Pin MessagePack to patched 2.5.302 in AppHost

Aspire.Hosting.PostgreSQL/JavaScript pull in MessagePack 2.5.192
transitively, which has multiple known vulnerabilities and fails the
build with TreatWarningsAsErrors. Pinned a direct reference to the
patched 2.5.302 (same major, no API break).

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, build-runner-fix]
 
 jobs:
   build-and-push:

.gitignore

@@ -468,3 +468,6 @@ lerna-debug.log*
 # Windows thumbnail cache
 Thumbs.db
 ehthumbs.db
+
+# Self-installed .NET SDK (scripts/ci/lib.sh ensure_dotnet, used when a CI runner lacks the SDK)
+/.dotnet/

scripts/ci/build.sh

@@ -6,6 +6,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Restoring and publishing MicCheck.Api (Release)"
 dotnet publish src/api/MicCheck.Api/MicCheck.Api.csproj -c Release
 

scripts/ci/lib.sh

@@ -37,6 +37,23 @@ image_names() {
   ADMIN_IMAGE="$REGISTRY/$REGISTRY_OWNER/miccheck-admin"
 }
 
+# Installs .NET into $CI_ROOT/.dotnet via the vendored dotnet-install.sh if
+# `dotnet` isn't already on PATH, then prepends it to PATH for this process.
+# Keeps bare runners (no SDK preinstalled) working the same as a dev machine.
+ensure_dotnet() {
+  if command -v dotnet > /dev/null 2>&1; then
+    return 0
+  fi
+
+  local install_dir="$CI_ROOT/.dotnet"
+  if [[ ! -x "$install_dir/dotnet" ]]; then
+    log "dotnet not found on PATH; installing .NET SDK via dotnet-install.sh"
+    bash "$CI_ROOT/dotnet-install.sh" --channel LTS --install-dir "$install_dir"
+  fi
+  export PATH="$install_dir:$PATH"
+  export DOTNET_ROOT="$install_dir"
+}
+
 registry_login() {
   require_registry_vars
   [[ -n "$REGISTRY_USER" ]] || fail "REGISTRY_USER env var is required to push images"

scripts/ci/prepush.sh

@@ -5,6 +5,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Building full solution (Debug)"
 dotnet build MicCheck.slnx -c Debug
 

scripts/ci/test.sh

@@ -6,6 +6,8 @@ set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
 
+ensure_dotnet
+
 log "Running MicCheck.Api.Tests.Unit"
 dotnet test tests/api/MicCheck.Api.Tests.Unit/MicCheck.Api.Tests.Unit.csproj -c Release --logger trx
 

src/MicCheck.AppHost/MicCheck.AppHost.csproj

@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.4.2" />
     <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.4.0" />
+    <PackageReference Include="MessagePack" Version="2.5.302" />
   </ItemGroup>
 
   <PropertyGroup>

src/api/MicCheck.Api/MicCheck.Api.csproj

@@ -12,6 +12,7 @@
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.5" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.5" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.5" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="10.0.5" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.5">