V5.1.0/service update

[codebelt-aicia]

This is a service update that focuses on package dependencies.

Automated changes:

• Codebelt/Cuemon package versions bumped to latest compatible
• PackageReleaseNotes.txt updated for v5.0.8
• CHANGELOG.md entry added for v5.0.8

Note: Third-party packages (Microsoft.Extensions.*, BenchmarkDotNet, etc.) are not auto-updated.
Use Dependabot or manual updates for those.

Generated by codebelt-aicia
Triggered by: swashbuckle-aspnetcore @ 10.2.1

[greptile-apps]

Greptile Summary

This PR delivers v5.1.0, adding UseBootstrapperEnvironmentDefaults extension methods that wire up user secrets for local development across all bootstrapper host types (console, web, worker), bumping Codebelt/Cuemon and Microsoft.Extensions.* dependencies, and enhancing the CI pipeline with an optional macOS test matrix and a test_qualitygate aggregation job.

• New UseBootstrapperEnvironmentDefaults feature: two overloads are introduced — one for IHostApplicationBuilder (dynamically loads the entry assembly by name) and one for IHostBuilder (uses the generic AddUserSecrets<TStartup> overload). Both guard on the LocalDevelopment environment and use optional: true to avoid errors when no UserSecretsId attribute is present. The IHostApplicationBuilder path only catches FileNotFoundException, leaving FileLoadException and BadImageFormatException unhandled.
• CI improvements: a new test_mac job runs macOS X64/ARM64 tests only when opted in via workflow_dispatch, and a new test_qualitygate job gates all downstream analysis and deploy jobs on the combined test outcome.
• Dependency updates: all Codebelt, Cuemon, Microsoft.Extensions.*, coverlet, and Microsoft.NET.Test.Sdk packages are bumped to latest compatible versions for .NET 9 and .NET 10.

Confidence Score: 5/5

Safe to merge; all changes are scoped to local development configuration, dependency bumps, and CI improvements with no production logic altered.

The core logic change — UseBootstrapperEnvironmentDefaults — only activates in a LocalDevelopment environment, limiting any runtime impact. The incomplete exception catch in HostApplicationBuilderExtensions is a narrow edge case and does not affect non-local environments. Package bumps follow the established minor-version cadence, and the CI quality gate addition strengthens the pipeline.

src/Codebelt.Bootstrapper/HostApplicationBuilderExtensions.cs — the Assembly.Load catch block could be broadened to cover FileLoadException and BadImageFormatException.

Important Files Changed

Filename	Overview
src/Codebelt.Bootstrapper/HostApplicationBuilderExtensions.cs	Adds UseBootstrapperEnvironmentDefaults, which dynamically loads an assembly and registers user secrets; only catches FileNotFoundException, leaving FileLoadException and BadImageFormatException unhandled.
src/Codebelt.Bootstrapper/HostBuilderExtensions.cs	Adds UseBootstrapperEnvironmentDefaults for IHostBuilder; uses AddUserSecrets(optional: true) which silently skips missing UserSecretsId attributes — correct and safe.
src/Codebelt.Bootstrapper/HostEnvironmentExtensions.cs	New internal helper that checks for the 'LocalDevelopment' environment name; straightforward and correct.
.github/workflows/ci-pipeline.yml	Adds optional macOS test matrix and a test_qualitygate aggregation job; downstream jobs (sonarcloud, codecov, codeql, deploy) now correctly gate on the quality gate result.
Directory.Packages.props	Bumps Codebelt, Cuemon, Microsoft.Extensions.*, and coverlet packages; all version increments are consistent across net9 and net10 TFM groups.
src/Codebelt.Bootstrapper.Console/ConsoleProgram.cs	Inserts UseBootstrapperEnvironmentDefaults after UseBootstrapperStartup, which is in the opposite order compared to WorkerProgram; no functional impact today but a stylistic inconsistency.
src/Codebelt.Bootstrapper.Worker/WorkerProgram.cs	Inserts UseBootstrapperEnvironmentDefaults before UseBootstrapperStartup; ordering has no functional consequence since they operate on different builder phases.
test/Codebelt.Bootstrapper.FunctionalTests/HostApplicationBuilderExtensionsTest.cs	Comprehensive tests for UseBootstrapperEnvironmentDefaults covering LocalDevelopment detection, missing assembly, empty/null application name, and non-local environments.
test/Codebelt.Bootstrapper.FunctionalTests/HostBuilderExtensionsTest.cs	Tests verify user secrets provider is added only for LocalDevelopment and respects the reloadOnChange setting.
test/Codebelt.Bootstrapper.Console.FunctionalTests/Assets/NullStartupFactory.cs	Test helper returning a null startup instance; intentional for testing the 'unable to activate' log path in ConsoleHostedService.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Program.CreateHostBuilder] --> B[UseBootstrapperLifetime]
    B --> C{IHostApplicationBuilder\nor IHostBuilder?}
    C -- IHostApplicationBuilder --> D[UseBootstrapperEnvironmentDefaults\nHostApplicationBuilderExtensions]
    C -- IHostBuilder --> E[UseBootstrapperEnvironmentDefaults-TStartup\nHostBuilderExtensions]
    D --> F{IsLocalDevelopment?}
    E --> F
    F -- No --> G[Return unchanged]
    F -- Yes --> H{ApplicationName\npresent?}
    H -- No --> G
    H -- Yes --> I[Read hostBuilder:reloadConfigOnChange]
    I --> J{IHostApplicationBuilder path?}
    J -- Yes --> K[Assembly.Load applicationName]
    K --> L{FileNotFoundException?}
    L -- Yes --> G
    L -- No --> M[AddUserSecrets from assembly]
    J -- No --> N[AddUserSecrets-TStartup]
    M --> O[Return hostBuilder]
    N --> O

Loading

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
src/Codebelt.Bootstrapper/HostApplicationBuilderExtensions.cs:44-52
**Incomplete exception handling for `Assembly.Load`**

Only `FileNotFoundException` is caught, but `Assembly.Load` can also throw `FileLoadException` (e.g., version conflict, strong-name validation failure) and `BadImageFormatException` (malformed assembly). Either of these would propagate as an unhandled exception and crash application startup, even though the intent is to silently skip when the assembly cannot be used. While the local-development-only guard limits the blast radius, the pattern is inconsistent with the handling goal described in the catch comment.

### Issue 2 of 2
src/Codebelt.Bootstrapper.Console/ConsoleProgram.cs:19-23
**Inconsistent position of `UseBootstrapperEnvironmentDefaults` across Program classes**

In `ConsoleProgram`, `UseBootstrapperEnvironmentDefaults<TStartup>()` is placed after `UseBootstrapperStartup<TStartup>()`, whereas in `WorkerProgram` it comes before `UseBootstrapperStartup<TStartup>()`. These two extension methods use different builder phases (`ConfigureAppConfiguration` vs `ConfigureServices`), so there is no functional difference in this case. However, the inconsistency may mislead readers about the intended ordering convention and could matter if the position is ever changed to `ConfigureServices` in the future.

_{Reviews (3): Last reviewed commit: "✨ add UseBootstrapperEnvironmentDefaults..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (acc5d04) to head (40dadb1).

Additional details and impacted files

@@             Coverage Diff              @@
##             main       #31       +/-   ##
============================================
+ Coverage   83.84%   100.00%   +16.15%     
============================================
  Files          20        21        +1     
  Lines         260       291       +31     
  Branches       19        23        +4     
============================================
+ Hits          218       291       +73     
+ Misses         42         0       -42     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
1 Security Hotspot
97.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud