Harden parsing, coverage, and plugin lifecycle

.github/workflows/CI_build.yml

@@ -5,12 +5,18 @@ on: [push, pull_request]
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build and tests (${{ matrix.build_configuration }}, ${{ matrix.build_platform }})
 
     runs-on: windows-2022
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       max-parallel: 6
       matrix:
         build_configuration: [Release, Debug]
@@ -42,6 +48,11 @@ jobs:
       if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Release'
       run: msbuild Package.proj /m /t:CorePerformance /p:Configuration=Release /p:Platform=x64
 
+    - name: Compatibility script safety tests
+      if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Debug'
+      shell: pwsh
+      run: msbuild Package.proj /m /t:RunCompatibilityScriptSafetyTests
+
     - name: Upload coverage to Codecov
       if: matrix.build_platform == 'x64' && matrix.build_configuration == 'Debug'
       uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
@@ -58,20 +69,26 @@ jobs:
       with:
           name: plugin_dll_x64
           path: bin64\MarkdownTableEditor.dll
+          if-no-files-found: error
+          retention-days: 14
 
     - name: Archive artifacts for Win32
       if: matrix.build_platform == 'Win32' && matrix.build_configuration == 'Release'
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
           name: plugin_dll_x86
           path: bin\MarkdownTableEditor.dll
+          if-no-files-found: error
+          retention-days: 14
 
     - name: Archive artifacts for ARM64
       if: matrix.build_platform == 'ARM64' && matrix.build_configuration == 'Release'
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
           name: plugin_dll_arm64
           path: arm64\MarkdownTableEditor.dll
+          if-no-files-found: error
+          retention-days: 14
 
   npp-ui-smoke:
     name: Tests / Notepad++ compatibility smoke

.github/workflows/CI_update_remote.yml

@@ -11,6 +11,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: notepad-interface-sync
+  cancel-in-progress: false
+
 jobs:
   update:
     # Keep the upstream sync limited to the canonical project repository.
@@ -20,10 +24,13 @@ jobs:
       contents: write
 
     runs-on: windows-2022
+    timeout-minutes: 30
 
     steps:
     - name: Checkout Markdown Table Editor repo
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        fetch-depth: 0
 
     - name: Checkout N++ repo
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -39,10 +46,6 @@ jobs:
       run: |
         any_difference=false
 
-        if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          any_difference=true
-        fi
-
         pairs=(
           "src/Scintilla.h|npp_repo/scintilla/include/Scintilla.h"
           "src/Sci_Position.h|npp_repo/scintilla/include/Sci_Position.h"
@@ -66,37 +69,44 @@ jobs:
           fi
         done
 
-        if [ "$any_difference" = true ]; then
-          echo "ANY_DIFFERENCE=True" >> "$GITHUB_OUTPUT"
-        fi
+        git diff --check
+        echo "ANY_DIFFERENCE=$any_difference" >> "$GITHUB_OUTPUT"
 
         date_now="$(date +%Y_%B_%d)"
         echo "CHANGE DATE will be $date_now"
         echo "CHANGE_DATE=$date_now" >> "$GITHUB_OUTPUT"
-        echo "HEAD_REF=$(git --git-dir=npp_repo/.git describe --always '@')" >> "$GITHUB_OUTPUT"
+        echo "HEAD_REF=$(git -C npp_repo rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
         rm -rf npp_repo
         git status
 
-    - name: Commit any updates to the repo
+    - name: If ANY_DIFFERENCE then add MSBuild to PATH
+      if: steps.diff_step.outputs.ANY_DIFFERENCE == 'true'
+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
+
+    - name: If ANY_DIFFERENCE then ensure ARM64 C++ build tools
+      if: steps.diff_step.outputs.ANY_DIFFERENCE == 'true'
+      shell: pwsh
+      run: .\scripts\Ensure-VsArm64Tools.ps1
+
+    - name: If ANY_DIFFERENCE then validate the synchronized interfaces
+      if: steps.diff_step.outputs.ANY_DIFFERENCE == 'true'
+      shell: pwsh
+      run: msbuild Package.proj /m "/t:BuildReleaseAllPlatforms;RunCoreSmokeTests;RunPluginShortcutSmokeTests;RunCompatibilityScriptSafetyTests"
+
+    - name: Commit validated updates to the repo
+      if: steps.diff_step.outputs.ANY_DIFFERENCE == 'true'
+      id: auto_commit
       uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
       with:
         # GitHub will auto-link the upstream ref to the corresponding commit
         commit_message: Sync Notepad++ interface files with notepad-plus-plus/notepad-plus-plus@${{ steps.diff_step.outputs.HEAD_REF }}
 
-    - name: If ANY_DIFFERENCE then add MSBuild to PATH
-      if: ${{steps.diff_step.outputs.ANY_DIFFERENCE}}
-      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
-
-    - name: If ANY_DIFFERENCE then run MSBuild of plugin dll
-      if: ${{steps.diff_step.outputs.ANY_DIFFERENCE}}
-      run: msbuild Package.proj /m /t:BuildReleaseAllPlatforms
-
     - name: Release
-      if: ${{steps.diff_step.outputs.ANY_DIFFERENCE}}
+      if: steps.auto_commit.outputs.changes_detected == 'true'
       uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
       with:
-        name: Markdown Table Editor Notepad++ interface sync v${{ steps.diff_step.outputs.CHANGE_DATE }}.${{github.run_number}}.${{github.run_attempt}}
-        tag_name: v${{ steps.diff_step.outputs.CHANGE_DATE }}.${{github.run_number}}.${{github.run_attempt}}
-        target_commitish: ${{ github.ref_name }}
+        name: Markdown Table Editor Notepad++ interface sync ${{ steps.diff_step.outputs.CHANGE_DATE }}.${{github.run_number}}.${{github.run_attempt}}
+        tag_name: npp-interface-sync-${{ steps.diff_step.outputs.CHANGE_DATE }}.${{github.run_number}}.${{github.run_attempt}}
+        target_commitish: ${{ steps.auto_commit.outputs.commit_hash }}
         token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/actionlint.yml

@@ -12,9 +12,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/codeql.yml

@@ -12,10 +12,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (cpp)
     runs-on: windows-2022
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read

.github/workflows/dependency-review.yml

@@ -2,15 +2,19 @@ name: Dependency Review
 
 on:
   pull_request:
-  workflow_dispatch:
 
 permissions:
   contents: read
   pull-requests: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/release.yml

@@ -13,9 +13,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   version:
     runs-on: windows-2022
+    timeout-minutes: 10
     outputs:
       version: ${{ steps.version.outputs.version }}
       tag: ${{ steps.version.outputs.tag }}
@@ -47,6 +52,7 @@ jobs:
   build:
     needs: version
     runs-on: windows-2022
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -87,6 +93,7 @@ jobs:
             build/MarkdownTableEditor-${{ needs.version.outputs.version }}-${{ matrix.label }}.zip
             build/MarkdownTableEditor-${{ needs.version.outputs.version }}-${{ matrix.label }}-pluginadmin.zip
           if-no-files-found: error
+          retention-days: 7
 
   compatibility-smoke:
     needs: version
@@ -111,6 +118,7 @@ jobs:
       - build
       - compatibility-smoke
     runs-on: windows-2022
+    timeout-minutes: 15
     permissions:
       contents: write
       id-token: write

.github/workflows/scorecard.yml

@@ -14,7 +14,7 @@ permissions: read-all
 jobs:
   scorecard:
     name: OSSF Scorecards
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       actions: read
@@ -45,3 +45,4 @@ jobs:
           name: openssf-scorecard
           path: scorecard-results.sarif
           if-no-files-found: error
+          retention-days: 14

Package.proj

@@ -194,7 +194,7 @@
         Func<double, string> formatDecimal = value => value.ToString("0.###############", CultureInfo.InvariantCulture);
         Action<XElement, int, int> setLineRate = (node, covered, valid) =>
         {
-            var rate = valid == 0 ? 1.0 : (double)covered / valid;
+            var rate = valid == 0 ? 0.0 : (double)covered / valid;
             node.SetAttributeValue("line-rate", formatDecimal(rate));
         };
         Func<string, string> relativePath = path =>
@@ -282,6 +282,11 @@
         var allClasses = document.Descendants("class").ToList();
         var linesValid = allClasses.Sum(node => node.Element("lines").Elements("line").Count());
         var linesCovered = allClasses.Sum(node => node.Element("lines").Elements("line").Count(line => ((int?)line.Attribute("hits") ?? 0) > 0));
+        if (linesValid == 0)
+        {
+            Log.LogError("Coverage report contains no source lines under {0}: {1}", sourceRoot, InputPath);
+            return false;
+        }
         var coverage = document.Root;
         setLineRate(coverage, linesCovered, linesValid);
         coverage.SetAttributeValue("lines-covered", linesCovered.ToString(CultureInfo.InvariantCulture));
@@ -317,11 +322,22 @@
         var coverage = document.Root;
         double actual;
         double minimum;
+        int linesValid;
         if (coverage == null || !Double.TryParse((string)coverage.Attribute("line-rate"), NumberStyles.Float, CultureInfo.InvariantCulture, out actual))
         {
             Log.LogError("Coverage report does not contain a valid root line-rate: {0}", InputPath);
             return false;
         }
+        if (!Int32.TryParse((string)coverage.Attribute("lines-valid"), NumberStyles.Integer, CultureInfo.InvariantCulture, out linesValid) || linesValid <= 0)
+        {
+            Log.LogError("Coverage report contains no valid source lines: {0}", InputPath);
+            return false;
+        }
+        if (Double.IsNaN(actual) || Double.IsInfinity(actual) || actual < 0.0 || actual > 1.0)
+        {
+            Log.LogError("Coverage report contains an invalid line-rate {0}: {1}", actual, InputPath);
+            return false;
+        }
         if (!Double.TryParse(MinimumLineRate, NumberStyles.Float, CultureInfo.InvariantCulture, out minimum))
         {
             Log.LogError("MinimumLineRate is not a valid decimal value: {0}", MinimumLineRate);
@@ -355,6 +371,7 @@
     <CoverageReportsDir>$(BuildDir)\reports\coverage</CoverageReportsDir>
     <RawCoverageReport>$(CoverageWorkDir)\coverage.raw.cobertura.xml</RawCoverageReport>
     <CoverageReport>$(CoverageReportsDir)\coverage.cobertura.xml</CoverageReport>
+    <CoverageSettings>$(ProjectRoot)tests\CodeCoverage.config</CoverageSettings>
     <MinimumCoreLineCoverage Condition="'$(MinimumCoreLineCoverage)'==''">0.70</MinimumCoreLineCoverage>
     <PackageRoot>$(BuildDir)\dist</PackageRoot>
     <PackageDir>$(PackageRoot)\MarkdownTableEditor</PackageDir>
@@ -482,6 +499,10 @@
     <Exec Command="&quot;$(PluginShortcutTestExe)&quot;" />
   </Target>
 
+  <Target Name="RunCompatibilityScriptSafetyTests">
+    <Exec Command="powershell -NoProfile -ExecutionPolicy Bypass -File &quot;$(ProjectRoot)scripts\Test-NppCompatibilitySmokeSafety.ps1&quot;" />
+  </Target>
+
   <Target Name="CleanCoverage">
     <RemoveDir Directories="$(CoverageWorkDir);$(CoverageReportsDir)" Condition="Exists('$(CoverageWorkDir)') Or Exists('$(CoverageReportsDir)')" />
     <MakeDir Directories="$(CoverageWorkDir);$(CoverageReportsDir)" />
@@ -494,7 +515,8 @@
   </Target>
 
   <Target Name="Coverage" DependsOnTargets="CleanCoverage;BuildCoreSmokeTests;ResolveCoverageInputs">
-    <Exec Command="&quot;$(CoverageConsole)&quot; collect --nologo --output &quot;$(RawCoverageReport)&quot; --output-format cobertura --include-files &quot;$(ProjectRoot)src\MarkdownTableCore.cpp&quot; &quot;$(TestExe)&quot;" />
+    <Exec WorkingDirectory="$(ProjectRoot)tests"
+          Command="&quot;$(CoverageConsole)&quot; collect --nologo --settings &quot;$(CoverageSettings)&quot; --output &quot;$(RawCoverageReport)&quot; --output-format cobertura &quot;$(TestExe)&quot;" />
     <NormalizeCoberturaCoverage InputPath="$(RawCoverageReport)"
                                 OutputPath="$(CoverageReport)"
                                 ProjectRoot="$(ProjectRoot)"