v1.0.0

.github/workflows/codemap-check.yml

@@ -0,0 +1,48 @@
+name: CODEMAP freshness
+
+# Guards the honor-system rule in docsource/CODEMAP.md: a PR that changes plugin
+# source must also update the codemap, so agents/humans can trust it as the
+# orientation map. The generated root README.md is handled separately by the
+# Keyfactor bootstrap workflow (it auto-commits a regenerated README), so this
+# check deliberately covers only the hand-maintained CODEMAP.
+#
+# Escape hatch: add the "skip-codemap" label to a PR when a source change
+# genuinely does not affect the codemap (e.g. a comment-only or whitespace edit).
+
+on:
+  pull_request:
+    paths:
+      - 'markmonitor-caplugin/**'
+
+jobs:
+  codemap:
+    runs-on: ubuntu-latest
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-codemap') }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Require CODEMAP update when plugin source changes
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          changed="$(git diff --name-only "$BASE" "$HEAD")"
+
+          # Production plugin source only: exclude build output and the test project.
+          src="$(printf '%s\n' "$changed" \
+            | grep -E '^markmonitor-caplugin/.*\.cs$' \
+            | grep -vE '/(bin|obj)/' || true)"
+
+          codemap="$(printf '%s\n' "$changed" | grep -E '^docsource/CODEMAP\.md$' || true)"
+
+          if [ -n "$src" ] && [ -z "$codemap" ]; then
+            echo "::error::Plugin source changed but docsource/CODEMAP.md was not updated. Update the codemap to match, or add the 'skip-codemap' label if this change genuinely does not affect it."
+            echo "Changed plugin source files:"
+            printf '  %s\n' $src
+            exit 1
+          fi
+
+          echo "CODEMAP freshness check passed."

.github/workflows/integration-tests.yml

@@ -0,0 +1,39 @@
+name: Integration Tests
+
+# Manual-only: hits the real MarkMonitor sandbox API and creates/cancels real orders. Never runs on
+# push or pull_request. The "markmonitor-integration" environment additionally gates every run
+# behind a required reviewer approval, on top of this workflow_dispatch trigger.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    environment: markmonitor-integration
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      - name: Add Keyfactor GitHub Packages NuGet source
+        run: |
+          dotnet nuget add source "https://nuget.pkg.github.com/Keyfactor/index.json" \
+            --name keyfactor-github \
+            --username keyfactor \
+            --password "${{ secrets.V2BUILDTOKEN }}" \
+            --store-password-in-clear-text
+
+      - name: Run live integration tests
+        env:
+          MARKMONITOR_BASE_URL: ${{ secrets.MARKMONITOR_BASE_URL }}
+          MARKMONITOR_API_TOKEN: ${{ secrets.MARKMONITOR_API_TOKEN }}
+          MARKMONITOR_USERNAME: ${{ secrets.MARKMONITOR_USERNAME }}
+          MARKMONITOR_PASSWORD: ${{ secrets.MARKMONITOR_PASSWORD }}
+        run: dotnet test markmonitor-caplugin.IntegrationTests/markmonitor-caplugin.IntegrationTests.csproj --configuration Release --verbosity normal

.github/workflows/keyfactor-bootstrap-workflow.yml

@@ -0,0 +1,19 @@
+name: Keyfactor Bootstrap Workflow
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, closed, synchronize, edited, reopened]
+  push:
+  create:
+    branches:
+      - 'release-*.*'
+
+jobs:
+  call-starter-workflow:
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
+    secrets:
+      token: ${{ secrets.V2BUILDTOKEN}}
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
+      scan_token: ${{ secrets.SAST_TOKEN }}

.github/workflows/unit-tests.yml

@@ -0,0 +1,42 @@
+name: Unit Tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+
+      # markmonitor-caplugin.Tests references markmonitor-caplugin, which restores several
+      # Keyfactor.* packages from Keyfactor's GitHub Packages feed - not just nuget.org.
+      #
+      # Deliberately not locked down with a checked-in nuget.config + packageSourceMapping: the
+      # keyfactor-bootstrap-workflow's shared dotnet-build-and-release action adds its own NuGet
+      # source (named "github", credentialed with this same token) via the same mechanism, and a
+      # repo-wide nuget.config restricting Keyfactor.* to a source name/mapping this workflow alone
+      # controls would leave that other, already-green workflow's differently-named source
+      # unable to resolve any Keyfactor.* package.
+      - name: Add Keyfactor GitHub Packages NuGet source
+        run: |
+          dotnet nuget add source "https://nuget.pkg.github.com/Keyfactor/index.json" \
+            --name keyfactor-github \
+            --username keyfactor \
+            --password "${{ secrets.V2BUILDTOKEN }}" \
+            --store-password-in-clear-text
+
+      - name: Run unit tests
+        run: dotnet test markmonitor-caplugin.Tests/markmonitor-caplugin.Tests.csproj --configuration Release --verbosity normal

.gitignore

@@ -364,4 +364,21 @@ FodyWeavers.xsd
 
 *.env
 *.env.local
-*.idea/
+*.idea/
+
+# Local scratch/sandbox artifacts - contain sandbox credentials or org/contact data
+# and are not meant to be committed.
+.DS_Store
+/order_from_*.json
+TestConsole/Scripts/
+TestConsole/lib/list_real.json
+TestConsole/lib/request.json
+# Claude Code local settings (never commit)
+.claude/
+
+# Jekyll local preview build output/vendored gems (see `just docs-preview`)
+docs/_site/
+docs/.jekyll-cache/
+docs/.bundle/
+docs/vendor/
+docs/Gemfile.lock

CHANGELOG.md

@@ -0,0 +1,3 @@
+# Features
+
+- initial release