Cerbi.Governance.Core 1.0.8

Cerbi.Governance.Core

Overview

Cerbi.Governance.Core provides lightweight, versioned runtime contracts and build-time types to enforce structured logging governance across the Cerbi ecosystem. It is intentionally small and dependency-light so it can be referenced from analyzers, libraries, and runtime services.

This repository contains:

• JSON schema and sample profiles under Schema/ and Samples/
• Core models (LogProfile, CerbiGovernance, EncryptionSettings, enums)
• Validation helpers and a runtime IGovernanceValidator implementation
• Plugin contract (ICustomGovernancePlugin) and a sample plugin
• A config loader (GovernanceConfigLoader) suitable for runtime usage

SDK & Language

• Pinned SDK: .NET9 via global.json (rollForward: latestFeature)
• Language: C#13 centralized in Directory.Build.props
• Nullable: enabled centrally
• Target frameworks: unchanged (library remains net8.0) to avoid breaking consumers
• Plan: bump SDK pin to 10.0.100 post-GA and evaluate C#14 features where beneficial

Production-readiness checklist (what I implemented)

• CI: GitHub Actions workflow (.github/workflows/ci.yml) to restore, build, test and pack the project.
• Tests: xUnit test project added at tests/Cerbi.Governance.Core.Tests with basic validation tests.
• Static analysis: enabled .NET analyzers and TreatWarningsAsErrors in CI.
• Deterministic packaging: project configured to produce deterministic packages for CI builds.
• Secrets & scanning: Dependabot config and a Snyk-based vulnerability scan workflow were added (requires SNYK_TOKEN).
• License: MIT LICENSE file added.
• Hardened config loader: GovernanceConfigLoader now uses System.Text.Json, is case-insensitive, logs via injectable Log action, and avoids throwing on parse errors.

Quick start

Add package to your project (NuGet):

$ dotnet add package Cerbi.Governance.Core --version1.0.4

Add the assembly attribute to point at your governance file:

using Cerbi.Governance;

[assembly: CerbiGovernanceConfig("cerbi_governance.json")]

Use the runtime validator:

using Cerbi.Governance.Core.Validation;
using System.Text.Json;

var validator = new GovernanceValidator();
var profile = /* load Profile model from JSON */;
var json = JsonDocument.Parse(jsonString);
var result = validator.Validate(profile, json.RootElement);

If using GovernanceConfigLoader at runtime, set a custom logger to integrate with your app logging:

GovernanceConfigLoader.Log = s => logger.LogInformation(s);

🧪 Re-baseline (build, tests, benchmarks)

1. Verify SDK selection

• dotnet --info (should show .NET9 selected via global.json)

2. Build and test

• dotnet restore
• dotnet build -c Release
• dotnet test -c Release

3. Benchmarks (optional)

• scripts/bench.sh (Linux/macOS)
• scripts/bench.ps1 (Windows)

Notes:

• No runtime TFM changes; only toolchain/language centralization.

Contributing & development

• Run tests: dotnet test from repository root.
• Open a PR; CI will run builds, analyzers, and tests.
• Add more tests: the test project uses xUnit and coverlet collector is included in the test project file.

Roadmap (suggested next steps)

• Expand unit tests to cover GovernanceConfigLoader, GovernanceHelper, and plugin execution paths.
• Add integration tests that exercise sample profiles in Samples/.
• Optionally remove Newtonsoft.Json fully and standardize on System.Text.Json (done in code, package removed).
• Add API logging using ILogger<T> where library code should integrate with host logging.

License

MIT — see LICENSE.