dotnet-security-scan.yml

# Copyright (c) Omar Boukli-Hacene. All rights reserved.
# Distributed under an MIT-style license that can be
# found in the LICENSE file.

# SPDX-License-Identifier: MIT

name: Security and package checks

on:
  pull_request:
    branches:
      - main
    paths:
      - src/**
      - test/**
  push:
    branches:
      - main
    paths:
      - src/**
      - test/**
  schedule:
    - cron: 10 22 * * 3
  workflow_dispatch:

permissions: {}

jobs:
  lint:
    name: Security scan
    runs-on: ubuntu-latest

    env:
      DOTNET_CLI_TELEMETRY_OPTOUT: true

    permissions:
      contents: read

    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          cache: true
          cache-dependency-path: |-
            src/**/packages.lock.json
            test/**/packages.lock.json
          global-json-file: global.json

      - name: Install scanner
        run: >-
          dotnet tool install security-scan
          --global

      - name: Run dotnet security-scan
        run: >-
          security-scan Aktabook.sln

  nuget:
    name: NuGet security check
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Set up .NET SDK
        uses: actions/setup-dotnet@v4
        with:
          cache: true
          cache-dependency-path: |-
            src/**/packages.lock.json
            test/**/packages.lock.json
          global-json-file: global.json

      - name: Restores dependencies
        env:
          DOTNET_NUGET_SIGNATURE_VERIFICATION: true
        run: dotnet restore --locked-mode

      - name: Run NuGet security check
        run: |-
          dotnet list package --vulnerable 2>&1 | tee packages.txt
          if grep --quiet --ignore-case "has the following vulnerable packages" packages.txt; then
            echo "Found NuGet security advisory."
            exit 1
          else
            echo "Success. No NuGet security advisory found."
          fi

      - name: Run NuGet security check for transitive packages
        continue-on-error: true
        run: |-
          dotnet list package --vulnerable --include-transitive 2>&1 | tee transitive.txt
          if grep --quiet --ignore-case "has the following vulnerable packages" transitive.txt; then
            echo "Found NuGet security advisory."
            exit 1
          else
            echo "Success. No NuGet security advisory found."
          fi