Harden release governance, versioning, and Pages deployment

.github/pull_request_template.md

@@ -0,0 +1,39 @@
+## Summary
+
+Describe the change, why it is needed, and the user or engineering impact.
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Protocol engine / packet behavior
+- [ ] Documentation / website
+- [ ] Refactor
+- [ ] Build / CI
+- [ ] Release preparation
+- [ ] Safety wording / guardrail
+
+## Engineering notes
+
+Explain any IEC 61850, Sampled Values, SCL/SCD, COMTRADE, PTP, timing, packet-layout, or UI behavior affected by this PR. Write **Not applicable** when the change is unrelated to runtime engineering behavior.
+
+## Safety impact
+
+- [ ] No runtime or live-network behavior changes
+- [ ] Changes offline parsing, display, reporting, or PCAP behavior only
+- [ ] Changes live capture behavior and was tested on an authorized isolated link
+- [ ] Changes live packet publishing and was tested on an authorized isolated link
+- [ ] Safety documentation or warnings were reviewed and updated where needed
+
+## Validation
+
+- [ ] `dotnet build ARSVIN.sln -c Release`
+- [ ] `dotnet test tests/ARSVIN.Tests/ARSVIN.Tests.csproj -c Release`
+- [ ] Public-site validator passed, when applicable
+- [ ] Release packaging and installer smoke test passed, when applicable
+- [ ] Manual dry run tested, when applicable
+- [ ] Live mode tested only on an isolated lab link, when applicable
+
+## Evidence
+
+Add relevant screenshots, sanitized Wireshark notes, test output, release artifact names, or a concise explanation when visual/packet evidence is not applicable.

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
 
       - name: Validate public site
         shell: pwsh

.github/workflows/codeql.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/pages.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'site/**'
       - 'docs/**'
+      - 'scripts/validate-public-site.ps1'
       - '.github/workflows/pages.yml'
   workflow_dispatch:
 
@@ -28,6 +29,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
+      - name: Validate public site
+        shell: pwsh
+        run: ./scripts/validate-public-site.ps1
+
       - name: Prepare site
         run: |
           mkdir -p site/docs

.github/workflows/release.yml

@@ -4,8 +4,6 @@ on:
   push:
     tags:
       - 'v*.*.*'
-    branches:
-      - 'release/v*.*.*'
   pull_request:
     branches: [ main ]
     paths:
@@ -23,7 +21,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version used for manual artifact builds (for example 0.3.0)'
+        description: 'Version used for a private workflow artifact build (for example 0.4.0-dev.1)'
         required: false
         default: '0.0.0-dev'
 
@@ -46,15 +44,18 @@ jobs:
       version: ${{ steps.version.outputs.value }}
       tag_name: ${{ steps.version.outputs.tag_name }}
       artifact_name: ${{ steps.version.outputs.artifact_name }}
+      is_prerelease: ${{ steps.version.outputs.is_prerelease }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 8.0.4xx
           cache: true
           cache-dependency-path: |
             **/*.csproj
@@ -64,18 +65,15 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          if ('${{ github.ref_type }}' -eq 'tag') {
-            $version = '${{ github.ref_name }}' -replace '^[vV]', ''
-          }
-          elseif ('${{ github.event_name }}' -eq 'workflow_dispatch') {
+          if ('${{ github.event_name }}' -eq 'workflow_dispatch') {
             $version = '${{ inputs.version }}'
             if ([string]::IsNullOrWhiteSpace($version)) {
               $version = '0.0.0-dev'
             }
             $version = $version -replace '^[vV]', ''
           }
-          elseif (('${{ github.event_name }}' -eq 'push') -and '${{ github.ref }}'.StartsWith('refs/heads/release/v')) {
-            $version = '${{ github.ref_name }}' -replace '^release/[vV]', ''
+          elseif ('${{ github.ref_type }}' -eq 'tag') {
+            $version = '${{ github.ref_name }}' -replace '^[vV]', ''
           }
           else {
             $version = "0.0.0-pr.$env:GITHUB_RUN_NUMBER"
@@ -87,11 +85,26 @@ jobs:
 
           $tagName = "v$version"
           $artifactName = "ARSVIN-$version-windows-x64"
+          $isPrerelease = $version.Contains('-').ToString().ToLowerInvariant()
+
           "value=$version" >> $env:GITHUB_OUTPUT
           "tag_name=$tagName" >> $env:GITHUB_OUTPUT
           "artifact_name=$artifactName" >> $env:GITHUB_OUTPUT
+          "is_prerelease=$isPrerelease" >> $env:GITHUB_OUTPUT
+
           Write-Host "Release version: $version"
           Write-Host "Release tag: $tagName"
+          Write-Host "Prerelease: $isPrerelease"
+
+      - name: Verify tagged commit belongs to main
+        if: github.ref_type == 'tag'
+        shell: pwsh
+        run: |
+          git fetch origin main --no-tags
+          git merge-base --is-ancestor "$env:GITHUB_SHA" 'origin/main'
+          if ($LASTEXITCODE -ne 0) {
+            throw "Tag ${{ github.ref_name }} does not point to a commit contained in main. Merge the release commit before tagging."
+          }
 
       - name: Build and test
         shell: pwsh
@@ -265,7 +278,7 @@ jobs:
 
   release:
     name: Publish GitHub Release
-    if: github.ref_type == 'tag' || (github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/v'))
+    if: github.ref_type == 'tag'
     needs: package
     runs-on: ubuntu-latest
     permissions:
@@ -284,7 +297,8 @@ jobs:
           tag_name: ${{ needs.package.outputs.tag_name }}
           target_commitish: ${{ github.sha }}
           name: ARSVIN ${{ needs.package.outputs.tag_name }}
-          make_latest: true
+          prerelease: ${{ needs.package.outputs.is_prerelease }}
+          make_latest: ${{ needs.package.outputs.is_prerelease == 'false' }}
           generate_release_notes: true
           fail_on_unmatched_files: true
           files: |

CHANGELOG.md

@@ -1,132 +1,71 @@
-## 2026-07-02 — Publisher close + subscriber phasor/header fix
-
-- Fixed publisher shutdown dispatch so late background UI events do not throw `NullReferenceException` after `Application.Current` starts closing.
-- Normalized ArSubsv phasor angles to `Va = 0°` so the subscriber phasor matches the publisher reference direction.
-- Cleaned the ArSubsv header: removed the duplicate header icon and made toolbar alignment more compact and modern.
-
-
-## 2026-07-02 — ArSubsv lean UI buildfix 3
-
-- Fixed ArSubsv auto-payload decoding to use `byte[].AsSpan()` instead of the non-existent `byte[].Span` property.
-- Added the shared in-memory process-bus transport sources to the test project so publisher session tests compile with the linked engine source.
-- Added an explicit `assembly=ARSVIN.Subscriber` hint for the ArSubsv custom controls namespace to reduce WPF designer resolution issues.
-
-## ARSVIN Subscriber companion app
-
-- Added `src/ARSVIN.Subscriber`, a separate WPF IEC 61850 Sampled Values subscriber and verification companion.
-- Added Npcap capture, SV APDU decode, SCL binding, stream health, sample-counter continuity checks, decoded value display, and Markdown verification report export.
-- Kept publisher and subscriber as separate applications so ARSVIN Publisher remains focused on SV generation.
-
 # Changelog
 
+All notable ARSVIN changes are documented here using a lightweight Keep a Changelog structure.
 
-### P2.1 Buildfix - Waveform Preview Shape Rendering
+## Unreleased
 
-- Updated the main waveform preview to render Manual harmonic injection, DC offset, and clipping.
-- Kept the advanced controls in the dedicated Waveform dialog so the main window remains clean.
+### Planned
 
+- Supply-chain pinning for GitHub Actions and installer tooling.
+- Shared `ARSVIN.Engine` class library extraction.
+- Code coverage and analyzer quality gates.
+- Search-indexable HTML engineering documentation.
 
-### P2 Full Publisher Scenario Engine
+## 0.3.0 — 2026-07-11
 
-- Expanded State Sequencer scenarios from balanced presets to per-phase publisher scenarios.
-- Added A-G fault, B-C fault, negative sequence, zero sequence, per-phase VT fuse fail, harmonic injection, and DC offset transient presets.
-- Added publisher-side waveform shaping metadata: DC offset, harmonic percentage/order, and clipping percentage.
-- Preserved backward compatibility with existing `.svpub.json` sequence snapshots.
-- Added `docs/p2-full-publisher-scenarios.md` and `samples/scenarios/p2-full-scenario-matrix.md`.
+### Added
 
-All notable changes to ARSVIN should be documented in this file.
+- Public Apache-2.0 ARSVIN suite positioning with separate Publisher and ArSubsv Subscriber applications.
+- Self-contained Windows x64 portable executables for Publisher and Subscriber.
+- Inno Setup suite installer with Start Menu shortcuts, documentation, samples, and uninstaller.
+- Portable suite ZIP and SHA-256 checksum release assets.
+- SCL/SCD-assisted SV stream configuration and validation.
+- Multi-ASDU Sampled Values publishing with `nofASDU=1/2/4/8`.
+- Manual values, ramps, state sequences, per-phase scenarios, waveform shaping, and COMTRADE replay.
+- Publisher timing-health metrics, generated PCAP export, and Markdown evidence reports.
+- ArSubsv live Npcap capture, classic-PCAP import, stream discovery, payload decoding, waveform, phasor, RMS, and receiver reports.
+- Real application screenshots in the public README and GitHub Pages product site.
+- SEO metadata, Open Graph, Twitter Card, `SoftwareApplication` JSON-LD, FAQ structured data, sitemap, robots, and web manifest.
+- GitHub Actions CI, full-solution CodeQL, Pages deployment, release packaging, installer smoke test, and dependency vulnerability reports.
 
-This project follows a simple public-release style:
+### Changed
 
-- `Added` for new features
-- `Changed` for changes in existing functionality
-- `Fixed` for bug fixes
-- `Security` for vulnerability-related changes
+- Reworked ArSubsv into a compact engineering workspace with a persistent stream explorer, dominant waveform view, phasor rail, values, frame details, diagnostics, and cursor comparison.
+- Normalized Subscriber phasor angles to `Va = 0°` for clearer Publisher/Subscriber comparison.
+- Centralized public documentation around transparent laboratory evidence and explicit IEC 61850 safety boundaries.
+- Made silent installer and uninstaller operation suitable for automated release validation.
 
-### P2.1 - Dedicated Waveform Shape Panel
+### Fixed
 
-- Added a dedicated `Waveform...` dialog instead of placing harmonic/DC/clipping controls on the main window.
-- Added Manual output shape editing for per-channel DC offset, harmonic, harmonic order, and clipping.
-- Added selected State Sequencer advanced shape editing for per-phase multipliers, angle offsets, DC offset, harmonic, clipping, and scenario tag.
-- Extended channel snapshots so Manual waveform shape is saved with `.svpub.json` plans and publisher slots.
+- Publisher shutdown dispatch no longer raises late UI exceptions while the application is closing.
+- Subscriber payload decoding, linked engine compilation, WPF control resolution, and frame parser build issues.
+- Publisher slot selection now updates the currently selected live slot instead of a stale startup selection.
+- Release packaging now fails immediately when external `dotnet` or installer commands fail.
 
+### Safety
 
-## Unreleased
+- Clarified that ARSVIN is not a calibrated protection test set, certified merging unit, deterministic real-time platform, production process-bus monitor, or IEC 61850 conformance tool.
+- Clarified that Publisher evidence proves generated traffic and Subscriber evidence proves PC/NIC reception, not IED consumption.
+- Kept Npcap external to the installer and limited live use to authorized, isolated laboratory networks.
+
+## 0.2.0 — 2026-07-02
 
 ### Added
 
-- P3 public presentation pack:
-  - rewritten top-level README for professional public release positioning,
-  - SEO-optimized GitHub Pages landing page,
-  - Open Graph / social preview image assets,
-  - documentation index,
-  - SEO and public launch checklist,
-  - GitHub repository settings guide,
-  - FAQ structured data on the landing page.
-- P2 publisher scenario presets in the State Sequencer: protection fault, CT saturation stress approximation, undervoltage approximation, frequency steps, phase jump, and load reversal.
-- Scenario preset key is saved in `.svpub.json` publish plans for traceability.
-- Documentation for the P2 scenario preset workflow.
-- P1 Markdown publisher evidence report export.
-- P1 TX-side SCL validation and stream summary in evidence reports.
-- P1 report button beside generated PCAP export.
-- P0.2 TX Timing Health metrics: target/actual FPS, jitter, late frames, missed schedules, and send duration.
-- P0.1 selected-slot SV quality presets and runtime quality-bit injection.
-- P0.1 generated PCAP export for offline Wireshark/tool verification.
-- P0 SV publisher protocol upgrade: `nofASDU=1/2/4/8` support.
-- Multi-ASDU SavPdu generation with sequential per-ASDU `smpCnt`.
-- Second-aligned sample counter initialization for lab publishing.
-- Publisher SCL validation and frame preview helpers.
-- Golden-style unit tests for multi-ASDU frame round-trip, quality bits, sample counter, timing health, report writer, and PCAP output.
-- Sample SCL file for `nofASDU=8`.
+- Initial ArSubsv IEC 61850 Sampled Values Subscriber companion.
+- Npcap capture, SV APDU decode, SCL binding, stream-health analysis, sample-counter continuity checks, decoded values, waveform, phasor, RMS, PCAP replay, and Markdown verification reports.
 
 ### Changed
 
-- README now presents ARSVIN as a focused IEC 61850 Sampled Values Publisher for Windows instead of a broad process-bus tester.
-- Landing page now emphasizes honest publisher scope, generated evidence, and safety boundaries.
+- Kept Publisher and Subscriber as separate applications so each workflow remains focused and its evidence boundary remains clear.
 
-## 0.1.0
+## 0.1.0 — 2026-06-01
 
 ### Added
 
-- Initial public Apache-2.0 repository structure.
-- WPF desktop app for IEC 61850 Sampled Values publishing.
-- SCL-based SV stream setup.
+- Initial Windows WPF IEC 61850 Sampled Values Publisher.
+- SCL-based stream setup.
 - Manual, ramp, and state-sequenced publishing workflows.
-- COMTRADE replay support.
-- Lab PTP and `smpSynch` compatibility controls.
-- GitHub Actions CI, CodeQL, Pages, and release packaging.
-
-
-## ArSubsv SV Scout Companion
-
-- Added ArSubsv branding for the subscriber companion application.
-- Added live SV discovery workflow, Scope/Phasor/Values/Frame/Diagnostics tabs.
-- Added oscilloscope-style waveform preview for SCL-decoded current/voltage samples.
-- Added phasor/RMS/peak/angle calculation from decoded waveform history.
-- Added classic PCAP import for offline stream verification.
-- Expanded receiver-side Markdown evidence report with phasor and quality summary.
-
-### ArSubsv buildfix 2
-- Fixed Subscriber frame parser call to pass `ReadOnlyMemory<byte>` directly instead of `ReadOnlySpan<byte>`.
-- Keeps custom oscilloscope/phasor controls compiled in the Subscriber project; remaining XAML designer warnings should clear after clean/rebuild.
-
-## Unreleased — ArSubsv DigSubAnalyzer-style receiver UI hotfix
-
-- Reworked ArSubsv into a dark, engineering workspace inspired by DigSubAnalyzer's process-bus analyzer shell.
-- Replaced the light prototype layout with a compact stream explorer, selected stream inspector, scope, phasor, values, frame, and diagnostics workspace.
-- Added auto fixed payload decoding for 9-2LE/UCA-style 4I+4V streams and common value+quality sample layouts so waveform/phasor views work without SCL when the payload profile is recognizable.
-- Updated oscilloscope and phasor controls to use a dark process-bus visual style and live traces instead of the previous blank prototype scope.
-
-## Unreleased — ArSubsv Lean Engineering UI
-
-- Reworked ArSubsv into a lean Linear/shadcn-inspired engineering workspace.
-- Removed the dashboard metric card row; live counts now live in a compact status bar.
-- Made SV Explorer the persistent left rail.
-- Made waveform the dominant center workspace and phasor the persistent right rail.
-- Kept values, frame details, diagnostics, and cursor compare as secondary tabs.
-- Refined oscilloscope and phasor colors to match the lean dark shell.
-
-## Publisher slot selection hotfix
-
-- Fixed live auto-apply routing so editing SV2/SV3 while publishing updates the currently selected publisher slot instead of the slot that was selected when publishing started.
-- Manual edits are now saved to the selected slot and the live loop resolves the selected slot dynamically per frame.
+- COMTRADE replay.
+- Laboratory PTP and `smpSynch` compatibility controls.
+- Initial CI, CodeQL, Pages, and release packaging.

Directory.Build.props

@@ -1,11 +1,12 @@
 <Project>
   <PropertyGroup>
-    <LangVersion>latest</LangVersion>
+    <LangVersion>12.0</LangVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
     <ContinuousIntegrationBuild Condition="'$(CI)' == 'true'">true</ContinuousIntegrationBuild>
     <Deterministic>true</Deterministic>
+    <VersionPrefix>0.3.0</VersionPrefix>
     <RepositoryUrl>https://github.com/masarray/arsvin</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>