cve-scanning.yml

name: CVE Scanning

on:
  push:
  workflow_dispatch:

jobs:
  dotnet-modules-scan:
    name: dotnet-scan
    runs-on: ubuntu-latest
    continue-on-error: false

    steps:
      - name: Checkout
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      - name: Setup .NET
        uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
        with:
          dotnet-version: 8.x
      - name: Build project with dotnet
        run: dotnet build --configuration Release
        working-directory: 'src'
      - name: List vulnerable libraries
        run: dotnet list package --vulnerable --include-transitive
        working-directory: 'src'
      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@3102a65fd5f36d0000297576acc56a475b0de98d
        id: Depcheck
        with:
          project: '.'
          path: '.'
          format: 'HTML'
          out: 'reports'
          args: >
            --suppression .cve/allow-list.xml
            --failOnCVSS 7
            --enableRetired
      - name: Upload Test results
        if: ${{ always() }}
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: Depcheck report
          path: ${{ github.workspace }}/reports