Merge pull request 'fix: address vulnerabilities' (#1) from stevanfreeborn/fix/address-vulnerabilities into main

fix: address reconnection logic not working

.dockerignore

@@ -10,4 +10,4 @@
 **/Dockerfile*
 **/obj
 .env*
-**/appsettings*.json
+**/appsettings*.json

.editorconfig

@@ -30,6 +30,7 @@ dotnet_diagnostic.IDE0058.severity = none
 dotnet_diagnostic.IDE0290.severity = none
 dotnet_diagnostic.CA1031.severity = none
 dotnet_diagnostic.CA1873.severity = none
+dotnet_diagnostic.CS1591.severity = none
 
 # Organize usings
 dotnet_separate_import_directive_groups = true
@@ -96,7 +97,7 @@ csharp_style_var_when_type_is_apparent = true:suggestion
 csharp_style_expression_bodied_accessors = true:silent
 csharp_style_expression_bodied_constructors = false:silent
 csharp_style_expression_bodied_indexers = true:silent
-csharp_style_expression_bodied_lambdas = true:suggestion
+csharp_style_expression_bodied_lambdas = false:silent
 csharp_style_expression_bodied_local_functions = false:silent
 csharp_style_expression_bodied_methods = false:silent
 csharp_style_expression_bodied_operators = false:silent

.gitea/workflows/deploy.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - 'src/**'
+      - '.editorconfig'
 jobs:
   build:
     name: Build Docker Images
@@ -26,10 +27,10 @@ jobs:
       - name: Build Docker image
         run: |
           WORKER_TAG=${{ secrets.DOCKERHUB_USERNAME }}/steves-bot:worker-${{ steps.version.outputs.version }}
-          docker build -f src/StevesBot.Worker.Dockerfile -t $WORKER_TAG src
+          docker build -f src/StevesBot.Worker.Dockerfile -t $WORKER_TAG .
           docker push $WORKER_TAG
           WEBHOOK_TAG=${{ secrets.DOCKERHUB_USERNAME }}/steves-bot:webhook-${{ steps.version.outputs.version }}
-          docker build -f src/StevesBot.Webhook.Dockerfile -t $WEBHOOK_TAG src
+          docker build -f src/StevesBot.Webhook.Dockerfile -t $WEBHOOK_TAG .
           docker push $WEBHOOK_TAG
   deploy:
     name: Deploy Docker Images

.gitea/workflows/pull_request.yml

@@ -30,13 +30,15 @@ jobs:
         with:
           dotnet-version: 10.0.x
       - name: Install report generator
-        run: dotnet tool install -g dotnet-reportgenerator-globaltool
+        run: |
+          dotnet tool install --tool-path ./.tools dotnet-reportgenerator-globaltool
+          echo "$PWD/.tools" >> "$GITHUB_PATH"
       - name: Run tests
         run: dotnet test src
       - name: Merge coverage reports
         run: reportgenerator "-reports:src/tests/*/TestResults/*/coverage.cobertura.xml" "-reporttypes:Html;Cobertura" "-targetdir:src/tests/TestResults/Coverage"
       - name: Upload code coverage
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v3
         with:
           name: coverage-reports
           path: src/tests/TestResults/Coverage

README.md

@@ -234,6 +234,13 @@ FROM mcr.microsoft.com/dotnet/aspnet:10.0
 # ... runtime setup ...
 ```
 
+Images are built with the **repository root** as Docker build context so solution-wide configuration (including root-level analyzer/editorconfig rules) is available during build:
+
+```bash
+docker build -f src/StevesBot.Worker.Dockerfile -t steves-bot:worker .
+docker build -f src/StevesBot.Webhook.Dockerfile -t steves-bot:webhook .
+```
+
 ### Configuration for Production
 
 Use environment variables or configuration providers for production secrets.

src/Directory.Build.props

@@ -9,6 +9,7 @@
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <CodeAnalysisTreatWarningsAsErrors>true</CodeAnalysisTreatWarningsAsErrors>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
   </PropertyGroup>
 
 </Project>

src/StevesBot.Webhook.Dockerfile

@@ -2,32 +2,29 @@ FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base
 WORKDIR /app
 
 # solution level
-COPY *.sln ./
+COPY src/StevesBot.sln src/
-COPY Directory.Build.props ./
+COPY src/Directory.Build.props src/
 
 # src level
-COPY src/StevesBot.Library/*.csproj src/StevesBot.Library/
+COPY src/src/StevesBot.Library/*.csproj src/src/StevesBot.Library/
-COPY src/StevesBot.Worker/*.csproj src/StevesBot.Worker/
+COPY src/src/StevesBot.Worker/*.csproj src/src/StevesBot.Worker/
-COPY src/StevesBot.Webhook/*.csproj src/StevesBot.Webhook/
+COPY src/src/StevesBot.Webhook/*.csproj src/src/StevesBot.Webhook/
-COPY src/Directory.Build.props src/
+COPY src/src/Directory.Build.props src/src/
-COPY src/Directory.Packages.props src/
+COPY src/src/Directory.Packages.props src/src/
 
 # test level
-COPY tests/StevesBot.Library.Tests/*.csproj tests/StevesBot.Library.Tests/
+COPY src/tests/StevesBot.Library.Tests/*.csproj src/tests/StevesBot.Library.Tests/
-COPY tests/StevesBot.Worker.Tests/*.csproj tests/StevesBot.Worker.Tests/
+COPY src/tests/StevesBot.Worker.Tests/*.csproj src/tests/StevesBot.Worker.Tests/
-COPY tests/StevesBot.Webhook.Tests/*.csproj tests/StevesBot.Webhook.Tests/
+COPY src/tests/StevesBot.Webhook.Tests/*.csproj src/tests/StevesBot.Webhook.Tests/
-COPY tests/Directory.Build.props tests/
+COPY src/tests/Directory.Build.props src/tests/
-COPY tests/Directory.Packages.props tests/
+COPY src/tests/Directory.Packages.props src/tests/
 
-COPY ./src/StevesBot.Worker/StevesBot.Worker.csproj ./
+RUN dotnet restore src/StevesBot.sln
-COPY ./Directory.Build.props ./
-
-RUN dotnet restore StevesBot.sln
 
 COPY . .
 
 FROM base AS publish-stage
-RUN dotnet publish -c Release -o dist src/StevesBot.Webhook/StevesBot.Webhook.csproj
+RUN dotnet publish -c Release -o dist src/src/StevesBot.Webhook/StevesBot.Webhook.csproj
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
 WORKDIR /app

src/StevesBot.Worker.Dockerfile

@@ -2,32 +2,29 @@ FROM mcr.microsoft.com/dotnet/sdk:10.0 AS base
 WORKDIR /app
 
 # solution level
-COPY *.sln ./
+COPY src/StevesBot.sln src/
-COPY Directory.Build.props ./
+COPY src/Directory.Build.props src/
 
 # src level
-COPY src/StevesBot.Library/*.csproj src/StevesBot.Library/
+COPY src/src/StevesBot.Library/*.csproj src/src/StevesBot.Library/
-COPY src/StevesBot.Worker/*.csproj src/StevesBot.Worker/
+COPY src/src/StevesBot.Worker/*.csproj src/src/StevesBot.Worker/
-COPY src/StevesBot.Webhook/*.csproj src/StevesBot.Webhook/
+COPY src/src/StevesBot.Webhook/*.csproj src/src/StevesBot.Webhook/
-COPY src/Directory.Build.props src/
+COPY src/src/Directory.Build.props src/src/
-COPY src/Directory.Packages.props src/
+COPY src/src/Directory.Packages.props src/src/
 
 # test level
-COPY tests/StevesBot.Library.Tests/*.csproj tests/StevesBot.Library.Tests/
+COPY src/tests/StevesBot.Library.Tests/*.csproj src/tests/StevesBot.Library.Tests/
-COPY tests/StevesBot.Worker.Tests/*.csproj tests/StevesBot.Worker.Tests/
+COPY src/tests/StevesBot.Worker.Tests/*.csproj src/tests/StevesBot.Worker.Tests/
-COPY tests/StevesBot.Webhook.Tests/*.csproj tests/StevesBot.Webhook.Tests/
+COPY src/tests/StevesBot.Webhook.Tests/*.csproj src/tests/StevesBot.Webhook.Tests/
-COPY tests/Directory.Build.props tests/
+COPY src/tests/Directory.Build.props src/tests/
-COPY tests/Directory.Packages.props tests/
+COPY src/tests/Directory.Packages.props src/tests/
 
-COPY ./src/StevesBot.Worker/StevesBot.Worker.csproj ./
+RUN dotnet restore src/StevesBot.sln
-COPY ./Directory.Build.props ./
-
-RUN dotnet restore StevesBot.sln
 
 COPY . .
 
 FROM base AS publish-stage
-RUN dotnet publish -c Release -o dist src/StevesBot.Worker/StevesBot.Worker.csproj
+RUN dotnet publish -c Release -o dist src/src/StevesBot.Worker/StevesBot.Worker.csproj
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0
 WORKDIR /app

src/src/Directory.Packages.props

@@ -5,15 +5,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="9.0.5" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.1.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.9.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.Console" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.18.0" />
-    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.18.0" />
   </ItemGroup>
 
 </Project>

src/src/StevesBot.Library/.editorconfig

@@ -1,3 +1,3 @@
 [*.cs]
 dotnet_diagnostic.CA1056.severity = none
-dotnet_diagnostic.CA1054.severity = none
+dotnet_diagnostic.CA1054.severity = none

src/src/StevesBot.Library/StevesBot.Library.csproj

@@ -1,5 +1,5 @@
 <Project Sdk="Microsoft.NET.Sdk">
-  
+
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="OpenTelemetry.Exporter.Console" />

src/src/StevesBot.Worker/Discord/Gateway/DiscordGatewayClient.cs

@@ -70,6 +70,8 @@ internal sealed class DiscordGatewayClient : IDiscordGatewayClient
       await SetGatewayUrlAsync(gatewayUrl, cancellationToken);
     }
 
+    _webSocket?.Dispose();
+
     await SetWebSocketAsync(_webSocketFactory.Create(), cancellationToken);
     await ConnectWithGatewayUrlAsync(cancellationToken);
 
@@ -685,9 +687,10 @@ internal sealed class DiscordGatewayClient : IDiscordGatewayClient
         await _webSocket.ConnectAsync(uri, cancellationToken);
         connected = true;
       }
-      catch (Exception e) when (e is WebSocketException)
+      catch (Exception e)
       {
-        var currentDelay = (int)(delay.TotalMilliseconds * Math.Pow(2, attempts));
+        var calculatedDelay = delay.TotalMilliseconds * Math.Pow(2, attempts);
+        var currentDelay = (int)Math.Min(calculatedDelay, int.MaxValue);
 
         _logger.LogWarning(
           e,
@@ -700,6 +703,9 @@ internal sealed class DiscordGatewayClient : IDiscordGatewayClient
         await Task.Delay(currentDelay, cancellationToken);
 
         attempts++;
+
+        _webSocket.Dispose();
+        await SetWebSocketAsync(_webSocketFactory.Create(), cancellationToken);
       }
     }
   }

src/tests/Directory.Packages.props

@@ -5,15 +5,15 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="coverlet.collector" Version="10.0.1" />
-    <PackageVersion Include="coverlet.msbuild" Version="6.0.4" />
+    <PackageVersion Include="coverlet.msbuild" Version="10.0.1" />
     <PackageVersion Include="FluentAssertions" Version="[7.2.0]" />
-    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.9.0" />
     <PackageVersion Include="moq" Version="4.20.72" />
-    <PackageVersion Include="RichardSzalay.MockHttp" Version="7.0.0" />
+    <PackageVersion Include="RichardSzalay.MockHttp" Version="7.1.0" />
     <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="4.0.0" />
   </ItemGroup>
 
 </Project>

src/tests/StevesBot.Webhook.Tests/Unit/VerifySubscriptionHandlerTests.cs

@@ -92,7 +92,7 @@ public class VerifySubscriptionHandlerTests
 
     task.Should().BeTrue();
     dequeuedTask.Should().NotBeNull();
-    dequeuedTask!.CallbackUrl.Should().Be(callbackUrl);
+    dequeuedTask.CallbackUrl.Should().Be(callbackUrl);
     dequeuedTask.TopicUrl.Should().Be(topic);
     dequeuedTask.ExpiresAt.Should().Be(now.AddSeconds(leaseSeconds));
   }

src/tests/StevesBot.Worker.Tests/Integration/Infrastructure/TestWebSocketServer.cs

@@ -8,14 +8,13 @@ public sealed class TestWebSocketServer : IAsyncLifetime, IDisposable
 {
   private readonly IHost _host;
   private readonly CancellationTokenSource _echoCts = new();
-  private Uri? _webSocketUri;
 
   public Uri Uri
   {
     get
     {
-      _webSocketUri ??= GetWebSocketUri();
+      field ??= GetWebSocketUri();
-      return _webSocketUri;
+      return field;
     }
   }
 

src/tests/StevesBot.Worker.Tests/Unit/AsyncLockTests.cs

@@ -43,7 +43,9 @@ public class AsyncLockTests
     var taskOne = FirstLockAction();
     var taskTwo = SecondLockAction();
 
+#pragma warning disable CA2027 // Cancel Task.Delay after Task.WhenAny completes
     await Task.WhenAll(taskOne, Task.WhenAny(taskTwo, Task.Delay(500)));
+#pragma warning restore CA2027 // Cancel Task.Delay after Task.WhenAny completes
 
     lockOneAcquired.Task.IsCompleted.Should().BeTrue();
     lockTwoAttempted.Task.IsCompleted.Should().BeTrue();

src/tests/StevesBot.Worker.Tests/Unit/DiscordGatewayClientTests.cs

@@ -210,7 +210,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     mockWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()
@@ -238,7 +238,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     mockWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedIdentifyPayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedIdentifyPayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()
@@ -337,7 +337,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     initialWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()
@@ -413,7 +413,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     mockWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()
@@ -502,7 +502,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     mockWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedHeartbeatPayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()
@@ -1035,7 +1035,7 @@ public sealed class DiscordGatewayClientTests : IDisposable
     mockWebSocket
       .Verify(
         x => x.SendAsync(
-          It.Is<ArraySegment<byte>>(b => expectedIdlePayload.Bytes.SequenceEqual(b.Array!)),
+          It.Is<ArraySegment<byte>>(b => expectedIdlePayload.Bytes.SequenceEqual(b.Array)),
           It.Is<WebSocketMessageType>(m => m == WebSocketMessageType.Text),
           true,
           It.IsAny<CancellationToken>()

src/tests/StevesBot.Worker.Tests/Unit/HelloDiscordEventTests.cs

@@ -62,10 +62,10 @@ public class HelloDiscordEventTests
     var helloEvent = JsonSerializer.Deserialize<HelloDiscordEvent>(json);
 
     helloEvent.Should().NotBeNull();
-    helloEvent!.OpCode.Should().Be(data.op);
+    helloEvent.OpCode.Should().Be(data.op);
     helloEvent.Sequence.Should().Be(data.s);
     helloEvent.Type.Should().Be(data.t);
     helloEvent.Data.Should().NotBeNull();
-    helloEvent.Data!.HeartbeatInterval.Should().Be(data.d.heartbeat_interval);
+    helloEvent.Data.HeartbeatInterval.Should().Be(data.d.heartbeat_interval);
   }
 }

src/tests/StevesBot.Worker.Tests/Unit/IdentifyDataTests.cs

@@ -1,5 +1,3 @@
-using StevesBot.Worker.Discord.Gateway.Events.Data;
-
 namespace StevesBot.Worker.Tests.Unit;
 
 public class IdentifyDataTests

src/tests/StevesBot.Worker.Tests/Unit/ReadyDiscordEventTests.cs

@@ -62,7 +62,7 @@ public class ReadyDiscordEventTests
     var readyEvent = JsonSerializer.Deserialize<ReadyDiscordEvent>(json);
 
     readyEvent.Should().NotBeNull();
-    readyEvent!.OpCode.Should().Be(data.op);
+    readyEvent.OpCode.Should().Be(data.op);
     readyEvent.Sequence.Should().Be(data.s);
     readyEvent.Type.Should().Be(data.t);
     readyEvent.Data.Version.Should().Be(data.d.v);