized build/package configuration (Directory.Build.props, Directory.Packages.props, version.json), plus dependency/security adjustments (SQLite transitive override).
• Carry governance and repo-configuration baseline (ruleset payloads + configure/check script, audit/secrets manifest), and normalize spell-check/markdownlint configuration.

Reviewed changes

Copilot reviewed 40 out of 41 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
version.json	Introduces NBGV version floor/config for release branch versioning.
spec/secrets.json	Adds repo-scoped secrets manifest used for audit/manual verification.
repo-config/settings.json	Captures baseline repository settings for idempotent apply/check.
repo-config/README.md	Documents repo-config payloads, models, and settings rationale.
repo-config/main.json	Adds/updates the main branch ruleset payload (merge-commit gated).
repo-config/develop.json	Adds/updates the develop branch ruleset payload (squash gated).
repo-config/configure.sh	Adds repo configuration apply/check automation via GitHub API.
README.md	Documents --apikey-file and adjusts headings to satisfy markdownlint.
HISTORY.md	Aligns header/description with README (repo convention).
Directory.Packages.props	Enables central package management and consolidates versions.
Directory.Build.props	Centralizes common MSBuild properties (TFM, analyzers, LangVersion).
PhotoCleaner/CommandLine.cs	Implements --apikey-file option + validation and key resolution helpers.
PhotoCleaner/TrashCommand.cs	Updates runtime error message to reflect both API-key inputs.
PhotoCleaner/PhotoCleaner.csproj	Moves to CPM versionless references and adds SQLite bundle override.
PhotoCleanerTests/CommandLineTests.cs	Adds parse/validation + helper tests for API-key file behavior.
PhotoCleanerTests/TrashCommandTests.cs	Propagates xUnit cancellation token into DB verification calls.
PhotoCleanerTests/TrashDatabaseTests.cs	Adds cancellation tokens to async DB calls for xUnit v3 analyzers.
PhotoCleanerTests/DatabaseTests.cs	Adds cancellation tokens to async DB/file operations for analyzer compliance.
PhotoCleanerTests/ImportTaskTests.cs	Adds cancellation tokens to async file/db operations and utility calls.
PhotoCleanerTests/IndexTaskTests.cs	Adds cancellation tokens to async indexing/db/file operations.
PhotoCleanerTests/ProcessTaskTests.cs	Adds cancellation tokens to async file/db operations and ProcessTask.ExecuteAsync.
PhotoCleanerTests/UndoTaskTests.cs	Passes xUnit cancellation token into UndoTask.Execute calls.
PhotoCleanerTests/PhotoCleanerTests.csproj	Converts to versionless CPM references and adds SQLite bundle override.
PhotoCleanerBenchmarks/PhotoCleanerBenchmarks.csproj	Converts to versionless CPM references.
PhotoCleanerBenchmarks/MediaBenchmarks.cs	Fixes nullable sha1 usage and adds async disposal to satisfy analyzers.
PhotoCleanerBenchmarks/.editorconfig	Suppresses benchmark-specific analyzer rules per BenchmarkDotNet constraints.
cspell.json	Externalizes/expands word list (replacing workspace-local cSpell words).
CODESTYLE.md	Updates/expands canonical style guidance (clean-compile tasks, CPM, spelling scope).
CLAUDE.md	Removes redundant agent instructions (folded into AGENTS/CODESTYLE guidance).
AUDIT.md	Adds repo-scoped audit process and drift/defect checks for settings/rulesets/secrets.
.editorconfig	Removes analyzer severity downgrade to enable full analyzer enforcement.
.markdownlint-cli2.jsonc	Aligns markdownlint configuration (keeps MD033 enabled; clarifies MD060).
.github/dependabot.yml	Adds dual-branch Dependabot configuration for NuGet and Actions.
.github/copilot-instructions.md	Re-vendors Copilot runbook + project architecture guidance and updates trash docs.
.vscode/tasks.json	Renames tasks to .NET casing to match conventions and references.
.vscode/launch.json	Updates launch configs to use .NET Build and demonstrates --apikey-file.
.husky/task-runner.json	Updates task name casing to .NET Format.
.gitignore	Adds secrets/ and normalizes ignored build/coverage outputs.
PhotoCleaner.code-workspace	Removes workspace-local cSpell word list to centralize spelling config.

[codecov]

Codecov Report

❌ Patch coverage is 84.21053% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.96%. Comparing base (17dcf37) to head (30434d0).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
PhotoCleaner/CommandLine.cs	88.88%	4 Missing and 2 partials ⚠️
PhotoCleaner/TrashCommand.cs	0.00%	3 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #20 +/- ##
==========================================
+ Coverage 44.39% 44.96% +0.56% 
==========================================
Files 25 25 Lines 3347 3398 +51 Branches 253 259 +6 ==========================================
+ Hits 1486 1528 +42 - Misses 1819 1824 +5 - Partials 42 46 +4 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 41 out of 42 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 49 out of 50 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 49 out of 50 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 49 out of 50 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (4)

.github/workflows/build-release-task.yml:70

• Same issue as above: needs.get-version... uses dot-notation against a hyphenated job id (get-version), which will not evaluate correctly. Switch these references to bracket form (needs['get-version']).

 if: ${{ !cancelled() && needs.get-version.result == 'success' && (needs.validate.result == 'success' || needs.validate.result == 'skipped') }}

.github/workflows/build-release-task.yml:105

• needs.get-version.outputs... references a hyphenated job id and will be parsed incorrectly. Use needs['get-version'].outputs... for these output references (and any other get-version references in this job).

 ref: ${{ needs.get-version.outputs.GitCommitId }}
# Backstop (main only): refuse to publish if the public version carries a prerelease '-' (NBGV mis-versioning).
# Strip '+buildmetadata' first; only a '-' in the core segment marks a prerelease.
- name: Verify public release version step
if: ${{ inputs.branch == 'main' }}
env:
SEMVER2: ${{ needs.get-version.outputs.SemVer2 }}

.github/workflows/build-release-task.yml:127

• TAG pulls from needs.get-version.outputs..., but get-version is a hyphenated job id so this expression will not evaluate correctly. Use bracket notation for the needs key.

 TAG: ${{ needs.get-version.outputs.SemVer2 }}

.github/workflows/build-release-task.yml:149

• tag_name/target_commitish reference needs.get-version... but get-version contains a hyphen, so these expressions will not be parsed as property access. Use bracket notation (needs['get-version']).

 tag_name: ${{ needs.get-version.outputs.SemVer2 }}
target_commitish: ${{ needs.get-version.outputs.GitCommitId }}

[Copilot]

Pull request overview

Copilot reviewed 49 out of 50 changed files in this pull request and generated no new comments.