[oznetmaster]

A latest-version lookup with no exact package match previously returned the original PackageReference. Verification could then accept an installed package as an unversioned dependency, or retain a previously pinned reference. Throw a diagnostic identifying the requested package and sources instead. Intentional unversioned checks retain their existing behavior.

Add Cake scripts in harness that load recipe/*.cake directly, with controlled feed responses and Cake filesystem/process doubles. A separate smoke target exercises real Cake setup, target execution and package verification against actual temporary files. Its intentional missing-file error is captured and asserted; successful output identifies it as expected.

CI now runs the harness before the existing packaging/publication step. A test failure blocks that step, and XML reports are uploaded with if: always(). Setup explicitly includes .NET 8 to match global.json, alongside the existing .NET 10 SDK. Charlie's restored triggers, publishing logic, package artifacts and workflow settings are preserved.

Validation on Windows / .NET 8 / Cake 6.3.0:

• Before the production correction: 40/102 behavior cases pass; 62 expose Dependency check ignores failure to find latest version #130.
• After correction: 102/102 behavior cases and the smoke case pass.
• The original implementation also passes from a fresh source archive without Git history or copied build artifacts.
• The smoke-output follow-up passes without the misleading ERROR: File output.
• Two isolated mutation checks fail as intended when the expected missing-file failure disappears or reports a different missing file.
• Parsed workflow checks confirm the harness precedes packaging, has no failure override, uploads reports on failure, and preserves other current-main settings.

Windows/Linux fake environments exercise path forms. Native Linux/macOS and live feed behavior have not been validated by this harness. Bootstrap may fetch declared dependencies, but behavioral cases contact no feeds or hardware. Hosted CI run 41407556455 passed on head 6f66eeb. Downloaded XML reports confirm 102 behavior cases and the smoke case passed. The harness ran before packaging, the expected missing-file diagnostic was handled cleanly, and all 29 packaged recipe scripts match the submitted source. This PR run built a package but published nothing to MyGet.

The production correction, harness, smoke-output follow-up and CI integration are separate commits. Current main is incorporated through a normal merge, preserving the published shared-branch history without a force push.

Fixes #130. First source-harness slice for #132; builds on the workflow restoration in #131.

Prepared by Neil Colvin with assistance from OpenAI Codex.

[oznetmaster]

@CharliePoole, could we move the recipe’s build SDK to .NET 10 as a separate follow-up? .NET 8 reaches end of support on 10 November. I retained it in #135 because the existing global.json selects SDK 8.

An isolated probe changing only that SDK pin passes all 102 behavior cases and the smoke test with SDK 10.0.403. One dependency needs attention before claiming a .NET 10-only toolchain: the pinned GitReleaseManager 0.20.0 has .NET 8/9 payloads.

I suggest updating global.json and SDK setup in both workflows, checking the release-tool dependency, and validating restore, harness execution, packaging and release-tool startup without publishing anything.

This concerns build tooling; it would not change the test runtimes supported by NUnit’s agents. Would you prefer a separate issue/PR after #135, or this migration before merging the branch?

Prepared by Neil Colvin with assistance from OpenAI Codex.

[CharliePoole]

This looks good to go. You can merge either before or after switching global.json to use .NET 10.0.

[CharliePoole]

You can drop 8.0 here if you update global.json to use 10.0.