Bump Microsoft.Extensions.Configuration.Binder and Microsoft.Extensions.Options.ConfigurationExtensions #36
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # workflow bump: force refresh after removing setup-trivy | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ───────────────────────── Backend (.NET 10) ───────────────────────── | |
| backend: | |
| name: backend (build + test) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup .NET 10 | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: '10.0.x' | |
| - name: Restore | |
| run: dotnet restore DocAnalytics.slnx | |
| - name: Build | |
| run: dotnet build DocAnalytics.slnx --no-restore --configuration Release | |
| - name: Test (correctness projects) | |
| run: | | |
| dotnet test DocAnalytics.Domain.Tests/DocAnalytics.Domain.Tests.csproj --no-build --configuration Release | |
| dotnet test DocAnalytics.Data.Tests/DocAnalytics.Data.Tests.csproj --no-build --configuration Release | |
| dotnet test DocAnalytics.Service.Tests/DocAnalytics.Service.Tests.csproj --no-build --configuration Release | |
| dotnet test DocAnalytics.Api.Tests/DocAnalytics.Api.Tests.csproj --no-build --configuration Release | |
| # ──────────────────────── Frontend (Angular 22) ──────────────────────── | |
| frontend: | |
| name: frontend (build + test) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: docanalytics-web | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node 22 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: docanalytics-web/package-lock.json | |
| - name: Install (clean) | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Test (Vitest, single run) | |
| run: npx ng test --watch=false | |
| # ──────────────────────── DevSecOps (scans) ──────────────────────── | |
| devsecops: | |
| name: devsecops (secrets + deps + image scan) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Gitleaks (working tree only, via Docker) | |
| run: | | |
| docker run --rm \ | |
| -v "${{ github.workspace }}:/repo" \ | |
| ghcr.io/gitleaks/gitleaks:v8.24.3 \ | |
| detect \ | |
| --source=/repo \ | |
| --no-git \ | |
| --redact \ | |
| --config=/repo/.gitleaks.toml \ | |
| --exit-code 1 | |
| # Backend dependency scan (.NET) | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: '10.0.x' | |
| - name: dotnet list package --vulnerable (fail on any) | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| dotnet list DocAnalytics.slnx package --vulnerable --include-transitive | tee dotnet-vuln.txt | |
| if grep -qi "has the following vulnerable packages" dotnet-vuln.txt; then | |
| echo "❌ Vulnerable NuGet packages detected" | |
| exit 1 | |
| fi | |
| # Frontend dependency scan (npm) | |
| - name: Setup Node 22 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: npm audit (HIGH+) | |
| working-directory: docanalytics-web | |
| run: | | |
| npm ci | |
| npm audit --audit-level=high | |
| # Container image scan (Trivy) — run via Docker (no setup-trivy dependency) | |
| - name: Build API image | |
| run: docker build -t docanalytics-api:${{ github.sha }} -f DocAnalytics.Api/Dockerfile . | |
| - name: Trivy scan (API image) | |
| run: | | |
| docker run --rm \ | |
| -v /var/run/docker.sock:/var/run/docker.sock \ | |
| aquasec/trivy:0.54.1 \ | |
| image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \ | |
| docanalytics-api:${{ github.sha }} | |
| - name: Build Web image | |
| run: docker build -t docanalytics-web:${{ github.sha }} -f docanalytics-web/Dockerfile docanalytics-web | |
| - name: Trivy scan (Web image) | |
| run: | | |
| docker run --rm \ | |
| -v /var/run/docker.sock:/var/run/docker.sock \ | |
| aquasec/trivy:0.54.1 \ | |
| image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \ | |
| docanalytics-web:${{ github.sha }} |