Modernize to .NET 10, new auth architecture, and JSON:API support

.github/workflows/ci.yml

@@ -0,0 +1,138 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [master, 'release/**']
+
+permissions:
+  contents: write
+  checks: write
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  build-test-pack:
+    name: Build, Test, Pack
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0 # Nerdbank.GitVersioning needs full history
+
+      - name: Prepare release branch
+        if: startsWith(github.ref, 'refs/heads/release/')
+        shell: pwsh
+        run: |
+          $content = Get-Content version.json -Raw
+          if ($content -match '"version"\s*:\s*"[^"]*-') {
+            $content = $content -replace '("version"\s*:\s*"[^"]*)-[^"]*"', '$1"'
+            Set-Content version.json $content -NoNewline
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git add version.json
+            git commit -m "chore: strip pre-release tag for release branch"
+            git push
+          }
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: '10.0.x'
+          dotnet-quality: ga
+
+      - name: Restore
+        run: dotnet restore src/TenantCloud.slnx --force
+
+      - name: Build
+        run: dotnet build src/TenantCloud.slnx -c Release -warnaserror --no-restore
+
+      - name: Test
+        run: >-
+          dotnet test --solution src/TenantCloud.slnx
+          -c Release
+          --no-build
+          --results-directory TestResults
+          --
+          --report-trx
+          --coverage
+          --coverage-output-format cobertura
+
+      - name: Test report
+        if: always()
+        uses: dorny/test-reporter@v1
+        with:
+          name: Test Results
+          path: 'TestResults/**/*.trx'
+          reporter: dotnet-trx
+
+      - name: Coverage summary
+        if: always()
+        shell: pwsh
+        run: |
+          $coberturaFiles = Get-ChildItem -Path TestResults -Filter '*.cobertura.xml' -Recurse -ErrorAction SilentlyContinue
+          if (-not $coberturaFiles -or $coberturaFiles.Count -eq 0) {
+            Write-Host 'No Cobertura coverage files found — skipping summary.'
+            exit 0
+          }
+          foreach ($file in $coberturaFiles) {
+            [xml]$xml = Get-Content $file.FullName
+            $lineRate = [math]::Round([double]$xml.coverage.'line-rate' * 100, 1)
+            $branchRate = [math]::Round([double]$xml.coverage.'branch-rate' * 100, 1)
+            "## Code Coverage`n" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+            "| Metric | Value |" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+            "|--------|-------|" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+            "| Line coverage | ${lineRate}% |" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+            "| Branch coverage | ${branchRate}% |" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+            Write-Host "Line coverage: ${lineRate}%, Branch coverage: ${branchRate}%"
+          }
+
+      - name: Pack
+        run: dotnet pack src/TenantCloud.slnx -c Release --no-restore -o ${{ runner.temp }}/packages
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: test-results
+          path: TestResults/**
+          retention-days: 14
+
+      - name: Upload packages
+        if: success()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: packages
+          path: ${{ runner.temp }}/packages/*.nupkg
+          retention-days: 14
+
+      - name: Resolve version
+        id: version
+        if: success() && github.event_name == 'push'
+        shell: pwsh
+        run: |
+          dotnet tool install -g nbgv
+          $v = nbgv get-version -v NuGetPackageVersion
+          echo "version=$v" >> $env:GITHUB_OUTPUT
+
+      - name: Publish to NuGet
+        if: success() && github.event_name == 'push'
+        run: >-
+          dotnet nuget push "${{ runner.temp }}/packages/*.nupkg"
+          --source https://api.nuget.org/v3/index.json
+          --api-key ${{ secrets.NUGET_API_KEY }}
+          --skip-duplicate
+
+      - name: Create GitHub Release
+        if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          gh release create "v${{ steps.version.outputs.version }}"
+          "${{ runner.temp }}/packages/*.nupkg"
+          --title "v${{ steps.version.outputs.version }}"
+          --generate-notes

.gitignore

@@ -337,4 +337,8 @@ ASALocalRun/
 .localhistory/
 
 # BeatPulse healthcheck temp database
-healthchecksdb
+healthchecksdb
+
+# TenantCloud MCP auth tokens (secrets!)
+.tenantcloud-mcp/
+.claude/