deps: Bump NSubstitute from 6.1.0 to 6.2.0 #64
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| - cron: "17 4 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-audit: | |
| name: dependency-audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up .NET 10 | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| # Read the exact SDK from global.json. The AOT toolchain packages (ILLink/ILCompiler) are | |
| # versioned by the SDK's runtime and land in packages.lock.json, so a floating SDK breaks | |
| # --locked-mode restores with NU1004 without a single source change. | |
| global-json-file: global.json | |
| - name: Verify .NET 10 SDK selection | |
| shell: bash | |
| run: | | |
| pinned_version="$(jq -r '.sdk.version' global.json)" | |
| selected_version="$(dotnet --version)" | |
| # global.json pins an exact SDK because the AOT toolchain packages it injects are recorded in | |
| # packages.lock.json; any other SDK would fail the locked restore below with NU1004. | |
| if [[ "${selected_version}" != "${pinned_version}" ]]; then | |
| echo "global.json pins SDK ${pinned_version}, but dotnet selected ${selected_version}." | |
| dotnet --info | |
| exit 1 | |
| fi | |
| - name: Audit direct and transitive NuGet dependencies | |
| run: >- | |
| dotnet restore SolSharp.sln | |
| --locked-mode | |
| -p:NuGetAudit=true | |
| -p:NuGetAuditMode=all | |
| -p:NuGetAuditLevel=low | |
| -warnaserror | |
| # Benchmarks are intentionally kept outside SolSharp.sln, so audit their graph explicitly. | |
| - name: Audit benchmark dependencies | |
| run: >- | |
| dotnet restore benchmarks/SolSharp.Benchmarks/SolSharp.Benchmarks.csproj | |
| --locked-mode | |
| -p:NuGetAudit=true | |
| -p:NuGetAuditMode=all | |
| -p:NuGetAuditLevel=low | |
| -warnaserror | |
| dependency-review: | |
| name: dependency-review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: low |