Dependency Audit #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Audit | |
| # Check vulnerability advisories on a schedule | |
| # | |
| # Note: GitHub disables scheduled workflows after 60 days without repository | |
| # activity; re-enable from the Actions tab if that happens. | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| env: | |
| DOTNET_CLI_TELEMETRY_OPTOUT: 1 | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1 | |
| NUGET_XMLDOC_MODE: skip | |
| name: NuGet Vulnerability Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: 10.0.x | |
| - run: dotnet restore | |
| - name: Check for vulnerable packages | |
| run: | | |
| output=$(dotnet list package --vulnerable --include-transitive) | |
| echo "$output" | |
| if grep -q "has the following vulnerable packages" <<< "$output"; then | |
| echo "::error::Vulnerable packages found, see the log above. Reproduce locally with: dotnet list package --vulnerable --include-transitive" | |
| exit 1 | |
| fi |