V2.0.0/service update

[gimlichael]

This pull request introduces foundational improvements to repository standards, automation, and documentation for the Static Content Provider project. It adds comprehensive contributing and agent guides, enforces code style and engineering rules, and implements a suite of reusable GitHub Actions for Docker image lifecycle management and SBOM/provenance attestations. Automated dependency updates are also configured.

Key changes include:

Documentation and Engineering Standards

• Added .github/CONTRIBUTING.md with clear contribution, code, and PR guidelines.
• Introduced AGENTS.md with durable engineering principles, project structure, and testing conventions for all contributors.

Repository and Code Quality Automation

• Added .editorconfig to enforce .NET and C# code style, file-scoped namespaces, and formatting rules.
• Set up .github/dependabot.yml to automate dependency updates for NuGet, GitHub Actions, and Dockerfiles.

Reusable GitHub Actions for Docker and Supply Chain Security

• Implemented composite actions for Docker image build, save, load, push, login, and tagging (SemVer and TrunkVer), as well as SBOM generation and SBOM/provenance attestations. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]

Docker Build Context Optimization

• Refined .dockerignore to minimize build context size and avoid including unnecessary files and directories in Docker builds.

[greptile-apps]

Greptile Summary

The PR updates the static-content service and introduces repository standards, CI automation, container publication, and supply-chain attestations.

• Adds reusable Docker build, tagging, save/load, push, SBOM, and attestation actions.
• Adds a multi-stage CI pipeline with testing, analysis, container publication, and promotion gates.
• Updates application configuration, content-root validation, cache handling, documentation, and test coverage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/Codebelt.Cdn.Origin/Hosting/CachePolicyResolver.cs	Uses case-insensitive immutable-prefix matching, resolving the previously reported cache-policy inconsistency.
src/Codebelt.Cdn.Origin/Hosting/ContentRootValidator.cs	Resolves symbolic links and junctions to final targets before checking whether a content root exposes application files.
.github/workflows/ci-pipeline.yml	Adds gated build, test, analysis, container publication, attestation, and promotion jobs.
.dockerignore	Reduces the repository-root Docker build context by excluding development and build artifacts.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Source[Source and configuration] --> Build[Build and test]
  Build --> Quality[Quality gates]
  Quality --> Image[Build and save container]
  Image --> Staging[Publish to staging]
  Staging --> Attest[SBOM and provenance attestations]
  Attest --> Production[Promote to Docker Hub]

Loading

_{Reviews (4): Last reviewed commit: "📝 update 2.0.0 changelog" | Re-trigger Greptile}

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.