Declare workflow YAML as LF and validate line endings in CI

.editorconfig

@@ -37,6 +37,11 @@ indent_size = 2
 end_of_line = crlf
 indent_size = 2
 
+# Workflow YAML is LF: Dependabot and Actions rewrite it with LF, so declaring LF keeps it consistent instead of
+# mixed. git still leaves endings alone (`* -text`); this and CI (editorconfig-checker) enforce it. Other YAML is CRLF.
+[.github/workflows/*.{yml,yaml}]
+end_of_line = lf
+
 # JSON and JSONC files
 [*.{json,jsonc}]
 end_of_line = crlf

.editorconfig-checker.json

@@ -0,0 +1,10 @@
+{
+  "Disable": {
+    "Charset": true,
+    "Indentation": true,
+    "IndentSize": true,
+    "TrimTrailingWhitespace": true,
+    "InsertFinalNewline": true,
+    "MaxLineLength": true
+  }
+}

.github/workflows/merge-bot-pull-request.yml

@@ -1,87 +1,87 @@
-name: Merge bot pull request action
-
-# Enables auto-merge on Dependabot pull requests and disables it when a maintainer pushes to the bot
-# branch. Auto-merge completes only once the required checks pass, so a breaking update blocks itself.
-# Merge method follows the base: squash for develop, merge commit for main.
-#
-# Every job mints an App token. The built-in GITHUB_TOKEN will not do: its merge commits do not trigger
-# downstream workflows (GitHub's recursion guard), and on a Dependabot pull request it is read-only.
-#
-# Trigger is pull_request_target, not pull_request, so action SHAs resolve from the base branch while the
-# jobs hold the App key. Safe because this workflow never checks out PR code, it only runs `gh pr merge`
-# against the PR URL.
-on:
-  pull_request_target:
-    types: [opened, reopened, synchronize]
-
-# Key on the PR number, not github.ref (the base branch under pull_request_target, which would serialize
-# every bot PR). cancel-in-progress: false so a synchronize does not cancel an in-flight opened run before
-# it enables auto-merge.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-
-  merge-dependabot:
-    name: Merge dependabot pull request job
-    runs-on: ubuntu-latest
-    # In-repo Dependabot PRs only, on opened/reopened so the disable job stays sticky. Every tier
-    # auto-merges, semver-major included: the required checks are the gate, not the version bump.
-    if: >-
-      (github.event.action == 'opened' || github.event.action == 'reopened') &&
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.event.pull_request.head.repo.full_name == github.repository
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Merge pull request step
-        run: |
-          set -euo pipefail
-          case "${{ github.event.pull_request.base.ref }}" in
-            develop) method=--squash ;;
-            main) method=--merge ;;
-            *) echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"; exit 1 ;;
-          esac
-          gh pr merge --auto --delete-branch "$method" "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-
-  disable-auto-merge-on-maintainer-push:
-    name: Disable auto-merge on maintainer push job
-    runs-on: ubuntu-latest
-    # A maintainer push to a bot branch (synchronize, actor is not the bot) disables auto-merge so the
-    # maintainer's commits do not merge with the bot's. Re-enable manually. The disable call is idempotent.
-    if: >-
-      github.event.action == 'synchronize' &&
-      github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login == 'dependabot[bot]' &&
-      github.actor != github.event.pull_request.user.login
-    permissions:
-      pull-requests: write
-
-    steps:
-
-      - name: Generate GitHub App token step
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
-
-      - name: Disable auto-merge step
-        run: gh pr merge --disable-auto "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+name: Merge bot pull request action
+
+# Enables auto-merge on Dependabot pull requests and disables it when a maintainer pushes to the bot
+# branch. Auto-merge completes only once the required checks pass, so a breaking update blocks itself.
+# Merge method follows the base: squash for develop, merge commit for main.
+#
+# Every job mints an App token. The built-in GITHUB_TOKEN will not do: its merge commits do not trigger
+# downstream workflows (GitHub's recursion guard), and on a Dependabot pull request it is read-only.
+#
+# Trigger is pull_request_target, not pull_request, so action SHAs resolve from the base branch while the
+# jobs hold the App key. Safe because this workflow never checks out PR code, it only runs `gh pr merge`
+# against the PR URL.
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+# Key on the PR number, not github.ref (the base branch under pull_request_target, which would serialize
+# every bot PR). cancel-in-progress: false so a synchronize does not cancel an in-flight opened run before
+# it enables auto-merge.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+
+  merge-dependabot:
+    name: Merge dependabot pull request job
+    runs-on: ubuntu-latest
+    # In-repo Dependabot PRs only, on opened/reopened so the disable job stays sticky. Every tier
+    # auto-merges, semver-major included: the required checks are the gate, not the version bump.
+    if: >-
+      (github.event.action == 'opened' || github.event.action == 'reopened') &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Merge pull request step
+        run: |
+          set -euo pipefail
+          case "${{ github.event.pull_request.base.ref }}" in
+            develop) method=--squash ;;
+            main) method=--merge ;;
+            *) echo "::error::Unsupported base branch: ${{ github.event.pull_request.base.ref }}"; exit 1 ;;
+          esac
+          gh pr merge --auto --delete-branch "$method" "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  disable-auto-merge-on-maintainer-push:
+    name: Disable auto-merge on maintainer push job
+    runs-on: ubuntu-latest
+    # A maintainer push to a bot branch (synchronize, actor is not the bot) disables auto-merge so the
+    # maintainer's commits do not merge with the bot's. Re-enable manually. The disable call is idempotent.
+    if: >-
+      github.event.action == 'synchronize' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.actor != github.event.pull_request.user.login
+    permissions:
+      pull-requests: write
+
+    steps:
+
+      - name: Generate GitHub App token step
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.CODEGEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CODEGEN_APP_PRIVATE_KEY }}
+
+      - name: Disable auto-merge step
+        run: gh pr merge --disable-auto "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/publish-release.yml

@@ -1,56 +1,56 @@
-name: Publish project release action
-
-# Branch-scoped self-publisher: a push to main or develop, or a manual dispatch, publishes that branch.
-#
-# - Trigger: a push that changes a shipped input (the on.push.paths inclusion list below - library source,
-#   version floor, build configuration, or package versions), or a workflow_dispatch on the target branch.
-# - Inclusion-only: add a path to that list when a new input starts affecting the shipped package. Package
-#   versions (Directory.Packages.props) ARE listed: a NuGet package cannot be rebuilt on a cadence (a version
-#   can't be re-pushed), so a dependency bump must republish to keep the package's declared dependencies
-#   current - this closes the stale/vulnerable-dependency window. GitHub Actions bumps are not listed (they do
-#   not ship in the package), so an Actions Dependabot bump does not republish (a package-version bump does).
-# - Output: main publishes a stable release, develop a prerelease. A dispatch force-publishes its branch.
-# - Gate: the publish job needs the same validate-task the PR runs, so nothing publishes that would fail
-#   validation, on any path (push, dispatch, or force-push).
-# - The merge-bot merges with an App token, so its merge commits reach this push trigger.
-on:
-  push:
-    branches: [main, develop]
-    paths:
-      - 'Utilities/**'
-      - 'version.json'
-      - 'Directory.Build.props'
-      - 'Directory.Packages.props'
-  workflow_dispatch:
-
-# Ref-independent group so concurrent publishes serialize, and cancel-in-progress: false so a publish is
-# never cancelled mid-release (a half-created GitHub release or partial NuGet push).
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-jobs:
-
-  # The same unit-test + lint gate the PR runs. The publish job needs it, so a failing test or lint blocks
-  # the release.
-  validate:
-    name: Validate job
-    uses: ./.github/workflows/validate-task.yml
-
-  # Build, version, validate, push, and release the triggering branch. Grants the write scopes
-  # build-release-task needs (it declares none, so the read-only smoke caller is not forced to over-grant).
-  # The push trigger is already limited to main/develop, and the if-guard covers a workflow_dispatch, which
-  # can target any branch.
-  publish:
-    name: Publish project release job
-    needs: validate
-    if: ${{ github.event_name == 'push' || github.ref_name == 'main' || github.ref_name == 'develop' }}
-    uses: ./.github/workflows/build-release-task.yml
-    secrets: inherit
-    permissions:
-      contents: write
-      id-token: write
-      actions: write
-    with:
-      publish: true
-      smoke: false
+name: Publish project release action
+
+# Branch-scoped self-publisher: a push to main or develop, or a manual dispatch, publishes that branch.
+#
+# - Trigger: a push that changes a shipped input (the on.push.paths inclusion list below - library source,
+#   version floor, build configuration, or package versions), or a workflow_dispatch on the target branch.
+# - Inclusion-only: add a path to that list when a new input starts affecting the shipped package. Package
+#   versions (Directory.Packages.props) ARE listed: a NuGet package cannot be rebuilt on a cadence (a version
+#   can't be re-pushed), so a dependency bump must republish to keep the package's declared dependencies
+#   current - this closes the stale/vulnerable-dependency window. GitHub Actions bumps are not listed (they do
+#   not ship in the package), so an Actions Dependabot bump does not republish (a package-version bump does).
+# - Output: main publishes a stable release, develop a prerelease. A dispatch force-publishes its branch.
+# - Gate: the publish job needs the same validate-task the PR runs, so nothing publishes that would fail
+#   validation, on any path (push, dispatch, or force-push).
+# - The merge-bot merges with an App token, so its merge commits reach this push trigger.
+on:
+  push:
+    branches: [main, develop]
+    paths:
+      - 'Utilities/**'
+      - 'version.json'
+      - 'Directory.Build.props'
+      - 'Directory.Packages.props'
+  workflow_dispatch:
+
+# Ref-independent group so concurrent publishes serialize, and cancel-in-progress: false so a publish is
+# never cancelled mid-release (a half-created GitHub release or partial NuGet push).
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+
+  # The same unit-test + lint gate the PR runs. The publish job needs it, so a failing test or lint blocks
+  # the release.
+  validate:
+    name: Validate job
+    uses: ./.github/workflows/validate-task.yml
+
+  # Build, version, validate, push, and release the triggering branch. Grants the write scopes
+  # build-release-task needs (it declares none, so the read-only smoke caller is not forced to over-grant).
+  # The push trigger is already limited to main/develop, and the if-guard covers a workflow_dispatch, which
+  # can target any branch.
+  publish:
+    name: Publish project release job
+    needs: validate
+    if: ${{ github.event_name == 'push' || github.ref_name == 'main' || github.ref_name == 'develop' }}
+    uses: ./.github/workflows/build-release-task.yml
+    secrets: inherit
+    permissions:
+      contents: write
+      id-token: write
+      actions: write
+    with:
+      publish: true
+      smoke: false