Merge pull request #3 from elsa-workflows/002-package-manifest-generator

Fix package catalog main build

Author: sfmskywalker

.gitignore

@@ -10,6 +10,7 @@
 *.userosscache
 *.sln.docstates
 *.env
+.azure/
 .DS_Store
 Thumbs.db
 
@@ -22,7 +23,7 @@ mono_crash.*
 # Build results
 bin/
 obj/
-packages/
+/packages/
 [Dd]ebug/
 [Dd]ebugPublic/
 [Rr]elease/
@@ -96,6 +97,7 @@ project.lock.json
 project.fragment.lock.json
 artifacts/
 .artifacts/
+src/Elsa.Catalog.AppHost/artifacts/
 
 # ASP.NET Scaffolding
 ScaffoldingReadMe.txt
@@ -236,9 +238,9 @@ PublishScripts/
 # NuGet Symbol Packages
 *.snupkg
 # The packages folder can be ignored because of Package Restore
-**/[Pp]ackages/*
+/[Pp]ackages/*
 # except build/, which is used as an MSBuild target.
-!**/[Pp]ackages/build/
+!/[Pp]ackages/build/
 # Uncomment if necessary however generally it will be regenerated when needed
 #!**/[Pp]ackages/repositories.config
 # NuGet v3's project.json files produces more ignorable files

Directory.Packages.props

@@ -5,18 +5,29 @@
 
   <ItemGroup>
     <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="Aspire.Hosting.Azure.AppService" Version="13.3.2" />
+    <PackageVersion Include="Aspire.Hosting.Azure.Sql" Version="13.3.2" />
     <PackageVersion Include="FluentAssertions" Version="8.8.0" />
     <PackageVersion Include="JsonSchema.Net" Version="9.2.0" />
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.1" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.8" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.8" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.8" />
+    <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.5.0" />
+    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.5.0" />
     <PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" />
     <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.14.8" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
     <PackageVersion Include="NuGet.Protocol" Version="7.6.0" />
     <PackageVersion Include="NuGet.Versioning" Version="7.6.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.1" />
     <PackageVersion Include="System.Reflection.MetadataLoadContext" Version="10.0.1" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4" />

Elsa.PackageCatalog.sln

@@ -52,6 +52,10 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "solution", "solution", "{9F
 		AGENTS.md = AGENTS.md
 	EndProjectSection
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.Catalog.AppHost", "src\Elsa.Catalog.AppHost\Elsa.Catalog.AppHost.csproj", "{60DAE03C-A730-4125-B310-656D64BA28F0}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.Catalog.ServiceDefaults", "src\Elsa.Catalog.ServiceDefaults\Elsa.Catalog.ServiceDefaults.csproj", "{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -278,6 +282,30 @@ Global
 		{060E3A4E-FD2E-41BB-936C-B91AF91BB628}.Release|x64.Build.0 = Release|Any CPU
 		{060E3A4E-FD2E-41BB-936C-B91AF91BB628}.Release|x86.ActiveCfg = Release|Any CPU
 		{060E3A4E-FD2E-41BB-936C-B91AF91BB628}.Release|x86.Build.0 = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|x64.Build.0 = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Debug|x86.Build.0 = Debug|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|Any CPU.Build.0 = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|x64.ActiveCfg = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|x64.Build.0 = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|x86.ActiveCfg = Release|Any CPU
+		{60DAE03C-A730-4125-B310-656D64BA28F0}.Release|x86.Build.0 = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|x64.Build.0 = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Debug|x86.Build.0 = Debug|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|Any CPU.Build.0 = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|x64.ActiveCfg = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|x64.Build.0 = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|x86.ActiveCfg = Release|Any CPU
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -301,5 +329,7 @@ Global
 		{3A90AE29-33DB-4241-9BB5-8578067C9A49} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
 		{10D68F1A-23BB-43BF-BC90-1BC0D73F0BFB} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
 		{060E3A4E-FD2E-41BB-936C-B91AF91BB628} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
+		{60DAE03C-A730-4125-B310-656D64BA28F0} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
+		{1906CE1B-FB94-4E2B-8EF7-44A927277BEA} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
 	EndGlobalSection
 EndGlobal

azure.yaml

@@ -0,0 +1,6 @@
+name: elsa-package-catalog
+services:
+  api:
+    project: src/Elsa.Catalog.AppHost/Elsa.Catalog.AppHost.csproj
+    host: containerapp
+    language: dotnet

docs/deployment/azure-app-service.md

@@ -0,0 +1,67 @@
+# Aspire Deployment to Azure App Service
+
+## Recommendation
+
+Use Aspire and Azure Developer CLI (`azd`) as the deployment path. The AppHost
+declares the API, Azure App Service environment, and Azure SQL database;
+Aspire/azd provisions the resources, builds the app container image, pushes it
+to ACR, and deploys the Web App.
+
+The previous manually provisioned Web App can be deleted once anything important
+has been backed up.
+
+## Local Tooling
+
+Install the current .NET 10 SDK before deploying. As of May 15, 2026, the
+current .NET 10 SDK line is `10.0.300`, released May 12, 2026.
+
+The official Aspire templates are installed with:
+
+```bash
+dotnet new install Aspire.ProjectTemplates
+dotnet tool install -g Aspire.Cli
+```
+
+On this machine, `~/.dotnet/tools/aspire` is `13.3.2`. If `aspire --version`
+prints an older version, move `~/.dotnet/tools` before `~/.aspire/bin` in
+`PATH`, or run `~/.dotnet/tools/aspire` explicitly.
+
+## Deploy
+
+```bash
+azd auth login
+azd init
+azd env set admin-api-key <strong-secret>
+azd up
+```
+
+When `azd init` asks how to initialize the app, scan the current directory and
+confirm the detected Aspire AppHost.
+
+## Removing Existing Resources
+
+If the old resources are in a dedicated resource group, delete the group:
+
+```bash
+az group delete --name <old-resource-group>
+```
+
+If the group has shared resources, delete only the old Web App, plan, registry,
+storage account, and related managed identities after confirming they are not
+used elsewhere.
+
+## Database Provider
+
+The API supports two EF Core providers:
+
+- `Database:Provider=Sqlite`
+- `Database:Provider=SqlServer`
+
+Local development defaults to SQLite. Aspire publish mode provisions Azure SQL,
+injects `ConnectionStrings__Catalog`, and sets `Database__Provider=SqlServer`.
+
+SQLite remains fine for local development and single-process test runs. For
+production and App Service scale-out, use Azure SQL. SQLite on shared App
+Service storage or Azure Files is not a good production target because SQLite
+depends on filesystem locking, and WAL mode does not support clients on
+different machines through a network filesystem.

global.json

@@ -0,0 +1,6 @@
+{
+  "sdk": {
+    "version": "10.0.300",
+    "rollForward": "latestFeature"
+  }
+}

src/Elsa.Catalog.Api/Admin/Packages/AdminApprovalEndpoints.cs

@@ -0,0 +1,35 @@
+using Elsa.Catalog.Api.Authentication;
+using Elsa.Catalog.Core.Approvals;
+using Elsa.Catalog.Core.Packages;
+using System.Security.Claims;
+
+namespace Elsa.Catalog.Api.Admin.Packages;
+
+public static class AdminApprovalEndpoints
+{
+    public static IEndpointRouteBuilder MapAdminApprovalEndpoints(this IEndpointRouteBuilder endpoints)
+    {
+        var group = endpoints.MapGroup("/api/admin/packages")
+            .RequireAuthorization(AdminAuthorization.Policy)
+            .WithTags("Admin Approval");
+
+        group.MapPost("/{packageId}/approve", async (string packageId, ApprovalRequest? request, HttpContext httpContext, ApprovalService approvals, CancellationToken cancellationToken) =>
+            await approvals.SetPackageApprovalAsync(packageId, PackageApprovalStatus.Approved, GetActor(httpContext), request?.Reason, cancellationToken) ? Results.NoContent() : Results.NotFound());
+
+        group.MapPost("/{packageId}/reject", async (string packageId, ApprovalRequest? request, HttpContext httpContext, ApprovalService approvals, CancellationToken cancellationToken) =>
+            await approvals.SetPackageApprovalAsync(packageId, PackageApprovalStatus.Rejected, GetActor(httpContext), request?.Reason, cancellationToken) ? Results.NoContent() : Results.NotFound());
+
+        group.MapPost("/{packageId}/versions/{version}/approve", async (string packageId, string version, ApprovalRequest? request, HttpContext httpContext, ApprovalService approvals, CancellationToken cancellationToken) =>
+            await approvals.SetVersionApprovalAsync(packageId, version, PackageApprovalStatus.Approved, GetActor(httpContext), request?.Reason, cancellationToken) ? Results.NoContent() : Results.NotFound());
+
+        group.MapPost("/{packageId}/versions/{version}/reject", async (string packageId, string version, ApprovalRequest? request, HttpContext httpContext, ApprovalService approvals, CancellationToken cancellationToken) =>
+            await approvals.SetVersionApprovalAsync(packageId, version, PackageApprovalStatus.Rejected, GetActor(httpContext), request?.Reason, cancellationToken) ? Results.NoContent() : Results.NotFound());
+
+        return endpoints;
+    }
+
+    private static string GetActor(HttpContext httpContext) =>
+        httpContext.User.FindFirstValue(ClaimTypes.NameIdentifier)
+        ?? httpContext.User.Identity?.Name
+        ?? "unknown";
+}

src/Elsa.Catalog.Api/Admin/Packages/AdminPackageContracts.cs

@@ -0,0 +1,29 @@
+using Elsa.Catalog.Core.Packages;
+
+namespace Elsa.Catalog.Api.Admin.Packages;
+
+public sealed record AdminPackageResponse(
+    string PackageId,
+    bool Approved,
+    bool Listed,
+    string? LatestVersion,
+    IReadOnlyList<AdminPackageVersionResponse> Versions);
+
+public sealed record AdminPackageVersionResponse(
+    string Version,
+    ValidationStatus ValidationStatus,
+    PackageApprovalStatus ApprovalStatus,
+    bool IsListed,
+    bool SuspiciousChangeDetected,
+    string? SchemaVersion);
+
+public sealed record ApprovalRequest(string? Reason);
+
+public sealed record AdminValidationResultResponse(
+    Guid Id,
+    string? SchemaVersion,
+    ValidationStatus Status,
+    string ErrorsJson,
+    string WarningsJson,
+    DateTimeOffset ValidatedAt,
+    string? ValidatorVersion);

src/Elsa.Catalog.Api/Admin/Packages/AdminPackageEndpoints.cs

@@ -0,0 +1,40 @@
+using Elsa.Catalog.Api.Authentication;
+using Elsa.Catalog.Core.Approvals;
+using Elsa.Catalog.Core.Packages;
+
+namespace Elsa.Catalog.Api.Admin.Packages;
+
+public static class AdminPackageEndpoints
+{
+    public static IEndpointRouteBuilder MapAdminPackageEndpoints(this IEndpointRouteBuilder endpoints)
+    {
+        var group = endpoints.MapGroup("/api/admin/packages")
+            .RequireAuthorization(AdminAuthorization.Policy)
+            .WithTags("Admin Packages");
+
+        group.MapGet("/", async (ApprovalService approvals, CancellationToken cancellationToken) =>
+            Results.Ok((await approvals.ListPackagesAsync(cancellationToken)).Select(ToResponse)));
+
+        group.MapGet("/{packageId}", async (string packageId, ApprovalService approvals, CancellationToken cancellationToken) =>
+        {
+            var package = await approvals.GetPackageAsync(packageId, cancellationToken);
+            return package is null ? Results.NotFound() : Results.Ok(ToResponse(package));
+        });
+
+        return endpoints;
+    }
+
+    internal static AdminPackageResponse ToResponse(Package package) =>
+        new(
+            package.PackageId,
+            package.Approved,
+            package.Listed,
+            package.LatestVersion,
+            package.Versions.Select(version => new AdminPackageVersionResponse(
+                version.Version,
+                version.ValidationStatus,
+                version.ApprovalStatus,
+                version.IsListed,
+                version.SuspiciousChangeDetected,
+                version.SchemaVersion)).ToList());
+}

src/Elsa.Catalog.Api/Admin/Packages/AdminValidationEndpoints.cs

@@ -0,0 +1,22 @@
+using Elsa.Catalog.Api.Authentication;
+using Elsa.Catalog.Core.Approvals;
+
+namespace Elsa.Catalog.Api.Admin.Packages;
+
+public static class AdminValidationEndpoints
+{
+    public static IEndpointRouteBuilder MapAdminValidationEndpoints(this IEndpointRouteBuilder endpoints)
+    {
+        var group = endpoints.MapGroup("/api/admin/packages")
+            .RequireAuthorization(AdminAuthorization.Policy)
+            .WithTags("Admin Validation");
+
+        group.MapGet("/{packageId}/versions/{version}/validation", async (string packageId, string version, IApprovalStore store, CancellationToken cancellationToken) =>
+        {
+            var results = await store.GetValidationResultsAsync(packageId, version, cancellationToken);
+            return Results.Ok(results.Select(x => new AdminValidationResultResponse(x.Id, x.SchemaVersion, x.Status, x.ErrorsJson, x.WarningsJson, x.ValidatedAt, x.ValidatorVersion)));
+        });
+
+        return endpoints;
+    }
+}