Skip to content

Validate NuGet binary closures during packaging#5676

Draft
brendankowitz wants to merge 26 commits into
mainfrom
brendankowitz-add-binary-closure-validation
Draft

Validate NuGet binary closures during packaging#5676
brendankowitz wants to merge 26 commits into
mainfrom
brendankowitz-add-binary-closure-validation

Conversation

@brendankowitz

@brendankowitz brendankowitz commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • validate the four supported FHIR Web package roots (Stu3, R4, R4B, and R5) as independently restored net8.0 and net9.0 deployment closures after packing in the shared PR/CI package path
  • run pinned checkbinarycompat 1.0.45 with exact local-package source mappings, deterministic failure aggregation, retained diagnostics, and eight committed portable baselines
  • cover the intended production failure with a real regression fixture where a transitive dependency renames a referenced method: publish succeeds, but binary closure validation fails

Layered protection

This PR provides the OSS producer gate for the supported FHIR Server deployment compositions. A separate fhir-paas gate is still required against each exact final publish directory after downstream NuGet pins and overrides are resolved; this repository cannot observe those downstream dependency selections.

Validation

  • Windows and Linux PowerShell suites: 33 tests passed, including the real renamed-member regression with checkbinarycompat 1.0.45
  • Full Linux validation: 8 closures across 4 Web packages
  • Produced 8 reports, 8 assembly inventories, and 8 comparisons with zero baseline mismatches
  • PR/CI YAML and PowerShell syntax parsed successfully
  • Independent whole-feature review and re-review found no remaining Critical or Important issues

brendankowitz and others added 26 commits July 14, 2026 11:28
@brendankowitz
Document NuGet binary closure validation
6c98fe2 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Plan NuGet binary closure validation
4b87a66 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Add NuGet closure validation helpers
e52e490 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Sort discovered package frameworks
2abfc59 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Resolve restore config output paths
ce205ea 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Validate restored NuGet binary closures
cd3c208 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Make validator errors deterministic
d227262 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Fix local package restore validation
daeabb5 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Run binary closure checks during packaging
383dd10 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Disable central versions for closure consumers
2ad2dd7 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Preserve empty binary closure reports
fc30842 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Honor binary checker baseline matches
a273c62 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Baseline NuGet binary closures
7dc9fa9 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Use relative binary checker input paths
64975f8 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Run binary checker from publish directory
d202465 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Regenerate binary closure baselines on Linux
a05e43a 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Resolve PowerShell child executable
c9cea3c 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Correct binary closure plan inventory
71dd7f1 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Reduce binary closure validation scope
8c684fb 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Plan reduced binary closure validation
4d29bd8 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Select binary closure deployment roots
1658058 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Validate Web package deployment closures
5735bfd 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Test renamed dependency member failures
a262ad7 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Make member regression fixture portable
697c31f 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Reduce binary closure baseline inventory
36a4073 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
@brendankowitz
Preserve binary closure package roots
12a33ce 
Invoke the validator in-process so the four required Web package IDs remain a PowerShell array across the pipeline boundary. Add a regression test covering the production invocation shape.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ef0bf75e-afad-46b4-8331-a436acedbe9a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brendankowitz