Serve the site API from ASP.NET Core 10

The language website ran a Spring Boot application on JVM 25 for two
endpoints, and it was the only JVM on the server: a quarter of a
gigabyte of resident memory for /api/v1/site and /health. The server
already runs ASP.NET Core 10 for Progmaweb.

The API is now Progmasoft.Tala.Website.Api, a minimal ASP.NET Core 10
application under the namespace Progmasoft.Tala.Website. It answers as
before: /api/v1/site returns the site's own state as the same JSON,
POST is not allowed there, /health answers with an empty 200, and every
other path is 404. It listens on 127.0.0.1, port 5086 unless PORT says
otherwise, as the Spring process did, so Nginx is unchanged.

- Progmasoft.Tala.Website.slnx, Directory.Build.props and global.json
  set up the solution with warnings as errors, documentation comments
  required and NuGet lock files.
- Progmasoft.Tala.Website.Api.Tests runs the endpoints in an in-memory
  host with xUnit v3 on Microsoft.Testing.Platform.
- ops/systemd/tala-site-api.service runs the published DLL on the shared
  runtime from /srv/xsharp/website/current/site-api, with the hardening
  of the unit it replaces.
- CI builds, tests, publishes and reports coverage with dotnet; CodeQL
  analyzes C# instead of Kotlin; Renovate watches NuGet instead of
  Gradle.

2 files changed, 22 insertions, 27 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70631c6..e1be3db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,22 +54,21 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
-          distribution: temurin
-          java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-        with:
-          gradle-version: "9.6.0"
-          cache-provider: basic
-      # dokkaGenerate is the documentation gate: an undocumented public
-      # declaration or a broken reference fails the build.
-      - run: gradle test jacocoTestReport bootJar dokkaGenerate --no-daemon
-        working-directory: backend
+          dotnet-version: 10.0.x
+          cache: true
+          cache-dependency-path: "**/packages.lock.json"
+      # The build is the documentation gate: GenerateDocumentationFile with
+      # warnings as errors fails on a public declaration without its comment.
+      - run: dotnet restore Progmasoft.Tala.Website.slnx --locked-mode
+      - run: dotnet build Progmasoft.Tala.Website.slnx --configuration Release --no-restore
+      - run: dotnet test --project backend/Progmasoft.Tala.Website.Api.Tests/Progmasoft.Tala.Website.Api.Tests.csproj --configuration Release --no-build --coverlet --coverlet-output-format cobertura --results-directory TestResults
+      - run: dotnet publish backend/Progmasoft.Tala.Website.Api/Progmasoft.Tala.Website.Api.csproj --configuration Release --no-restore --output publish
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: website-backend-coverage
-          path: backend/build/reports/jacoco/test/jacocoTestReport.xml
+          path: TestResults/coverage.cobertura.xml
           if-no-files-found: error
           retention-days: 1
 
@@ -105,7 +104,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      # Keep OIDC-capable jobs isolated from Gradle build scripts.
+      # Keep OIDC-capable jobs isolated from the backend build.
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: website-backend-coverage
@@ -113,7 +112,7 @@ jobs:
       - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           use_oidc: true
-          files: coverage/backend/jacocoTestReport.xml
+          files: coverage/backend/coverage.cobertura.xml
           flags: website-backend
           fail_ci_if_error: true
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c5dde81..b565115 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,31 +25,27 @@ jobs:
             build_mode: none
           - language: javascript-typescript
             build_mode: none
-          - language: java-kotlin
+          - language: csharp
             build_mode: manual
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
-        if: matrix.language == 'java-kotlin'
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+        if: matrix.language == 'csharp'
         with:
-          distribution: temurin
-          java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-        if: matrix.language == 'java-kotlin'
-        with:
-          gradle-version: "9.6.0"
+          dotnet-version: 10.0.x
       - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
           config-file: ./.github/codeql/codeql-config.yml
           queries: security-extended
-      - name: Build Kotlin backend for extraction
-        if: matrix.language == 'java-kotlin'
-        run: gradle classes --no-daemon
-        working-directory: backend
+      - name: Build the backend for extraction
+        if: matrix.language == 'csharp'
+        run: |
+          dotnet restore Progmasoft.Tala.Website.slnx --locked-mode
+          dotnet build Progmasoft.Tala.Website.slnx --configuration Release --no-restore
       - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           category: /language:${{ matrix.language }}