CSHARP-6147: Add a dotnet format check - #2086
Conversation
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| with: | ||
| persist-credentials: false | ||
|
|
||
| - uses: actions/setup-dotnet@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🎈 Fixed in commit 86cbb94 🎈
| runs-on: ubuntu-latest | ||
| timeout-minutes: 20 | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🌟 Fixed in commit 86cbb94 🌟
There was a problem hiding this comment.
Pull request overview
Adds automated formatting/code-style validation to the mongo-csharp-driver contributor workflow by introducing a dedicated dotnet format GitHub Actions check and an optional local pre-push hook, with contributor documentation updates to match.
Changes:
- Add a new CI workflow that runs
dotnet format ... --verify-no-changeson pull requests. - Add a repo-local
.githooks/pre-pushhook to rundotnet formatonly against pushed.csfiles. - Document formatting expectations and hook enablement in
CONTRIBUTING.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
CONTRIBUTING.md |
Documents how formatting/style are enforced and how to enable the repo git hooks. |
.github/workflows/format.yml |
New PR workflow that verifies dotnet format has no pending changes. |
.githooks/pre-push |
New pre-push hook that runs dotnet format on changed .cs files before pushing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…tation dotnet format's indentation of an `else` followed by an `if` on the next line changed between SDK 10.0.100 and 10.0.302, so the check disagreed with the formatting already on main. Writing it as `else if` formats identically under both. Pinning the SDK keeps the check from breaking on a runner image update.
dotnet format needs to compile each project once per target framework, so checking even a single changed file costs 10-50s depending on the project. That is too slow to sit on every push - it would just get bypassed with --no-verify. CI stays the only automated checkpoint.
A tag can be repointed by its owner, which would run unreviewed code in the workflow. Flagged by semgrep.
papafe
changed the title
The v3.x branch has not had the formatting applied, so the check would fail on every pull request against it.
https://jira.mongodb.org/browse/CSHARP-6147
We also looked at running the check as a commit/push git hook, so problems would be caught before CI. Unfortunately
dotnet formatis quite slow on projects of this size, so it is not included here.