Dev to Lab

.docker/Dockerfile

@@ -7,12 +7,12 @@ ENV CI=true
 COPY docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm/*.csproj CodeBeam.Website/
 COPY docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm.Client/*.csproj CodeBeam.Website.Client/
 
-RUN dotnet restore CodeBeam.Website/CodeBeam.UltimateAuth.Docs.Wasm.csproj
+RUN dotnet restore CodeBeam.Website/CodeBeam.UltimateAuth.Docs.Wasm.csproj -p:UltimateAuthBuildTargetFrameworks=net10.0
 
 COPY . .
 
 RUN dotnet publish docs/website/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm/CodeBeam.UltimateAuth.Docs.Wasm.csproj \
-    -c Release -o /app/publish
+    -c Release -p:UltimateAuthBuildTargetFrameworks=net10.0 -o /app/publish
 
 # RUNTIME
 FROM mcr.microsoft.com/dotnet/aspnet:10.0

.docker/Dockerfile.identitylab

@@ -5,11 +5,13 @@ WORKDIR /src
 COPY . .
 
 RUN dotnet restore \
-    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj
+    apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj \
+    -p:UltimateAuthBuildTargetFrameworks=net10.0
 
 RUN dotnet publish \
     apps/identity-lab/CodeBeam.UltimateAuth.IdentityLab/CodeBeam.UltimateAuth.IdentityLab.csproj \
     -c Release \
+    -p:UltimateAuthBuildTargetFrameworks=net10.0 \
     --no-restore \
     -o /app/publish
 

.github/workflows/deploy.yml

@@ -1,49 +1,90 @@
-name: Deploy UltimateAuth
+name: Docs Site
 
 on:
+  pull_request:
   push:
     branches:
       - master
   workflow_dispatch:
 
 concurrency:
-  group: ultimateauth-deploy
+  # PR updates may cancel their own validation, never a production deployment.
+  group: ${{ github.event_name == 'pull_request' && format('docs-site-pr-{0}', github.event.pull_request.number) || 'ultimateauth-deploy' }}
   cancel-in-progress: true
 
 permissions:
   contents: read
   packages: write
 
 jobs:
-  build-and-deploy:
+  changes:
+    name: Changes
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      site: ${{ steps.filter.outputs.site }}
+    steps:
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            site:
+              - 'docs/**'
+              - 'src/utilities/CodeBeam.UltimateAuth.DocsBuilder/**'
+              - 'Directory.Build.props'
+              - 'Directory.Build.targets'
+              - 'Directory.Packages.props'
+              - 'global.json'
+              - 'NuGet.Config'
+              - 'nuget.config'
+              - '.dockerignore'
+              - '.docker/Dockerfile'
+              - '.docker/docker-compose.yml'
+              - '.github/workflows/deploy.yml'
 
+  build:
+    name: Docker Build
+    needs: changes
+    # Master and manual builds do not depend on a PR-only detector succeeding.
+    if: >-
+      !cancelled() &&
+      (github.event_name != 'pull_request' ||
+       (needs.changes.result == 'success' && needs.changes.outputs.site == 'true'))
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
       - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
-
       - name: Build and push image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: .docker/Dockerfile
-          push: true
+          push: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/master' }}
           tags: |
             ghcr.io/codebeamorg/ultimateauth:master
             ghcr.io/codebeamorg/ultimateauth:${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  deploy:
+    name: Deploy
+    needs: build
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    steps:
       - name: Deploy to Server
         uses: appleboy/ssh-action@v1.0.3
         with:

.github/workflows/identitylab-image.yml

@@ -1,55 +1,77 @@
-name: Identity Lab Docker Image
+name: Identity Lab
 
 on:
   pull_request:
-    paths:
-      - "apps/identity-lab/**"
-      - "src/**"
-      - "samples/**"
-      - ".docker/Dockerfile.identitylab"
-      - ".docker/docker-compose.identitylab.yml"
-      - ".github/workflows/identitylab-image.yml"
-
   push:
     branches:
       - lab
-    paths:
-      - "apps/identity-lab/**"
-      - "src/**"
-      - "samples/**"
-      - ".docker/Dockerfile.identitylab"
-      - ".docker/docker-compose.identitylab.yml"
-      - ".github/workflows/identitylab-image.yml"
-
   workflow_dispatch:
 
 permissions:
   contents: read
   packages: write
 
 concurrency:
-  group: identitylab-deploy
+  # PR validation cannot block or replace a production deployment run.
+  group: ${{ github.event_name == 'pull_request' && format('identitylab-pr-{0}', github.event.pull_request.number) || 'identitylab-deploy' }}
   cancel-in-progress: false
 
 jobs:
-  build:
+  changes:
+    name: Changes
+    if: github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      image: ${{ steps.filter.outputs.image }}
+    steps:
+      - name: Checkout for push comparison
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@v4
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            image:
+              - 'apps/identity-lab/**'
+              - 'src/**'
+              - 'samples/**'
+              - 'Directory.Build.props'
+              - 'Directory.Build.targets'
+              - 'Directory.Packages.props'
+              - 'global.json'
+              - 'NuGet.Config'
+              - 'nuget.config'
+              - '.dockerignore'
+              - '.docker/Dockerfile.identitylab'
+              - '.docker/docker-compose.identitylab.yml'
+              - '.github/workflows/identitylab-image.yml'
 
+  build:
+    name: Docker Build
+    needs: changes
+    # Manual image builds must also run when the PR/push detector is skipped.
+    if: >-
+      !cancelled() &&
+      (github.event_name == 'workflow_dispatch' ||
+       (needs.changes.result == 'success' && needs.changes.outputs.image == 'true'))
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Build and push Identity Lab
         uses: docker/build-push-action@v6
         with:
@@ -61,7 +83,7 @@ jobs:
           cache-to: type=gha,mode=max
 
   deploy:
-    name: Deploy Identity Lab
+    name: Deploy
     needs: build
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/lab'
     runs-on: ubuntu-latest

.github/workflows/javascript-tests.yml

@@ -0,0 +1,50 @@
+name: JS Client
+
+on:
+  pull_request:
+  push:
+    branches:
+      - dev
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      javascript: ${{ steps.filter.outputs.javascript }}
+    steps:
+      - name: Checkout for push comparison
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@v4
+      - name: Detect changed files
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            javascript:
+              - 'src/client/CodeBeam.UltimateAuth.Client.Blazor/TScripts/**'
+              - 'tests/CodeBeam.UltimateAuth.Tests.Unit/javascript/**'
+              - '.github/workflows/javascript-tests.yml'
+
+  tests:
+    name: Tests
+    needs: changes
+    if: needs.changes.outputs.javascript == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Run JavaScript tests
+        run: node --test tests/CodeBeam.UltimateAuth.Tests.Unit/javascript/*.test.cjs

.github/workflows/nuget-publish.yml

@@ -24,13 +24,26 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Resolve supported SDKs
+        id: frameworks
+        env:
+          DOTNET_NOLOGO: '1'
+        shell: bash
+        run: |
+          frameworks=$(dotnet msbuild src/CodeBeam.UltimateAuth.Core/CodeBeam.UltimateAuth.Core.csproj -nologo -getProperty:UltimateAuthTargetFrameworks)
+          {
+            echo 'sdks<<SDKS'
+            IFS=';' read -ra targets <<< "$frameworks"
+            for target in "${targets[@]}"; do
+              echo "${target#net}.x"
+            done
+            echo 'SDKS'
+          } >> "$GITHUB_OUTPUT"
+
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: |
-            8.0.x
-            9.0.x
-            10.0.x
+          dotnet-version: ${{ steps.frameworks.outputs.sdks }}
 
       - name: Verify package version
         shell: bash