timothy
45627ede82
- Add concurrency group so the single jazz runner can't run the push-main-then-push-tag release flow in parallel (shared :buildcache + smoke container would collide). - Add pull_request trigger running the test job only (PRs had no gate); skip the build job on PRs. - Only push images from main or a v* tag (workflow_dispatch from other refs now builds without publishing, instead of clobbering :latest/:prod). - Replace the log-grep smoke check with a real HTTP readiness probe (docker exec python3 -> http://localhost:8409/), unique container name, and trap-based cleanup to avoid leaks on cancel. - dotnet test now runs -c Release --no-build (was rebuilding in Debug). - Directory.Build.props: WarningsAsErrors=NU1904 so critical NuGet advisories block in every project, not just ones with TreatWarningsAsErrors. - Dockerfile copies global.json + .editorconfig too, so the image build matches CI's SDK pin and analyzer severities. - Remove dead .github/dependabot.yml + FUNDING.yml (upstream-pointed). - Rewrite docs/ci-cd.md to the implemented pipeline. Refs #4, #3, #8.