Enum Member Name Binding

https://github.com/Reefact/enum-member-name-binding — a public Git repository, readable and clonable without an account.

Git records the author, the timestamp and a message for every change. Message quality is enforced rather than hoped for: Conventional Commits are checked by tools/commit-lint/lint-commit-message.sh, the one script run both by the commit-msg hook and by CI, so the two cannot drift apart.

main carries the full development history, not only released versions: every change lands through a pull request, squashed or rebased, and is public from the moment it is pushed. A repository ruleset refuses direct pushes, force pushes and merge commits on main, so the branch is a reviewable linear record of the work between releases. Nothing is withheld from the public repository.

Repository on GitHub, which uses git. git is distributed.

The Git tag is the single source of truth for a version. The release workflow derives the package version from the tag name (v<X.Y.Z>), validates it against a SemVer 2.0.0 allowlist before anything is built, and refuses build metadata because nuget.org would drop it and publish a version other than the one the tag names. Local builds carry 0.0.0-dev and are never published, and nuget.org refuses a version that already exists. No version has been released yet; the first one will follow this scheme.

A release is triggered by pushing a v* tag, and the workflow additionally refuses to publish unless that tag points at a commit already on main — so a released version is identified by a tag on reviewed history, by construction. No tag exists yet; the first release will create one.

https://github.com/Reefact/enum-member-name-binding/blob/main/CHANGELOG.md — a written, human-readable summary following Keep a Changelog 1.1.0 and Semantic Versioning, not the raw output of a version-control log: each entry explains what changed and why it matters to a consumer. A French counterpart is maintained at docs/CHANGELOG.fr.md and the pair is compared structurally by the test suite. The release workflow additionally creates a GitHub release for each tag and attaches the packages. No version has been released yet.

No version has been released and no vulnerability in this project has ever been publicly known, so there is nothing for release notes to identify. The criterion's own guidance says to choose N/A when there have been no publicly known vulnerabilities. SECURITY.md commits to publishing an advisory once a report is confirmed and fixed, naming the affected and corrected versions and carrying a CVE identifier where one is appropriate.

Bugs are reported as GitHub issues at https://github.com/Reefact/enum-member-name-binding/issues. SECURITY.md draws the line explicitly: a suspected vulnerability goes through a private advisory and must not be filed as a public issue, while everything else — ordinary bugs with no security impact, feature requests, documentation mistakes, and problems only reproducible on an unsupported version — is welcome as a public issue.

GitHub Issues, one issue per problem, with labels, assignment and cross-referencing to the pull request that closes it.

The project is new — the repository was created on 5 August 2026 — and no bug report has been received yet, so there is no unanswered report of any kind. The tracker is open and monitored by the maintainer, and SECURITY.md sets an explicit acknowledgement target of 3 business days for reports arriving on the private channel.

No enhancement request has been received yet — the project is new and the tracker is empty, so none is outstanding. Requests will be answered on the issue itself, including when the answer is no; the README already states the two known limitations and why one of them is a platform constraint rather than an implementation gap.

https://github.com/Reefact/enum-member-name-binding/issues?q=is%3Aissue — GitHub's issue archive. It is public, permanent, full-text searchable, readable without an account, and closed issues stay readable with their whole discussion. Published security advisories are archived separately at https://github.com/Reefact/enum-member-name-binding/security/advisories.

https://github.com/Reefact/enum-member-name-binding/blob/main/SECURITY.md gives the channel (a GitHub private security advisory), what a report should contain, which versions are supported, what is in scope and what is not, the response times committed to, and how disclosure is coordinated. A French counterpart is maintained at docs/SECURITY.fr.md.

Private reports are supported through GitHub private security advisories, over HTTPS, visible only to the maintainer until an advisory is published: https://github.com/Reefact/enum-member-name-binding/security/advisories/new. SECURITY.md asks explicitly that a suspected vulnerability not be filed as a public issue, discussion or pull request, and that the report stay confidential until a fix or a mitigation is available.

No vulnerability has been reported in the last 6 months — none has ever been reported. The criterion's own guidance says to choose N/A in that case. SECURITY.md commits to an acknowledgement within 3 business days, well inside the 14 days this criterion asks for.

dotnet build -c Release, from the solution EnumMemberNameBinding.slnx. The SDK floor is declared in global.json with rollForward, and CI proves the build on that floor and on the latest 10.0.x, because a disagreement between analyzer versions belongs in this repository rather than in a consumer's build.

The standard .NET toolchain and nothing else: the .NET SDK, MSBuild, Roslyn and NuGet for dependency restore. No custom build tooling and no code generation step.

The .NET SDK, MSBuild, Roslyn and NuGet are all MIT-licensed and available on Linux, and the test dependencies (xUnit v3, NFluent, coverlet) are FLOSS too. CI builds, tests, packs and smoke-tests on ubuntu-latest, so the whole pipeline is demonstrated to work on free software.

Four automated test projects under tests/ — xUnit v3 with NFluent assertions — covering the binding library, the analyzers, the OpenAPI companion and the documentation samples, plus a package smoke test that packs into a local feed, compiles a consumer against the result and drives it over HTTP. They live in the same public repository under the same Apache-2.0 licence: https://github.com/Reefact/enum-member-name-binding/tree/main/tests

dotnet test -c Release, the standard invocation for a .NET solution, documented in CONTRIBUTING.md. The slower package smoke test is a single script: tests/PackageSmokeTest/run.sh.

SonarQube Cloud measures 100% line coverage and 95.8% branch coverage over both libraries: https://sonarcloud.io/summary/new_code?id=reefact_enum-member-name-binding. Coverage is not the whole of it. A parity suite uses JsonSerializer itself as the oracle — for each candidate input, the HTTP outcome must equal the request-body outcome — so the accepted vocabulary cannot drift from the platform's. The forbidden-character set behind EMN0006 was established by sending each character over all five channels against a running server rather than read off a specification, and that measurement is pinned by tests. Every C# sample in the documentation is compiled and analysed, and a package smoke test exercises the packed artifact end to end.

GitHub Actions runs the build, the tests, the package smoke test and the layout checker on every push and every pull request to main, across two SDK versions; CodeQL and SonarQube Cloud run on the same events. A single aggregate job named CI is the required check on main, written with if: always() so that a skipped or cancelled leg fails the gate instead of silently satisfying it. Workflows: https://github.com/Reefact/enum-member-name-binding/actions

CONTRIBUTING.md states the policy: major new functionality lands with tests in the automated suite, in the same pull request. Adjacent parts of the same rule are enforced by the build rather than left to review — a change to the public surface fails until the committed API baseline records it, a documentation sample that no longer compiles or that the shipped analyzers reject fails like any other test, and the aggregate CI job is a required check on main.

Every feature listed in the CHANGELOG landed with its tests: the parity suite for the binding rules, dedicated tests per analyzer diagnostic (EMN0001–EMN0006), the OpenAPI transformer tests, and a documentation suite that compiles every sample and runs the analyzers over it. The two most recent commits on main are "test: reach every line of both libraries, and all but nine branches" and "test: compile the documentation's samples, and run the rules over them". SonarQube Cloud measures the result at 100% line and 95.8% branch coverage.

The policy is written in CONTRIBUTING.md, on the same page that documents how to build the project and run the suite, so a contributor reads it where they read everything else that gates a merge: https://github.com/Reefact/enum-member-name-binding/blob/main/CONTRIBUTING.md

TreatWarningsAsErrors is on repository-wide in Directory.Build.props, together with AnalysisLevel=latest-recommended, EnforceCodeStyleInBuild=true and nullable reference types enabled, so Roslyn analyzer findings and code-style findings are compiler errors rather than advice. .editorconfig raises specific rules further — CA1062 argument-null checking is extended to the internal surface, because the boundary is the type and not the assembly. A separate checker, tools/style/lint-layout.sh, covers three layout conventions no analyzer can express, and CI runs the checker's own test first so that "nothing to report" means something.

Warnings are errors, so a build carrying an unfixed warning does not exist: CI cannot go green with one, on either SDK in the matrix, and CI is the required check on main. SonarQube Cloud independently reports 0 bugs, 0 vulnerabilities and 0 code smells with the quality gate passing.

Maximally strict where it is practical: warnings as errors on every project, nullable reference types enabled, latest-recommended analysis level, code style enforced in the build, and a public API baseline analyzer that fails any undeclared change to the published surface. The two deliberate relaxations are written down with their reasons rather than left implicit — IDE0028 in test code (.editorconfig, because the rule's fix trips CA1825 on the SDK floor) and the warning ratchet during the Sonar-instrumented build only (sonar.yml, because an injected analyzer warning would otherwise abort the run before the analysis uploads, turning "Sonar found something" into "the analysis crashed"). The ratchet stays enforced in CI on both SDKs.

The maintainer is the sole primary developer and is familiar with the Saltzer and Schroeder design principles. They are visible in the design of the library itself: input validation with an allowlist (only names the contract declares are accepted; numeric values and undeclared names are refused on every channel), fail-safe defaults (an enum that declares no contract is left completely untouched, and registration is all-or-nothing so a malformed contract cannot leave the process half-configured behind an exception that reads as though nothing had happened), economy of mechanism (no model binder is replaced; one converter per contract enum rather than a global factory), a limited attack surface (a committed public API baseline, and a single supported entry point with the TypeConverter kept an implementation detail), and least privilege throughout the delivery chain (per-job GITHUB_TOKEN permissions, actions pinned by full commit SHA, a credential-free checkout where a token is not needed, and OIDC trusted publishing instead of a long-lived API key).

The relevant error class for this library is input handling: it turns untrusted text arriving on a route, a query string, a form field or a header into an enum value, so improper input validation and injection through a permissive parser are the risks that matter, alongside supply-chain weaknesses in how the package is built and published. The countermeasures are in place and tested: allowlist validation, refusal of numeric and undeclared values, argument guards on every public and internal boundary, and a parity suite that uses JsonSerializer as an oracle so the accepted vocabulary cannot drift. In the pipeline, a tag name is validated against a SemVer allowlist before it becomes an MSBuild property, and values reach shell steps through the environment rather than through template interpolation, so a ref named v1.0.0;whoami is data and not script. CodeQL runs the C# security queries on every push and pull request and weekly; the maintainer tracks the OWASP Top 10 and the CWE/SANS Top 25, and SECURITY.md names the boundary and the classes of report that matter for this project.

Packages are published to nuget.org over HTTPS and installed over HTTPS; the source repository is served over HTTPS and cloned over HTTPS or SSH. Delivery is hardened beyond that. Publication uses NuGet trusted publishing, so the credential is a short-lived OIDC token rather than a long-lived API key sitting in secrets. A build-provenance attestation is signed for every .nupkg and stored publicly, so a consumer can tie the exact bytes to this workflow and this commit: gh attestation verify AspNetCore.EnumMemberNameBinding.<version>.nupkg --repo Reefact/enum-member-name-binding. And the release workflow refuses to publish a tag that does not point at a commit already on main, so a tag pushed onto unreviewed history cannot become a release.

The project publishes no hashes for manual verification and retrieves none over HTTP. Dependencies are restored by NuGet over HTTPS with its own package signature validation, every GitHub Action is pinned to a full commit SHA rather than a moving tag, and the published packages carry a signed build-provenance attestation rather than a bare checksum.

No vulnerability in this project has ever been publicly known, so none is unpatched. CodeQL and SonarQube Cloud run continuously and report none — SonarQube Cloud shows a security rating of A with 0 vulnerabilities. On the dependency side, Dependabot keeps packages and actions current and a dependency-review check fails any pull request that would introduce a known-vulnerable dependency at moderate severity or above.

None has been reported. SECURITY.md sets the commitment in advance rather than after the fact: an acknowledgement within 3 business days, an initial assessment within 7, a status update at least every 14 days while a report is open, and a fix with coordinated disclosure within 90 days where that is reasonably possible — with severity and the availability of a safe fix allowed to move those dates, discussed with the reporter rather than decided silently.

The repository holds no credentials. Publication uses OIDC trusted publishing, so there is no NuGet API key to store in the first place, and the one repository secret, SONAR_TOKEN, is passed to steps through the environment rather than interpolated into a workflow's generated script, where an unlucky set -x could spill it. The issued short-lived key is checked for presence only, never echoed. GitHub secret scanning and push protection are enabled on the repository, and CodeQL runs on every change.

Two tools beyond compiler warnings, both on every push and every pull request to main. CodeQL analyses the C# sources and uploads to the code-scanning dashboard, with a weekly scheduled run so that queries published after a change still run against it. SonarQube Cloud runs a full instrumented build with coverage, and the workflow passes sonar.qualitygate.wait=true so a failing Quality Gate actually fails the check rather than merely reporting that the analysis ran. OpenSSF Scorecard additionally grades the repository itself weekly and on every branch-protection change. Reports: https://sonarcloud.io/summary/new_code?id=reefact_enum-member-name-binding

CodeQL's C# query suite covers the common vulnerability classes for the language — injection, unsafe deserialization, improper input validation, information exposure — and SonarQube Cloud adds its own security rules on top. Both are the standard rule sets rather than a narrowed subset. For a library whose whole job is to accept enum names off a route, a query string, a form field and a header, whether a value arriving from outside reaches somewhere it should not is the question worth asking on every change, which is why CodeQL is wired to every push and pull request rather than to releases only.

Nothing is outstanding: SonarQube Cloud reports 0 vulnerabilities, 0 bugs and 0 code smells with the quality gate passing, and the code-scanning dashboard carries no open CodeQL alert. How a finding is answered is itself written down, in CLAUDE.md: fix it, suppress it at the one site with a Justification saying why the rule's premise does not hold there, decline the rule for a whole category in .editorconfig (a decision to raise with the maintainer first, because it also silences the rule where obeying it would have been right), or leave it visible as known debt. The reason always lives in the repository — in an attribute, a comment or a workflow — never as a click in a tool's UI that a reader of the repository cannot see.

On every commit: CodeQL and SonarQube Cloud both run on every push and every pull request to main, so no change reaches the default branch unanalysed. CodeQL also runs weekly on a schedule, because most findings arrive that way — the code did not change, the analysis did.

The automated test suite qualifies under this criterion's own definition, which accepts a suite with at least 80% branch coverage: SonarQube Cloud measures 95.8% branch coverage and 100% line coverage. It also varies its inputs in the way the criterion describes. The parity suite sweeps candidate strings across all five input channels and requires the HTTP outcome to equal what JsonSerializer does with the same value in a request body, so the oracle is the platform rather than an expectation written by hand; the character-portability set behind EMN0006 was established the same way, by sending each character over every channel against a running server. The package smoke test starts at dotnet pack and ends at a real HTTP response against a live Kestrel server.

The project produces no software written in a memory-unsafe language. It is entirely C# on a managed runtime, with nullable reference types enabled and no unsafe blocks anywhere in the sources.

The suite is assertion-driven throughout — xUnit v3 with NFluent — and the library's own runtime checks are active in the code under test rather than compiled out: argument guards on every public and internal boundary raise ArgumentNullException naming the parameter, and start-up validation raises EnumContractException for a duplicate public name, surrounding whitespace or a comma inside a [Flags] member name. Tests run in Release, the same configuration that ships, so what the suite exercises is what a consumer gets.

No vulnerability has been found through dynamic analysis. Failures the suite does find are fixed before the change merges: the aggregate CI job is the required check on main, and it is written so that a skipped or cancelled leg fails the gate rather than satisfying it.