How to Integrate .NET Code Obfuscation into GitHub Actions CI/CD Pipelines

·1 views

Developers building .NET applications face a security risk because .NET compiles to Intermediate Language (IL), which can be decompiled back to near-original C# code almost instantly using tools like ILSpy. To address this, obfuscation tools such as Nebula.NET can be added as a step in GitHub Actions workflows, running after the dotnet publish command on the build server rather than on individual developer machines. This approach requires storing the obfuscator license as a GitHub secret and using a configuration file to specify which assemblies to protect and where to output the hardened binaries. Running obfuscation exclusively in CI ensures that developers retain clean, debuggable local builds while only the final release artifact is protected. Alternatively, Nebula.NET's MSBuild integration can gate obfuscation on an environment variable, triggering it automatically on the build agent without any changes to source code.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Three MCP Servers That Extend Claude Desktop With Files, GitHub, and Postgres

A developer has shared three Model Context Protocol (MCP) servers they actively use with Claude Desktop to streamline daily workflows. The filesystem server allows Claude to directly read project files, eliminating the need to manually copy and paste code into the chat. The GitHub server enables Claude to review pull requests, check issues, and browse repositories without leaving the conversation. A PostgreSQL server grants Claude direct database query access, useful for tasks like identifying user activity patterns. Each server can be installed via the mcp-hub CLI in roughly two minutes, though users are cautioned to restrict filesystem path access carefully to avoid unintended disk exposure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mainframe Migration Tools: What They Do Well and Where They Fall Short

Mainframe migration tools fall into four broad categories: discovery and analysis, rehosting and emulation, automated code translation, and data migration — and most real programmes require tools from at least three of them. Vendor demos of automated COBOL-to-Java conversion often look impressive, but are typically run on cleaner code than what organisations actually have in production. While automated translation reliably produces runnable code, it rarely produces maintainable code, and bridging that gap is where the majority of migration budgets are spent. Discovery and analysis tools are considered the most consistently valuable category, as no organisation typically has a full picture of a system built up over decades. Buyers are also advised to scrutinise vendor ownership before signing long-term agreements, as consolidation through acquisition is common in this market.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer admits mislabeling a build failure as 'unknown' to avoid a hard negative result

A developer building a check system that uses three result states — pass, fail, and unknown — incorrectly marked a detected dependency cycle as 'unknown' instead of 'fail', a mistake caught by a teammate. The author argues the 'unknown' state should only apply when a check cannot reach a conclusion, such as when an input file is missing or a human-produced record cannot be re-run. A completed graph traversal that confirms a cycle is a definitive negative answer, making it a clear failure. The error was compounded by the fact that the 'unknown' label felt principled and humble, while quietly removing a red flag from the build summary. The author's key takeaway is that if a check ran to completion and returned a negative result, it must be recorded as a failure — 'unknown' is for the absence of an answer, not for an answer that is inconvenient.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How ~900 Silent Catch Blocks Were Hiding Real Payment Failures in Frontend Code

A frontend engineer discovered that HTTP 200 responses from a payment BFF were masking real user-facing errors, including TypeErrors on payment buttons, across four separate frontend repositories. A static grep of the codebases revealed approximately 900 empty or swallowed catch blocks — none of which produced runtime telemetry. The engineer rejected default SDK configurations, opting instead for conservative sampling rates and mandatory domain tags to comply with Brazil's LGPD data privacy rules and avoid PII leakage to third-party vendors. Rather than replacing existing Grafana and APM tooling, the approach was designed to fill a specific gap: capturing client-side errors tied to release versions and user journeys. The resulting setup treats frontend observability as a revenue-gap problem, not a tooling exercise, with sampling rates and tagging contracts documented before any SDK was deployed to production.

0 comments Read more at DEV Community