Streamline .NET SDK upgrade process and remove CodeAnalysis checks

.github/ISSUE_TEMPLATE/target_frameworks.md

@@ -9,11 +9,15 @@ type: task
 
 - [ ] Update `global.json` to the required SDK version.
 Use the minimal SDK version required, the `rollForward` rule will pick the latest version available on the machine. It's up to the user to update their SDK to the version they want in case there is an update and we don't want to force them into a newer version in case they can't install it.
-- [ ] Update CodeAnalysis packages in `Directory.Packages.props` to versions supported by the new SDK's Roslyn compiler. See [Upgrading the .NET SDK Version](../../src/docs/guides/upgrading-sdk-version/README.md) guide for details.
-- [ ] Run `build/verify-codeanalysis-versions.ps1` to verify package compatibility.
+- [ ] Optionally update CodeAnalysis packages in `Directory.Packages.props` to versions supported by the new SDK's Roslyn compiler. See [Upgrading the .NET SDK Version](../../src/docs/guides/upgrading-sdk-version/README.md) guide for details.
 - [ ] Update `src/OrchardCore.Build/TargetFrameworks.props`.
 - [ ] Decide whether to upgrade the C# language version in `src/OrchardCore.Build/OrchardCore.Commons.props`.
 - [ ] Add a custom `AspNetCorePackagesVersion` for each TFM in `Directory.Packages.props`
+- [ ] Update `.github/actions/setup-dotnet/action.yml` to the required SDK versions. If dual targeting frameworks, add both. Use the same version as in `global.json`:
+  ```yaml
+  dotnet-version: | 
+    10.0.302
+  ```
 - [ ] Update all `dotnet publish`, `dotnet build` and `dotnet test` calls to the latest TFM, if specified.
 - [ ] Update all `tasks.json` files to target the latest TFM
 - [ ] Update the list of template **choices** (see the `template.json` files).

.github/actions/setup-dotnet/action.yml

@@ -6,3 +6,6 @@ runs:
   steps:
     - name: Set Up .NET
       uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      with:
+        dotnet-version: | 
+          10.0.302

.github/workflows/main_ci.yml

@@ -28,11 +28,26 @@ jobs:
         os: [ubuntu-24.04, windows-2022]
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Pin global.json SDK in CI
+      shell: pwsh
+      run: |
+        $globalJson = Get-Content global.json -Raw | ConvertFrom-Json
+        $version = $globalJson.sdk.version
+        $globalJson.sdk.PSObject.Properties.Remove('rollForward')
+        $globalJson | ConvertTo-Json -Depth 10 | Set-Content global.json
+        Write-Host "Pinned global.json SDK for CI: $version"
     - uses: ./.github/actions/setup-dotnet
-    - name: Verify CodeAnalysis Package Versions
-      # Ensure Microsoft.CodeAnalysis packages stay in sync with the Roslyn compiler version in global.json
+    - name: Verify exact .NET SDK from global.json
+      shell: pwsh
       run: |
-        pwsh ./build/verify-codeanalysis-versions.ps1
+        $expected = (Get-Content global.json | ConvertFrom-Json).sdk.version
+        $actual = dotnet --version
+        Write-Host "Expected SDK: $expected"
+        Write-Host "Actual SDK:   $actual"
+        if ($actual -ne $expected) {
+          Write-Error "CI must use exact SDK version from global.json."
+          exit 1
+        }
     - name: Build
       # See pr_ci.yml for the reason why we disable NuGet audit warnings.
       run: |

.github/workflows/pr_ci.yml

@@ -20,11 +20,26 @@ jobs:
     name: Build & Test
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Pin global.json SDK in CI
+      shell: pwsh
+      run: |
+        $globalJson = Get-Content global.json -Raw | ConvertFrom-Json
+        $version = $globalJson.sdk.version
+        $globalJson.sdk.PSObject.Properties.Remove('rollForward')
+        $globalJson | ConvertTo-Json -Depth 10 | Set-Content global.json
+        Write-Host "Pinned global.json SDK for CI: $version"
     - uses: ./.github/actions/setup-dotnet
-    - name: Verify CodeAnalysis Package Versions
-      # Ensure Microsoft.CodeAnalysis packages stay in sync with the Roslyn compiler version in global.json
+    - name: Verify exact .NET SDK from global.json
+      shell: pwsh
       run: |
-        pwsh ./build/verify-codeanalysis-versions.ps1
+        $expected = (Get-Content global.json | ConvertFrom-Json).sdk.version
+        $actual = dotnet --version
+        Write-Host "Expected SDK: $expected"
+        Write-Host "Actual SDK:   $actual"
+        if ($actual -ne $expected) {
+          Write-Error "CI must use exact SDK version from global.json."
+          exit 1
+        }
     - name: Build
       # We disable NuGet audit warnings, see https://learn.microsoft.com/en-us/nuget/reference/errors-and-warnings/nu1901-nu1904.
       # Security issues being discovered in NuGet packages we use can happen at any time, and thus all our CI builds that

Directory.Packages.props

@@ -87,9 +87,9 @@
        compiler in global.json (10.0.302). Version 5.6 is the max supported version for SDK 10.0.0-10.0.3xx.
        See build/verify-codeanalysis-versions.ps1 for version verification. -->
   <ItemGroup>
-    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.6.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
-    <GlobalPackageReference Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
+    <GlobalPackageReference Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="5.9.0" />
   </ItemGroup>
   <ItemGroup>
     <GlobalPackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.400" />

src/docs/guides/upgrading-sdk-version/README.md

@@ -7,9 +7,9 @@ This guide explains how to upgrade the .NET SDK version used by Orchard Core and
 Orchard Core specifies a minimum .NET SDK version in `global.json`. When upgrading the SDK version, you need to:
 
 1. Update the SDK version in `global.json`
-2. Update CodeAnalysis packages to versions compatible with the new SDK's Roslyn compiler
-3. Update other framework-specific packages as needed
-4. Run the verification script to ensure compatibility
+2. Update `.github/actions/setup-dotnet/action.yml` to the same SDK version
+3. Update CodeAnalysis packages to versions compatible with the new SDK's Roslyn compiler (optional)
+4. Update other framework-specific packages as needed
 5. Update CI/CD configuration and documentation
 
 ## Understanding the Relationship
@@ -48,8 +48,6 @@ Look up the Roslyn version included in the new SDK:
 - Check [.NET SDK releases](https://github.com/dotnet/sdk/releases) for the Roslyn version included in the SDK version you are upgrading to
 - Check [Roslyn](https://github.com/dotnet/roslyn) for additional Roslyn version details
 
-Update the version requirement mapping in `build/verify-codeanalysis-versions.ps1` if this is a new minor SDK version.
-
 ### Step 3: Update CodeAnalysis Packages (Optional)
 
 Updating CodeAnalysis packages is **optional**. You may choose to update them to newer compatible versions when upgrading the SDK, but it is not required.
@@ -58,35 +56,27 @@ If you decide to update them, use `Directory.Packages.props` to update the CodeA
 
 ```xml
 <!-- Microsoft.CodeAnalysis packages must be equal to or lower than the version supported by the Roslyn 
-     compiler in global.json (10.0.4xx). Version 5.9 is the max supported version for SDK 10.0.4xx+.
-     See build/verify-codeanalysis-versions.ps1 for version verification. -->
+     compiler in global.json (10.0.4xx). Version 5.9 is the max supported version for SDK 10.0.4xx+. -->
 <ItemGroup>
   <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="5.9.0" />
   <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.9.0" />
   <GlobalPackageReference Include="Microsoft.CodeAnalysis.CSharp.CodeStyle" Version="5.9.0" />
 </ItemGroup>
 ```
 
-### Step 4: Update the Verification Script (If Needed)
+### Step 4: Update GitHub setup-dotnet Action
 
-If the new SDK version is a new minor version (e.g., upgrading from 10.0.3xx to 10.0.4xx), you must manually add a new entry to the `$versionRequirements` hash in `build/verify-codeanalysis-versions.ps1` with the compatible CodeAnalysis version range for that SDK version.
+Update `.github/actions/setup-dotnet/action.yml` so `dotnet-version` matches `global.json` exactly.
 
-Before committing, verify that the SDK version and CodeAnalysis packages are properly configured:
+Example:
 
-```powershell
-pwsh ./build/verify-codeanalysis-versions.ps1
+```yaml
+with:
+  dotnet-version: |
+    10.0.302
 ```
 
-This script will:
-- Parse the SDK version from `global.json`
-- Check the version mapping in the script
-- Verify that CodeAnalysis packages don't exceed the maximum supported version
-- Provide clear diagnostics if versions don't match
-
-**Expected output:**
-```
-✓ All CodeAnalysis package versions are supported by the .NET SDK (Roslyn 5.9, max version: 5.9)
-```
+This ensures CI installs the same SDK version used by the repository.
 
 ### Step 5: Update Framework-Specific Packages
 
@@ -113,7 +103,7 @@ dotnet build -c Release
 ```
 
 The CI pipeline will also automatically:
-- Run `build/verify-codeanalysis-versions.ps1` to check version compatibility
+- Install the SDK version from `.github/actions/setup-dotnet/action.yml`
 - Run all unit and functional tests
 - Verify there are no compilation errors
 
@@ -138,34 +128,17 @@ Current configuration in `renovate.json5`:
 
 ## Troubleshooting
 
-### Build fails with "CodeAnalysis package version mismatch"
+### Build fails after updating CodeAnalysis packages
 
-The CI verification script detected that CodeAnalysis packages exceed the maximum version supported by the SDK in `global.json`. Run the verification script locally to see the exact mismatch:
+CodeAnalysis packages may be newer than the Roslyn version included in the SDK pinned by `global.json`. Lower the `Microsoft.CodeAnalysis.*` package versions in `Directory.Packages.props` to versions supported by that SDK.
 
-```powershell
-pwsh ./build/verify-codeanalysis-versions.ps1
-```
+### CI fails to install the expected SDK version
 
-Then update the CodeAnalysis versions in `Directory.Packages.props` to equal or lower versions.
-
-### "No version mapping found for SDK X.Y.Z"
-
-The verification script doesn't have a mapping for your SDK version. Add a new entry to the `$versionRequirements` hash in `build/verify-codeanalysis-versions.ps1`:
-
-```powershell
-@{
-    # SDK 10.0.5xx and later (Roslyn X.Y.x)
-    minPatchVersion = 500
-    maxPatchVersion = 999
-    maxAnalyzerVersion = "X.Y"
-    maxAnalyzerMajorMinor = @(X, Y)
-    roslynVersion = "X.Y"
-}
-```
+Ensure `.github/actions/setup-dotnet/action.yml` was updated to the exact same SDK version as `global.json`.
 
 ### Local build succeeds but CI fails
 
-Make sure you have the correct .NET SDK version installed. The `global.json` file enforces a minimum SDK version. Install the required version from [dotnet.microsoft.com](https://dotnet.microsoft.com/download).
+Make sure you have the correct .NET SDK version installed locally and that CI uses the same version. Keep `global.json` and `.github/actions/setup-dotnet/action.yml` aligned, then install the required SDK from [dotnet.microsoft.com](https://dotnet.microsoft.com/download).
 
 ## References