ersatztv/.gitea/workflows/dependency-scan.yml

name: Dependency vulnerability scan

# Scheduled NuGet advisory scan — a Gitea-native stand-in for Dependabot (ersatztv#14).
# Surfaces vulnerable direct/transitive packages on a schedule instead of only when a
# `dotnet restore` happens to break. This is DETECTION ONLY; automated update PRs are
# tracked separately (self-hosted Renovate — server-management#484).
#
# Scans the FULL solution (including the Scanner project, which the image build strips)
# so coverage isn't narrower than the code we ship.
#
# NOTE: Gitea runs `schedule` triggers only from the default branch (main); the workflow
# must be merged to main before the cron registers. Use `workflow_dispatch` to run on demand.

on:
  workflow_dispatch:
  schedule:
    # Mondays 06:00 UTC
    - cron: '0 6 * * 1'

# Independent of the build pipeline's concurrency group; a stale scan can be cancelled.
concurrency:
  group: ersatztv-depscan
  cancel-in-progress: true

# No persistent MSBuild/Roslyn servers (ersatztv#406). Workflow `env:` does not cross workflow
# files, so docker-build.yml's copy of these does not apply here and this has to be repeated.
# Smaller stakes than the build pipeline — `dotnet restore` + `dotnet list` are MSBuild-driven and
# never invoke csc, so this is lingering worker nodes (hundreds of MiB), not a 7.8 GB VBCSCompiler.
# Worth setting anyway: this runs unattended on a Monday 06:00 cron against the same host that runs
# prod media, and node reuse keeps workers alive ~15 min after the job.
env:
  UseSharedCompilation: "false"
  DOTNET_CLI_USE_MSBUILD_SERVER: "0"
  MSBUILDDISABLENODEREUSE: "1"

# Explicit token scope (ersatztv#748) so the owner-level Actions default can move to Restricted
# (server-management#714). Declaring `permissions:` is EXHAUSTIVE, not additive: a unit omitted here
# is NOT granted, and that holds at any owner default — it is not conditional on Restricted being on.
# Only `review-verdict.yml` needs write; it declares that at the job and says why there. Full
# rationale and the per-workflow credential audit: docs/ci-cd.md -> "Workflow token scope".
# Holds no registry credential and reads nothing from the Gitea API; the injected GITEA_TOKEN serves
# only its one `actions/checkout`.
permissions:
  code: read

jobs:
  scan:
    name: NuGet vulnerable packages
    runs-on: ubuntu-latest
    env:
      CI_JOB_ROLE: guard
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore ErsatzTV.sln

      - name: Scan for vulnerable packages (direct + transitive)
        # bash + `set -euo pipefail` so a failing `dotnet list` (e.g. the audit source
        # is unreachable while restore served from cache) fails the job instead of
        # falling through to a false "no vulnerable packages" green.
        shell: bash
        run: |
          set -euo pipefail
          echo "Running: dotnet list package --vulnerable --include-transitive"
          dotnet list ErsatzTV.sln package --vulnerable --include-transitive 2>&1 | tee depscan.txt
          # `dotnet list package --vulnerable` exits 0 even when advisories exist, so detect
          # findings by the report marker and fail the run if any are present. Expect this to
          # be RED until ersatztv#8 clears the current NCalcSync / SQLitePCLRaw advisories;
          # after that, a red run means a NEW advisory has appeared.
          if grep -q "has the following vulnerable packages" depscan.txt; then
            echo "::error::Vulnerable NuGet packages detected — see report above (tracked: ersatztv#8)."
            exit 1
          fi
          echo "No vulnerable packages found."