fix: harden rate limiting, bound waits and optimize 10.2.0

.config/dotnet-tools.json

@@ -3,21 +3,21 @@
   "isRoot": true,
   "tools": {
     "roslynator.dotnet.cli": {
-      "version": "0.12.0",
+      "version": "1.0.0",
       "commands": [
         "roslynator"
       ],
       "rollForward": false
     },
     "coverlet.console": {
-      "version": "8.0.0",
+      "version": "10.0.1",
       "commands": [
         "coverlet"
       ],
       "rollForward": false
     },
     "dotnet-reportgenerator-globaltool": {
-      "version": "5.5.3",
+      "version": "5.5.11",
       "commands": [
         "reportgenerator"
       ],

.editorconfig

@@ -0,0 +1,5 @@
+root = true
+
+[*.cs]
+# RPC identity/signature drift must be reviewed before clients and silos diverge.
+dotnet_analyzer_diagnostic.category-Versioning.severity = error

.github/workflows/ci.yml

@@ -14,16 +14,77 @@ permissions:
   contents: read
 
 jobs:
+  performance:
+    name: Isolated concurrency comparison
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      BASELINE_REF: '705b47da12e41fa22aebc3049819c9efd2b605f8'
+      TEST_PROJECT: 'ManagedCode.Orleans.RateLimiting.Tests/ManagedCode.Orleans.RateLimiting.Tests.csproj'
+      RATE_LIMIT_PERFORMANCE_ALGORITHM: 'concurrency'
+      RATE_LIMIT_PERFORMANCE_WARM_WORKLOAD: 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6.0.0
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Prepare identical baseline harness
+        run: |
+          baseline_dir="$RUNNER_TEMP/rate-baseline"
+          mkdir -p "$baseline_dir"
+          git archive "$BASELINE_REF" | tar -x -C "$baseline_dir"
+          cp -R ManagedCode.Orleans.RateLimiting.Tests/Performance "$baseline_dir/ManagedCode.Orleans.RateLimiting.Tests/Performance"
+          printf 'Baseline: %s; updated: %s. All samples run serially on this runner.\n' "$BASELINE_REF" "$GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Build baseline
+        working-directory: ${{ runner.temp }}/rate-baseline
+        run: dotnet build "$TEST_PROJECT" -c Release -p:RunPerformanceTests=true
+
+      - name: Build updated
+        run: dotnet build "$TEST_PROJECT" -c Release -p:RunPerformanceTests=true
+
+      - name: Compare warmed workloads in ABBA order
+        run: |
+          sample=0
+          for version in baseline updated updated baseline; do
+            source_dir="$GITHUB_WORKSPACE"
+            if [ "$version" = baseline ]; then source_dir="$RUNNER_TEMP/rate-baseline"; fi
+            for caller_token in false true; do
+              export RATE_LIMIT_PERFORMANCE_CALLER_TOKEN="$caller_token"
+              export RATE_LIMIT_PERFORMANCE_OUTPUT="$GITHUB_WORKSPACE/artifacts/performance/$sample-$version-$caller_token.json"
+              dotnet test --project "$source_dir/$TEST_PROJECT" -c Release --no-build -p:RunPerformanceTests=true --treenode-filter '/*/*/PerformanceBenchmarkTests/*'
+            done
+            sample=$((sample + 1))
+          done
+
+      - name: Summarize paired measurements
+        run: python3 scripts/summarize-performance.py artifacts/performance >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload every measurement
+        if: always()
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: performance-comparison
+          path: artifacts/performance/**
+          retention-days: 30
+
   build-and-test:
     name: Build, Test, and Coverage
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7.0.1
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6.0.0
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -39,29 +100,37 @@ jobs:
       - name: Analyze
         run: dotnet build ManagedCode.Orleans.RateLimiting.sln --configuration Release --no-restore -p:RunAnalyzers=true
 
+      - name: Validate package compatibility
+        run: dotnet pack ManagedCode.Orleans.RateLimiting.sln --configuration Release --no-build
+
       - name: Verify formatting
         run: dotnet format ManagedCode.Orleans.RateLimiting.sln --verify-no-changes
 
       - name: Test
         run: dotnet test --solution ManagedCode.Orleans.RateLimiting.sln --configuration Release --no-build --verbosity normal --report-trx --results-directory ./artifacts/test-results
 
+      - name: Map deterministic coverage source paths
+        run: |
+          mkdir -p artifacts/coverage
+          printf '|%s/=/_/\n' "$GITHUB_WORKSPACE" > artifacts/coverage/SourceRootsMapping.txt
+
       - name: Collect coverage
-        run: dotnet tool run coverlet ManagedCode.Orleans.RateLimiting.Tests/bin/Release/net10.0/ManagedCode.Orleans.RateLimiting.Tests.dll --target "dotnet" --targetargs "test --project ManagedCode.Orleans.RateLimiting.Tests/ManagedCode.Orleans.RateLimiting.Tests.csproj --configuration Release --no-build --no-restore" --format cobertura --output artifacts/coverage/coverage.cobertura.xml --exclude "[ManagedCode.Orleans.RateLimiting.Tests]*" --threshold 85 --threshold-type line --threshold-stat total
+        run: dotnet tool run coverlet ManagedCode.Orleans.RateLimiting.Tests/bin/Release/net10.0/ManagedCode.Orleans.RateLimiting.Tests.dll --target "dotnet" --targetargs "test --project ManagedCode.Orleans.RateLimiting.Tests/ManagedCode.Orleans.RateLimiting.Tests.csproj --configuration Release --no-build --no-restore" --source-mapping-file artifacts/coverage/SourceRootsMapping.txt --format cobertura --output artifacts/coverage/coverage.cobertura.xml --exclude "[ManagedCode.Orleans.RateLimiting.Tests]*" --threshold 85 --threshold-type line --threshold-stat total
 
       - name: Render coverage report
         run: dotnet tool run reportgenerator -reports:"artifacts/coverage/coverage.cobertura.xml" -targetdir:"artifacts/coverage-report" -reporttypes:"HtmlSummary;MarkdownSummaryGithub"
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: test-results
           path: ./artifacts/test-results/**
           retention-days: 5
 
       - name: Upload coverage artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: coverage-report
           path: |
@@ -70,7 +139,7 @@ jobs:
           retention-days: 5
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./artifacts/coverage/coverage.cobertura.xml

.github/workflows/codeql-analysis.yml

@@ -12,6 +12,7 @@
 name: CodeQL
 
 on:
+  workflow_dispatch:
   push:
     branches: [ main ]
   pull_request:
@@ -20,37 +21,43 @@ on:
   schedule:
     - cron: '35 11 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'csharp' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+        language: [ 'csharp', 'actions' ]
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v7.0.1
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      if: matrix.language == 'csharp'
+      uses: actions/setup-dotnet@v6.0.0
       with:
         dotnet-version: '10.0.x'
 
     - name: Restore
+      if: matrix.language == 'csharp'
       run: dotnet restore ManagedCode.Orleans.RateLimiting.sln
 
     - name: Build
+      if: matrix.language == 'csharp'
       run: dotnet build ManagedCode.Orleans.RateLimiting.sln --configuration Release --no-restore
 
     - name: Perform CodeQL Analysis