Security and package checks #390
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) Omar Boukli-Hacene. All rights reserved. | |
| # Distributed under an MIT-style license that can be | |
| # found in the LICENSE file. | |
| # SPDX-License-Identifier: MIT | |
| name: Security and package checks | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| paths: | |
| - src/** | |
| - test/** | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - src/** | |
| - test/** | |
| schedule: | |
| - cron: 10 22 * * 3 | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| lint: | |
| name: Security scan | |
| runs-on: ubuntu-latest | |
| env: | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Install scanner | |
| run: >- | |
| dotnet tool install security-scan | |
| --global | |
| - name: Run dotnet security-scan | |
| run: >- | |
| security-scan Aktabook.sln | |
| nuget: | |
| name: NuGet security check | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Restores dependencies | |
| env: | |
| DOTNET_NUGET_SIGNATURE_VERIFICATION: true | |
| run: dotnet restore --locked-mode | |
| - name: Run NuGet security check | |
| run: |- | |
| dotnet list package --vulnerable 2>&1 | tee packages.txt | |
| if grep --quiet --ignore-case "has the following vulnerable packages" packages.txt; then | |
| echo "Found NuGet security advisory." | |
| exit 1 | |
| else | |
| echo "Success. No NuGet security advisory found." | |
| fi | |
| - name: Run NuGet security check for transitive packages | |
| continue-on-error: true | |
| run: |- | |
| dotnet list package --vulnerable --include-transitive 2>&1 | tee transitive.txt | |
| if grep --quiet --ignore-case "has the following vulnerable packages" transitive.txt; then | |
| echo "Found NuGet security advisory." | |
| exit 1 | |
| else | |
| echo "Success. No NuGet security advisory found." | |
| fi |