[CI][Backend] Unit Tests red since Batch S (dcproj NU1105 via Directory.Build.props pins) + ArtPipe per-model images broken since CPM (Dockerfile.model missing Packages.props) #623

New Issue

2026-07-17T00:50:13Z

spikerj commented

2026-07-17 00:50:13 +00:00

Found while verifying post-merge CI for the #618 part-2 merges (backend 52c67fcc). Both failures pre-date #618 and were masked by cancelled runs during yesterday's rapid merge train.

Symptom 1 — Unit Tests workflow red on every master push since Batch S

tests.yml fails at dotnet restore SpikerSoft.sln:

docker-compose.dcproj : error NU1105: Invalid target framework ''.
NuGet.targets(198,5): error : Invalid restore input. One or more invalid frameworks were detected. Input files: docker-compose.dcproj.

First red on d88a0565 (#335 merge); runs on the two commits before that were cancelled (superseded), so it was never seen green/red in between. Root cause bisected locally: the Batch S transitive-security pins (c3dd9a1d, PR #328 stack) added solution-wide <PackageReference> items to Directory.Build.props. Those inject into EVERY project — including docker-compose.dcproj, which has no TargetFramework — so NuGet now treats the dcproj as restorable and dies. NOT caused by CPM (reproduces with Directory.Packages.props removed).

Symptom 2 — ArtPipeProcessor per-model worker images fail to build since CPM (Batch P)

ArtPipeProcessor workflow, step "Build + push per-model worker images (#515)":

error NU1015: The following PackageReference item(s) do not have a version specified: ...

The CPM Dockerfile hotfix (#334) added COPY Directory.Packages.props to the per-service Dockerfiles but missed SpikerSoft.EventHandlers.ArtPipeProcessor/Dockerfile.model (the per-model image variant). Failing since at least the #334 merge (run 8298).

Fix

One PR: (1) scope the Directory.Build.props security-pin ItemGroup with Condition="'$(MSBuildProjectExtension)' == '.csproj'" so the dcproj is untouched; (2) add the missing COPY Directory.Packages.props to Dockerfile.model. Verified locally: dotnet restore SpikerSoft.sln clean, dotnet build SpikerSoft.UnitTests.slnf -c Release 0 errors.

Found while verifying post-merge CI for the #618 part-2 merges (backend 52c67fcc). **Both failures pre-date #618 and were masked by cancelled runs during yesterday's rapid merge train.** ## Symptom 1 — Unit Tests workflow red on every master push since Batch S `tests.yml` fails at `dotnet restore SpikerSoft.sln`: ``` docker-compose.dcproj : error NU1105: Invalid target framework ''. NuGet.targets(198,5): error : Invalid restore input. One or more invalid frameworks were detected. Input files: docker-compose.dcproj. ``` First red on d88a0565 (#335 merge); runs on the two commits before that were cancelled (superseded), so it was never seen green/red in between. Root cause bisected locally: the **Batch S transitive-security pins** (c3dd9a1d, PR #328 stack) added solution-wide `<PackageReference>` items to `Directory.Build.props`. Those inject into EVERY project — including `docker-compose.dcproj`, which has no TargetFramework — so NuGet now treats the dcproj as restorable and dies. NOT caused by CPM (reproduces with Directory.Packages.props removed). ## Symptom 2 — ArtPipeProcessor per-model worker images fail to build since CPM (Batch P) `ArtPipeProcessor` workflow, step "Build + push per-model worker images (#515)": ``` error NU1015: The following PackageReference item(s) do not have a version specified: ... ``` The CPM Dockerfile hotfix (#334) added `COPY Directory.Packages.props` to the per-service Dockerfiles but missed **`SpikerSoft.EventHandlers.ArtPipeProcessor/Dockerfile.model`** (the per-model image variant). Failing since at least the #334 merge (run 8298). ## Fix One PR: (1) scope the Directory.Build.props security-pin ItemGroup with `Condition="'$(MSBuildProjectExtension)' == '.csproj'"` so the dcproj is untouched; (2) add the missing `COPY Directory.Packages.props` to Dockerfile.model. Verified locally: `dotnet restore SpikerSoft.sln` clean, `dotnet build SpikerSoft.UnitTests.slnf -c Release` 0 errors.

spikerj added the bug label 2026-07-17 00:50:13 +00:00

spikerj referenced this issue

2026-07-17 01:04:59 +00:00

[Security][Backend][Books] Private books are listable and downloadable by any authenticated user — /api/book/all and /api/book/{id}/file have no visibility/ownership check #618

spikerj commented

2026-07-17 01:06:45 +00:00

Timeline validated against the full Unit Tests task history: last green run was 9e9a137c (2026-07-16 22:30); the Batch S PR run itself failed (c3dd9a1d, 22:10) and every run since — including the Batch S merge (5a8a0c4b, 22:38) and all #618 PR branches — has been red. The merge-train cancellations hid it and the red PR run was overlooked. Fix PR: spikersoft-backend#337.

Timeline validated against the full Unit Tests task history: last green run was 9e9a137c (2026-07-16 22:30); the **Batch S PR run itself failed** (c3dd9a1d, 22:10) and every run since — including the Batch S merge (5a8a0c4b, 22:38) and all #618 PR branches — has been red. The merge-train cancellations hid it and the red PR run was overlooked. Fix PR: spikersoft-backend#337.

spikerj commented

2026-07-17 02:08:45 +00:00

Resolved in spikersoft-backend PR #337 (merged to master, 97198fdc), now CI-proven on the merge commit:

ArtPipeProcessor workflow: green on the merge push (build_and_publish + deploy success) — the per-model NU1015 is gone.
Unit Tests: the workflow's paths filter does not include Directory.Build.props, so the merge did not trigger it; dispatched it manually on master (run 15059) → success. dotnet restore SpikerSoft.sln works again.

Follow-up hardening PR incoming: add Directory.Build.props / Directory.Packages.props to the tests workflow's path triggers — the missing trigger is exactly what let Batch S break restore invisibly (same lesson as #583). Closing.

Resolved in spikersoft-backend PR #337 (merged to `master`, 97198fdc), now **CI-proven on the merge commit**: - ArtPipeProcessor workflow: green on the merge push (build_and_publish + deploy success) — the per-model NU1015 is gone. - Unit Tests: the workflow's `paths` filter does not include `Directory.Build.props`, so the merge did not trigger it; dispatched it manually on master (run 15059) → **success**. `dotnet restore SpikerSoft.sln` works again. Follow-up hardening PR incoming: add `Directory.Build.props` / `Directory.Packages.props` to the tests workflow's path triggers — the missing trigger is exactly what let Batch S break restore invisibly (same lesson as #583). Closing.

spikerj closed this issue

2026-07-17 02:08:45 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#623