From f68e126c9d9349682c84c40e942223f472b3520a Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 15:45:20 +0100
Subject: [PATCH 01/28] Create docker-publish.yml

---
 .github/workflows/docker-publish.yml | 98 ++++++++++++++++++++++++++++
 1 file changed, 98 insertions(+)
 create mode 100644 .github/workflows/docker-publish.yml

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 0000000..c094564
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,98 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  schedule:
+    - cron: '31 9 * * *'
+  push:
+    branches: [ "main" ]
+    # Publish semver tags as releases.
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
+        with:
+          cosign-release: 'v2.2.4'
+
+      # Set up BuildKit Docker container builder to be able to build
+      # multi-platform images and export cache
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

From ce133d03e306cfa871f1859522ec41be785ac2e7 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:11:18 +0100
Subject: [PATCH 02/28] Update cron schedule to nightly and add Docker metadata
 tags

---
 .github/workflows/docker-publish.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index c094564..27b4e37 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -7,7 +7,7 @@ name: Docker
 
 on:
   schedule:
-    - cron: '31 9 * * *'
+    - cron: '31 22 * * *'
   push:
     branches: [ "main" ]
     # Publish semver tags as releases.
@@ -68,6 +68,11 @@ jobs:
         uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=schedule,enable=true,priority=1000,pattern=nightly
+            type=semver,pattern={{version}}
+            type=ref,event=branch
+            type=ref,event=pr
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action

From ab3eac5732647bafea3a9c34b89dded7f681bfc1 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:15:17 +0100
Subject: [PATCH 03/28] Update Docker build context to
 source/AAS.TwinEngine.DataEngine

---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 27b4e37..ad38746 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -80,7 +80,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
-          context: .
+          context: source/AAS.TwinEngine.DataEngine
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

From f0a85a922cf7b8d269aae881c37cb819324028a3 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:20:45 +0100
Subject: [PATCH 04/28] Update Docker build context and specify Dockerfile path

---
 .github/workflows/docker-publish.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index ad38746..59f915d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -80,7 +80,8 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
-          context: source/AAS.TwinEngine.DataEngine
+          context: ./source
+          file: source/AAS.TwinEngine.DataEngine/Dockerfile
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

From d48a4f69490a8902beb6fcfb257283461092475b Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:30:03 +0100
Subject: [PATCH 05/28] Update docker-publish.yml

---
 .github/workflows/docker-publish.yml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 59f915d..6268926 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -88,17 +88,17 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-      # Sign the resulting Docker image digest except on PRs.
-      # This will only write to the public Rekor transparency log when the Docker
-      # repository is public to avoid leaking data.  If you would like to publish
-      # transparency data even for private images, pass --force to cosign below.
-      # https://github.com/sigstore/cosign
-      - name: Sign the published Docker image
-        if: ${{ github.event_name != 'pull_request' }}
-        env:
-          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
-          TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        # This step uses the identity token to provision an ephemeral certificate
-        # against the sigstore community Fulcio instance.
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+      # # Sign the resulting Docker image digest except on PRs.
+      # # This will only write to the public Rekor transparency log when the Docker
+      # # repository is public to avoid leaking data.  If you would like to publish
+      # # transparency data even for private images, pass --force to cosign below.
+      # # https://github.com/sigstore/cosign
+      # - name: Sign the published Docker image
+      #   if: ${{ github.event_name != 'pull_request' }}
+      #   env:
+      #     # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+      #     TAGS: ${{ steps.meta.outputs.tags }}
+      #     DIGEST: ${{ steps.build-and-push.outputs.digest }}
+      #   # This step uses the identity token to provision an ephemeral certificate
+      #   # against the sigstore community Fulcio instance.
+      #   run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

From 28f5df698b7d4ea6c89635d7cd67d1d30ba07e48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:36:38 +0100
Subject: [PATCH 06/28] Bump actions/setup-dotnet from 4.3.1 to 5.0.1 (#11)

* Update dependabot.yml

* Update dependabot.yml

* Bump actions/setup-dotnet from 4.3.1 to 5.0.1

Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4.3.1 to 5.0.1.
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](https://github.com/actions/setup-dotnet/compare/67a3573c9a986a3f9c594539f4ab511d57bb3ce9...2016bd2012dba4e32de620c46fe006a3ac9f0602)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: mm-psy <147830298+mm-psy@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/dependabot.yml       | 6 ++++++
 .github/workflows/dotnet.yml | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f95adb1..50bb708 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,11 +6,17 @@
 version: 2
 updates:
   - package-ecosystem: "nuget"
+    open-pull-requests-limit: 30
     directory: "/source"
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 3
+    groups:
+      non-major:
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "docker"
     directory: "/source/AAS.TwinEngine.DataEngine"
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 196bccf..49774f1 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Setup .NET
-      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
       with:
         dotnet-version: 8.0.x
     - name: Restore dependencies

From 5ced613cfaf7fd204aa15e448a222967dc60ae0b Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 1 Dec 2025 16:37:02 +0100
Subject: [PATCH 07/28] Revert "Bump actions/setup-dotnet from 4.3.1 to 5.0.1
 (#11)" (#26)

This reverts commit 28f5df698b7d4ea6c89635d7cd67d1d30ba07e48.
---
 .github/dependabot.yml       | 6 ------
 .github/workflows/dotnet.yml | 2 +-
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 50bb708..f95adb1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,17 +6,11 @@
 version: 2
 updates:
   - package-ecosystem: "nuget"
-    open-pull-requests-limit: 30
     directory: "/source"
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 3
-    groups:
-      non-major:
-        update-types:
-          - "minor"
-          - "patch"
 
   - package-ecosystem: "docker"
     directory: "/source/AAS.TwinEngine.DataEngine"
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 49774f1..196bccf 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Setup .NET
-      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
+      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
       with:
         dotnet-version: 8.0.x
     - name: Restore dependencies

From f07de4d84001d4ce3f5d74b5215e2873f9ab4dc5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 10:30:51 +0100
Subject: [PATCH 08/28] Bump docker/build-push-action from 5.0.0 to 6.18.0
 (#27)

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.0.0 to 6.18.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/0565240e2d4ab88bba5387d719585280857ece09...263435318d21b8e681c14492fe198d362a7d2c83)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 6268926..872f9a0 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -78,7 +78,7 @@ jobs:
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           context: ./source
           file: source/AAS.TwinEngine.DataEngine/Dockerfile

From 201cea70afe313e9f113f5b74e2bb6c871f35524 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 10:31:07 +0100
Subject: [PATCH 09/28] Bump actions/checkout from 4 to 6 (#30)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 872f9a0..d8bb780 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer

From bd9c42142926948369eb754c16d0d3295b6cddc4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 2 Dec 2025 10:31:40 +0100
Subject: [PATCH 10/28] Bump docker/metadata-action from 5.0.0 to 5.10.0 (#28)

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5.0.0 to 5.10.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](https://github.com/docker/metadata-action/compare/96383f45573cb7f253c731d3b3ab81c87ef81934...c299e40c65443455700f0fdfc63efafe5b349051)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-version: 5.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index d8bb780..7ff6c04 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -65,7 +65,7 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |

From 9e90ccc10cd51eec21529169e5c87844ccd1e481 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Tue, 2 Dec 2025 14:10:33 +0100
Subject: [PATCH 11/28] Create sbom.yml (#24)

* Create main.yml

* Add SBOM generation workflow

* Update sbom.yml

* Update .github/workflows/sbom.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/sbom.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/sbom.yml

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
new file mode 100644
index 0000000..d802bbc
--- /dev/null
+++ b/.github/workflows/sbom.yml
@@ -0,0 +1,27 @@
+name: SBOM Generation
+
+on:
+  push:
+    branches: [ "main", "release-*" ]
+    tags: [ 'v*.*.*' ]
+
+permissions:
+  contents: write
+
+jobs:
+  generate-sbom:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Generate SBOM
+        run: docker run --rm -v ${{ runner.temp }}:${{ runner.temp }} -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o ${{ runner.temp }}/bom.json
+    
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: sbom
+          path: ${{ runner.temp }}/bom.json

From bdac82fc01299d48b2fdaee561b24875749ec6e6 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Tue, 2 Dec 2025 14:18:40 +0100
Subject: [PATCH 12/28] Update sbom.yml

---
 .github/workflows/sbom.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index d802bbc..502d5d3 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -18,10 +18,10 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Generate SBOM
-        run: docker run --rm -v ${{ runner.temp }}:${{ runner.temp }} -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o ${{ runner.temp }}/bom.json
+        run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json
     
       - name: Upload SBOM artifact
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: sbom
-          path: ${{ runner.temp }}/bom.json
+          path: /tmp/bom.json

From 95837ca1b4fc35c3ee51a3edbfe2c7771810c4f6 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Tue, 2 Dec 2025 14:56:46 +0100
Subject: [PATCH 13/28] Update docker-publish.yml to support multiple branches
 for push and pull requests (#31)

---
 .github/workflows/docker-publish.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 7ff6c04..c65ee1a 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -9,11 +9,11 @@ on:
   schedule:
     - cron: '31 22 * * *'
   push:
-    branches: [ "main" ]
+    branches: [ "main", "release-*" ]
     # Publish semver tags as releases.
     tags: [ 'v*.*.*' ]
   pull_request:
-    branches: [ "main" ]
+    branches: [ "main", "release-*" ]
 
 env:
   # Use docker.io for Docker Hub if empty
@@ -37,13 +37,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      # Install the cosign tool except on PR
-      # https://github.com/sigstore/cosign-installer
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
-        with:
-          cosign-release: 'v2.2.4'
+      # # Install the cosign tool except on PR
+      # # https://github.com/sigstore/cosign-installer
+      # - name: Install cosign
+      #   if: github.event_name != 'pull_request'
+      #   uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
+      #   with:
+      #     cosign-release: 'v2.2.4'
 
       # Set up BuildKit Docker container builder to be able to build
       # multi-platform images and export cache
@@ -73,6 +73,7 @@ jobs:
             type=semver,pattern={{version}}
             type=ref,event=branch
             type=ref,event=pr
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') && github.event.base_ref == 'release-v1.0' }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action

From da910df9549330a1e23a4ec80b3eba31aae54f3d Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Fri, 5 Dec 2025 12:00:23 +0100
Subject: [PATCH 14/28] Update docker-publish.yml (#32)

---
 .github/workflows/docker-publish.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index c65ee1a..9c06b0d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -81,6 +81,7 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
+          sbom: true
           context: ./source
           file: source/AAS.TwinEngine.DataEngine/Dockerfile
           push: ${{ github.event_name != 'pull_request' }}

From 58d0f05212f5965e76f49b50558c5de820741f25 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Fri, 5 Dec 2025 13:15:06 +0100
Subject: [PATCH 15/28] Update docker-publish.yml

---
 .github/workflows/docker-publish.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 9c06b0d..0bf182b 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -68,12 +68,14 @@ jobs:
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=false
           tags: |
             type=schedule,enable=true,priority=1000,pattern=nightly
             type=semver,pattern={{version}}
             type=ref,event=branch
             type=ref,event=pr
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') && github.event.base_ref == 'release-v1.0' }}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v1.0.')}}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action

From 7d8e3289818d915b8ae3b038faede9f8e2c7f875 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:09:20 +0100
Subject: [PATCH 16/28] Update docker-publish.yml (#33)

---
 .github/workflows/docker-publish.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 0bf182b..7f43648 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -84,6 +84,7 @@ jobs:
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:
           sbom: true
+          provenance: mode=max
           context: ./source
           file: source/AAS.TwinEngine.DataEngine/Dockerfile
           push: ${{ github.event_name != 'pull_request' }}

From 4c266cdbce7d429f23820b5d314b239b92369712 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:33:17 +0100
Subject: [PATCH 17/28] Bump actions/setup-dotnet from 4.3.1 to 5.0.1 (#29)

Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4.3.1 to 5.0.1.
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](https://github.com/actions/setup-dotnet/compare/67a3573c9a986a3f9c594539f4ab511d57bb3ce9...2016bd2012dba4e32de620c46fe006a3ac9f0602)

---
updated-dependencies:
- dependency-name: actions/setup-dotnet
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dotnet.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 196bccf..49774f1 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Setup .NET
-      uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
       with:
         dotnet-version: 8.0.x
     - name: Restore dependencies

From 38977e3f9ac1b70e0a1e47155d1e9a22f0901a63 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:33:28 +0100
Subject: [PATCH 18/28] Bump actions/upload-artifact from 4.6.1 to 5.0.0 (#34)

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 5.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.6.1...330a01c490aca151604b8cf639adc76d48f6c5d4)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/sbom.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 502d5d3..67339de 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -21,7 +21,7 @@ jobs:
         run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json
     
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: sbom
           path: /tmp/bom.json

From b9d77e5ae19824130a82313b7fff730bfc93d96d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:33:59 +0100
Subject: [PATCH 19/28] Bump github/codeql-action from 3.31.2 to 4.31.6 (#35)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.31.2 to 4.31.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5d5cd550d3e189c569da8f16ea8de2d821c9bf7a...fe4161a26a8629af62121b670040955b330f9af2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 85079c8..f2e4aea 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5d5cd550d3e189c569da8f16ea8de2d821c9bf7a # v3.31.2
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: results.sarif

From f2ab891cf7323c78380a0c4158c9c1f5096593fb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:34:15 +0100
Subject: [PATCH 20/28] Bump docker/login-action from 3.0.0 to 3.6.0 (#36)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/343f7c4344506bcbf9b4de18042ae17996df046d...5e57cd118135c172c3672efd75eb46360885c0ef)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 7f43648..36d25bb 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -55,7 +55,7 @@ jobs:
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

From 382b4418523afda5cb95d7a160af07ebfd30a82d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:34:33 +0100
Subject: [PATCH 21/28] Bump actions/checkout from 4.3.0 to 6.0.1 (#37)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v4.3.0...v6.0.1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/dependency-review.yml | 2 +-
 .github/workflows/docker-publish.yml    | 2 +-
 .github/workflows/dotnet.yml            | 2 +-
 .github/workflows/sbom.yml              | 2 +-
 .github/workflows/scorecard.yml         | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 96e5e6c..b4468de 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout repository'
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 36d25bb..b5ea64b 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.1
 
       # # Install the cosign tool except on PR
       # # https://github.com/sigstore/cosign-installer
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 49774f1..44df955 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Setup .NET
       uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602 # v5.0.1
       with:
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 67339de..8f66dfd 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Generate SBOM
         run: docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -t ghcr.io/cyclonedx/cdxgen -r /app -o /tmp/bom.json
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f2e4aea..0d586b6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 

From 26b1564f96bf1d27e5642d6cc840b2ef148e0de4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:39:01 +0100
Subject: [PATCH 22/28] Bump docker/setup-buildx-action from 3.0.0 to 3.11.1
 (#38)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.0.0 to 3.11.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/f95db51fddba0c2d1ec667646a06c2ce06100226...e468171a9de216ec08956ac3ada2f0791b6bd435)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index b5ea64b..2cfaf67 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -49,7 +49,7 @@ jobs:
       # multi-platform images and export cache
       # https://github.com/docker/setup-buildx-action
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action

From ed3a28389ad48dade7dee847df5fe7117c4b87ea Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Fri, 5 Dec 2025 14:45:06 +0100
Subject: [PATCH 23/28] Update docker-publish.yml

---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 2cfaf67..008a4e8 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       # # Install the cosign tool except on PR
       # # https://github.com/sigstore/cosign-installer

From ce397e4569fee3183466f164adcaf33ced110b5d Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 8 Dec 2025 11:19:59 +0100
Subject: [PATCH 24/28] Update docker-publish.yml (#39)

* Update docker-publish.yml

* Update docker-publish.yml
---
 .github/workflows/docker-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 008a4e8..e6277aa 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -75,7 +75,7 @@ jobs:
             type=semver,pattern={{version}}
             type=ref,event=branch
             type=ref,event=pr
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v1.0.')}}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, format('refs/tags/{0}', vars.VERSION_PATTERN))}}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action

From 371a32b5641fb63c2e7453fb61f8545e01395346 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 8 Dec 2025 11:34:16 +0100
Subject: [PATCH 25/28] Update docker-publish.yml

---
 .github/workflows/docker-publish.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index e6277aa..3c82b8e 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -14,7 +14,10 @@ on:
     tags: [ 'v*.*.*' ]
   pull_request:
     branches: [ "main", "release-*" ]
-
+    
+permissions:
+  contents: read
+  
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io

From c61829756ede1a5e015b9b1189171ff46a3425b1 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 8 Dec 2025 11:56:34 +0100
Subject: [PATCH 26/28] Update sbom.yml

---
 .github/workflows/sbom.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 8f66dfd..d5fc880 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -6,11 +6,13 @@ on:
     tags: [ 'v*.*.*' ]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   generate-sbom:
-
+    permissions:
+      contents: write
+      
     runs-on: ubuntu-latest
 
     steps:

From 51edbcf0d2b444b52a27d1f175bcf45b1fa4920e Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 8 Dec 2025 14:15:08 +0100
Subject: [PATCH 27/28] Update dotnet.yml

---
 .github/workflows/dotnet.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 44df955..3cdcf74 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -27,7 +27,7 @@ jobs:
       run: dotnet restore --locked-mode
       working-directory: source
     - name: Build
-      run: dotnet build --no-restore
+      run: dotnet build --no-restore --configuration Release ../source/AAS.TwinEngine.DataEngine.sln
       working-directory: source
     # - name: Test
     #   run: dotnet test --no-build --verbosity normal

From 77a354b19b0d38cba3c1e91df0e651a6431102f7 Mon Sep 17 00:00:00 2001
From: mm-psy <147830298+mm-psy@users.noreply.github.com>
Date: Mon, 8 Dec 2025 14:19:58 +0100
Subject: [PATCH 28/28] Update dotnet.yml

---
 .github/workflows/dotnet.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 3cdcf74..0860f29 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -29,6 +29,11 @@ jobs:
     - name: Build
       run: dotnet build --no-restore --configuration Release ../source/AAS.TwinEngine.DataEngine.sln
       working-directory: source
-    # - name: Test
-    #   run: dotnet test --no-build --verbosity normal
-    #   working-directory: source
+    - name: Run tests with code coverage
+      run: |
+        dotnet test ../source/AAS.TwinEngine.DataEngine.UnitTests/AAS.TwinEngine.DataEngine.UnitTests.csproj \
+          --configuration Release \
+          --settings ../source/coverlet.runsettings \
+          --collect:"XPlat Code Coverage" \
+          -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=cobertura
+      working-directory: source