timothyandClaude Opus 4.8
2fa79edfdc
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 2m7s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
Build ErsatzTV Image / Build & test (.NET) (push) Successful in 2m14s
Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 5m16s
A Gitea-native stand-in for Dependabot (#14): a weekly (cron) + workflow_dispatch job running `dotnet list package --vulnerable --include-transitive` over the full solution, failing the run when advisories are present (the command itself exits 0, so the marker line is parsed). Detection only; automated update PRs are tracked in server-management#484 (self-hosted Renovate). Expect RED until #8 clears the current NCalcSync/SQLitePCLRaw advisories; after that a red run signals a NEW advisory. Part of #14. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.4 KiB
YAML
59 lines
2.4 KiB
YAML
name: Dependency vulnerability scan
|
|
|
|
# Scheduled NuGet advisory scan — a Gitea-native stand-in for Dependabot (ersatztv#14).
|
|
# Surfaces vulnerable direct/transitive packages on a schedule instead of only when a
|
|
# `dotnet restore` happens to break. This is DETECTION ONLY; automated update PRs are
|
|
# tracked separately (self-hosted Renovate — server-management#484).
|
|
#
|
|
# Scans the FULL solution (including the Scanner project, which the image build strips)
|
|
# so coverage isn't narrower than the code we ship.
|
|
#
|
|
# NOTE: Gitea runs `schedule` triggers only from the default branch (main); the workflow
|
|
# must be merged to main before the cron registers. Use `workflow_dispatch` to run on demand.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
# Mondays 06:00 UTC
|
|
- cron: '0 6 * * 1'
|
|
|
|
# Independent of the build pipeline's concurrency group; a stale scan can be cancelled.
|
|
concurrency:
|
|
group: ersatztv-depscan
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
scan:
|
|
name: NuGet vulnerable packages
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Restore
|
|
run: dotnet restore ErsatzTV.sln
|
|
|
|
- name: Scan for vulnerable packages (direct + transitive)
|
|
# bash + `set -euo pipefail` so a failing `dotnet list` (e.g. the audit source
|
|
# is unreachable while restore served from cache) fails the job instead of
|
|
# falling through to a false "no vulnerable packages" green.
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
echo "Running: dotnet list package --vulnerable --include-transitive"
|
|
dotnet list ErsatzTV.sln package --vulnerable --include-transitive 2>&1 | tee depscan.txt
|
|
# `dotnet list package --vulnerable` exits 0 even when advisories exist, so detect
|
|
# findings by the report marker and fail the run if any are present. Expect this to
|
|
# be RED until ersatztv#8 clears the current NCalcSync / SQLitePCLRaw advisories;
|
|
# after that, a red run means a NEW advisory has appeared.
|
|
if grep -q "has the following vulnerable packages" depscan.txt; then
|
|
echo "::error::Vulnerable NuGet packages detected — see report above (tracked: ersatztv#8)."
|
|
exit 1
|
|
fi
|
|
echo "No vulnerable packages found."
|