timothy/ersatztv
1
0
Fork 0
Code Issues 57 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

build: Central Package Management + scheduled vulnerability scan (#14) #17

Merged
timothy merged 2 commits from foundations/14-central-package-management into main 2026-06-27 01:20:55 +02:00
Conversation 0 Commits 2 Files Changed 17
+320 -157
2 Commits
Author SHA1 Message Date
timothyandClaude Opus 4.8 2fa79edfdc ci: add scheduled NuGet vulnerability scan
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 2m7s
Details
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Details
Build ErsatzTV Image / Build & test (.NET) (push) Successful in 2m14s
Details
Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 5m16s
Details 
A Gitea-native stand-in for Dependabot (#14): a weekly (cron) + workflow_dispatch
job running `dotnet list package --vulnerable --include-transitive` over the full
solution, failing the run when advisories are present (the command itself exits 0,
so the marker line is parsed). Detection only; automated update PRs are tracked in
server-management#484 (self-hosted Renovate).

Expect RED until #8 clears the current NCalcSync/SQLitePCLRaw advisories; after
that a red run signals a NEW advisory.

Part of #14.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-27 01:16:05 +02:00
timothyandClaude Opus 4.8 77a28fcefc build: adopt Central Package Management (Directory.Packages.props) 
Move all 154 PackageReference versions (96 distinct packages) out of the 14
project files into a single central Directory.Packages.props with
ManagePackageVersionsCentrally=true. No version changes — every package was
already pinned identically across projects (no conflicts detected), so this is a
pure relocation: updates become one-line and cross-project version drift is
structurally impossible.

Also copy Directory.Packages.props into the Docker image build before restore:
with CPM the csproj carry no versions, so the image's `dotnet restore` fails
without the central manifest (verified: NU1015 across every project).

Restore + Release build verified locally, plus a simulation of the image's
restore layer under linux-x64 (0 errors; only the pre-existing
NCalcSync/SQLitePCLRaw advisories remain, demoted to warnings, tracked in #8).

Part of #14.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-27 01:07:52 +02:00