Part 3: clear the NU1903 warnings and put the checkpoints under CI

[jongalloway]

Four fixes to the Part 3 lab, all found in the 2026-07-27 end-to-end run. Part 3 is mid-morning, so these land on attendees early.

1. NU1903 warnings on the MEDI path

Reproduced by replaying Step 3.1 into a clean console app — four NU1903 high-severity warnings:

Package	Pulled in by
Microsoft.Bcl.Memory 9.0.4	transitively via Microsoft.ML.Tokenizers.Data.O200kBase
SQLitePCLRaw.lib.e_sqlite3 2.1.10	via Microsoft.SemanticKernel.Connectors.SqliteVec

Repo policy is zero warnings and every other target is clean, so an attendee finishing Step 3 saw warnings nobody else in the workshop does.

Note

The pin suggested in the issue does not work. #575 proposes Microsoft.Bcl.Memory --version 9.0.11, but GHSA-73j8-2gch-69rq lists >= 9.0.0, <= 9.0.13 as affected — 9.0.11 is inside that range and the warning survives. I confirmed this: pinning 9.0.11 leaves the build at 2 warnings.

Patched versions are 9.0.14 and 10.0.4. I pinned 10.0.10, which is above the 10.x fix and matches the version the rest of the repo already uses.

Verified from a clean console app following Step 3.1 verbatim, with the real medi-program.cs as Program.cs: 0 warnings, 0 errors.

2. The checkpoints were never compiled

checkpoints/manual-program.cs and medi-program.cs sit outside RagChatApp/ and nothing built them — that gap is how #567 and #568 reached the repo.

Adds checkpoints/verify/ with one compile-only project per checkpoint (they are both top-level-statement programs, so they cannot share a project) plus a Checkpoints.slnx so CI covers both in a single matrix entry.

Confirmed the coverage actually bites by introducing a deliberate typo into medi-program.cs and watching the build fail with CS0246.

The checkpoint .cs files themselves are untouched — they stay where the README links them.

3. RagChatApp.csproj was missing Microsoft.Extensions.Logging.Console

Part 2 Step 2 adds it, so an attendee arrives at Part 3 carrying it, but the snapshot did not list it. The snapshot now matches what "continue from your Part 2 app" actually produces.

4. "What's next" contradicted Step 3

It said the knowledge base "lives in memory, so it's rebuilt on every run and can't scale" — true of Step 2, but Step 3 persists to vectors.db via SqliteVectorStore. Rewritten to describe what Part 4 actually adds (web app, server-based vector store, background ingestion, citations) instead of implying Step 3 did not happen.

Verification

• All nine CI targets build with 0 warnings (the new Checkpoints.slnx is the ninth)
• Clean-room replay of Step 3.1 → 0 warnings
• Deliberate-typo test → checkpoint build fails as intended
• markdownlint clean

Fixes #575
Fixes #564

[Copilot]

Pull request overview

This PR improves the Part 3 “Add RAG” workshop experience by eliminating NU1903 vulnerability warnings on the MEDI/SqliteVec path and ensuring the Part 3 checkpoint reference implementations are compiled in CI (preventing future drift from going undetected).

Changes:

• Pins patched dependency versions in Part 3 Step 3.1 instructions to clear NU1903 warnings (Microsoft.Bcl.Memory and SQLitePCLRaw.bundle_e_sqlite3).
• Adds compile-only “checkpoint verification” projects + Checkpoints.slnx, and wires that into CI so both checkpoint programs are type-checked.
• Aligns the Part 3 snapshot and narrative with the attendee flow (adds Microsoft.Extensions.Logging.Console to RagChatApp.csproj, and updates “What’s next” to reflect persisted vectors.db).

Show a summary per file

File	Description
Part 03 - Add RAG/README.md	Adds explicit security pins to Step 3.1 and corrects the “What’s next” section to match Step 3 persistence behavior.
Part 03 - Add RAG/RagChatApp/RagChatApp.csproj	Adds Microsoft.Extensions.Logging.Console so the snapshot matches what attendees carry forward from Part 2.
Part 03 - Add RAG/checkpoints/verify/MediCheckpoint/MediCheckpoint.csproj	New compile-only project to type-check checkpoints/medi-program.cs with the same package set (including pins).
Part 03 - Add RAG/checkpoints/verify/ManualCheckpoint/ManualCheckpoint.csproj	New compile-only project to type-check checkpoints/manual-program.cs.
Part 03 - Add RAG/checkpoints/verify/Checkpoints.slnx	New solution wrapper to build both checkpoint verification projects in one CI entry.
.github/workflows/dotnet-build.yml	Expands path filters and adds a build matrix entry for Checkpoints.slnx so checkpoints are compiled in CI.
.github/copilot-instructions.md	Updates repo build target list/count and documents the new checkpoints/verify/ CI coverage.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Low