From 3e06a4e7ab91eb0edf50ba8519d15eb7b6a9d4ca Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 25 Apr 2026 01:13:36 +0000
Subject: [PATCH] eng: add src/Directory.Build.props with analyzer and NuGet
 audit settings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a Directory.Build.props for OpenClaw.Shared, OpenClaw.Tray.WinUI,
and OpenClaw.Cli that aligns them with the quality baseline already
present in OpenClaw.CommandPalette/Directory.Build.props.

Changes:
- EnableNETAnalyzers=true: explicit (already the SDK default for .NET 5+)
- AnalysisMode=Recommended: enables the Recommended rule set (superset of
  Default), matching CommandPalette's existing setting
- NuGetAuditMode=all: audit direct AND transitive packages for known CVEs
  during restore (default is 'direct')

OpenClaw.CommandPalette is NOT affected — MSBuild stops at its own
Directory.Build.props one directory level deeper and does not walk up
to this file.

Test status: 652 passed, 20 skipped (unchanged from baseline).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/Directory.Build.props | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 src/Directory.Build.props

diff --git a/src/Directory.Build.props b/src/Directory.Build.props
new file mode 100644
index 00000000..20b177cc
--- /dev/null
+++ b/src/Directory.Build.props
@@ -0,0 +1,30 @@
+<Project>
+
+  <!--
+    Shared build configuration for OpenClaw.Shared, OpenClaw.Tray.WinUI, and OpenClaw.Cli.
+
+    OpenClaw.CommandPalette has its own Directory.Build.props one level deeper, so MSBuild
+    stops walking up at that file and this one does NOT apply to CommandPalette.
+
+    Properties here set a consistent quality baseline that matches the CommandPalette project's
+    existing settings and are safe defaults for all src projects:
+      - NET analyzers + Recommended rule set: catch common bugs and anti-patterns
+      - NuGetAudit covers transitive packages so CVEs in indirect deps surface during restore
+  -->
+
+  <PropertyGroup>
+    <!-- Enable the built-in .NET source analyzers (already the SDK default for net5+,
+         but made explicit here so the intent is clear and auditable). -->
+    <EnableNETAnalyzers>true</EnableNETAnalyzers>
+
+    <!-- Recommended rule set: a superset of Default that enables additional quality rules
+         aligned with the CommandPalette project's AnalysisMode=Recommended setting.
+         Rules produce warnings only; src projects do not set TreatWarningsAsErrors. -->
+    <AnalysisMode>Recommended</AnalysisMode>
+
+    <!-- Audit all package dependencies (direct + transitive) for known CVEs during restore.
+         Defaults to "direct" in the SDK; "all" provides broader security coverage. -->
+    <NuGetAuditMode>all</NuGetAuditMode>
+  </PropertyGroup>
+
+</Project>