Refs #14 (issue closed via the Task Completion Protocol once the main image build + smoke is verified green).
Central Package Management
Adds Directory.Packages.props (ManagePackageVersionsCentrally=true) and strips the Version= attribute from every <PackageReference> across the 14 solution projects + Directory.Build.targets.
No version changes. Survey found 154 PackageReference elements → 96 distinct packages with zero version conflicts (every package already pinned identically everywhere), so this is a pure relocation. Range/lock/prerelease syntaxes preserved exactly (MediatR [12.5.0], EF Core [9.0.12,10), Lucene.Net 4.8.0-beta00017, …).
Dockerfile:Directory.Packages.props is now copied into the image build before dotnet restore — without it the versionless csproj fail restore (NU1015). Verified by simulating the image's linux-x64 restore layer, plus a negative test reproducing the failure.
Scheduled vulnerability scan
New .gitea/workflows/dependency-scan.yml: weekly cron + workflow_dispatch, runs dotnet list package --vulnerable --include-transitive over the full solution and fails the run when advisories are present (the command exits 0 even with findings, so the marker line is parsed; bash -euo pipefail so a failing dotnet list can't false-green).
Separate workflow file (not a job in docker-build.yml) because it's cron-triggered and shouldn't share the build pipeline's triggers/concurrency.
Expected RED until #8 clears the current NCalcSync/SQLitePCLRaw advisories — after that, red = a new advisory.
PR runs the test job only; full image build + smoke runs on merge to main.
Refs #14 (issue closed via the Task Completion Protocol once the `main` image build + smoke is verified green).
## Central Package Management
- Adds `Directory.Packages.props` (`ManagePackageVersionsCentrally=true`) and strips the `Version=` attribute from every `<PackageReference>` across the 14 solution projects + `Directory.Build.targets`.
- **No version changes.** Survey found 154 PackageReference elements → **96 distinct packages with zero version conflicts** (every package already pinned identically everywhere), so this is a pure relocation. Range/lock/prerelease syntaxes preserved exactly (`MediatR [12.5.0]`, EF Core `[9.0.12,10)`, `Lucene.Net 4.8.0-beta00017`, …).
- **Dockerfile:** `Directory.Packages.props` is now copied into the image build before `dotnet restore` — without it the versionless csproj fail restore (`NU1015`). Verified by simulating the image's `linux-x64` restore layer, plus a negative test reproducing the failure.
## Scheduled vulnerability scan
- New `.gitea/workflows/dependency-scan.yml`: weekly cron + `workflow_dispatch`, runs `dotnet list package --vulnerable --include-transitive` over the **full** solution and fails the run when advisories are present (the command exits 0 even with findings, so the marker line is parsed; `bash -euo pipefail` so a failing `dotnet list` can't false-green).
- Separate workflow file (not a job in `docker-build.yml`) because it's cron-triggered and shouldn't share the build pipeline's triggers/concurrency.
- **Expected RED until #8** clears the current NCalcSync/SQLitePCLRaw advisories — after that, red = a new advisory.
## Out of scope / related
- Renovate (real Dependabot replacement, multi-repo, opens update PRs) filed as infra: **server-management#484**.
- `.mcp/` (gitignored vendored tool) gets a local-only CPM opt-out — not in this PR.
## Verification
- `dotnet restore` + `dotnet build -c Release` → 0 errors (only the expected #8 advisory warnings).
- Image restore-layer simulation under `linux-x64` → green; negative test (no manifest) → NU1015 as expected.
- Reproduced the CI `test`-job Scanner-strip path under CPM → 0 errors.
- Adversarial self-review of the full diff → **SHIP** (no version drift; one workflow nit fixed).
- PR `test` job (run #132) → **green**.
PR runs the `test` job only; full image build + smoke runs on merge to `main`.
Move all 154 PackageReference versions (96 distinct packages) out of the 14
project files into a single central Directory.Packages.props with
ManagePackageVersionsCentrally=true. No version changes — every package was
already pinned identically across projects (no conflicts detected), so this is a
pure relocation: updates become one-line and cross-project version drift is
structurally impossible.
Also copy Directory.Packages.props into the Docker image build before restore:
with CPM the csproj carry no versions, so the image's `dotnet restore` fails
without the central manifest (verified: NU1015 across every project).
Restore + Release build verified locally, plus a simulation of the image's
restore layer under linux-x64 (0 errors; only the pre-existing
NCalcSync/SQLitePCLRaw advisories remain, demoted to warnings, tracked in #8).
Part of #14.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A Gitea-native stand-in for Dependabot (#14): a weekly (cron) + workflow_dispatch
job running `dotnet list package --vulnerable --include-transitive` over the full
solution, failing the run when advisories are present (the command itself exits 0,
so the marker line is parsed). Detection only; automated update PRs are tracked in
server-management#484 (self-hosted Renovate).
Expect RED until #8 clears the current NCalcSync/SQLitePCLRaw advisories; after
that a red run signals a NEW advisory.
Part of #14.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
timothy
merged commit 2fa79edfdc into main2026-06-27 01:20:55 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Refs #14 (issue closed via the Task Completion Protocol once the
mainimage build + smoke is verified green).Central Package Management
Directory.Packages.props(ManagePackageVersionsCentrally=true) and strips theVersion=attribute from every<PackageReference>across the 14 solution projects +Directory.Build.targets.MediatR [12.5.0], EF Core[9.0.12,10),Lucene.Net 4.8.0-beta00017, …).Directory.Packages.propsis now copied into the image build beforedotnet restore— without it the versionless csproj fail restore (NU1015). Verified by simulating the image'slinux-x64restore layer, plus a negative test reproducing the failure.Scheduled vulnerability scan
.gitea/workflows/dependency-scan.yml: weekly cron +workflow_dispatch, runsdotnet list package --vulnerable --include-transitiveover the full solution and fails the run when advisories are present (the command exits 0 even with findings, so the marker line is parsed;bash -euo pipefailso a failingdotnet listcan't false-green).docker-build.yml) because it's cron-triggered and shouldn't share the build pipeline's triggers/concurrency.Out of scope / related
.mcp/(gitignored vendored tool) gets a local-only CPM opt-out — not in this PR.Verification
dotnet restore+dotnet build -c Release→ 0 errors (only the expected #8 advisory warnings).linux-x64→ green; negative test (no manifest) → NU1015 as expected.test-job Scanner-strip path under CPM → 0 errors.testjob (run #132) → green.PR runs the
testjob only; full image build + smoke runs on merge tomain.