[.NET] Fail CI on known-vulnerable NuGet packages

.github/workflows/ci-dotnet-vulnerable-packages.yml

@@ -0,0 +1,69 @@
+# Copyright (c) Microsoft. All rights reserved.
+# Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+# Fails when any .NET project references a NuGet package (direct or transitive) with a known
+# vulnerability. Daily as well, because new advisories apply to unchanged code.
+name: ci-dotnet-vulnerable-packages
+
+on:
+  push:
+    branches: [ main ]
+  # No workflow-level `paths:` filter: a workflow that never triggers reports no check, which
+  # would block a required check. The `changes` job below skips work instead.
+  pull_request:
+  schedule:
+    - cron: '0 13 * * *'  # Daily, 13:00 UTC.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  DOTNET_NOLOGO: '1'
+  DOTNET_CLI_TELEMETRY_OPTOUT: '1'
+
+jobs:
+  changes:
+    name: detect changes
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read  # dorny/paths-filter lists PR files through the API.
+    outputs:
+      dotnet: ${{ steps.filter.outputs.dotnet == 'true' || steps.filter.outputs.workflow == 'true' }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
+        id: filter
+        with:
+          predicate-quantifier: every
+          filters: |
+            dotnet:
+              - 'dotnet/**'
+              - '!dotnet/**/*.md'
+            workflow:
+              - '.github/workflows/ci-dotnet-vulnerable-packages.yml'
+
+  vulnerable-packages:
+    name: vulnerable packages
+    needs: changes
+    if: needs.changes.outputs.dotnet == 'true' || github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Check
+        run: bash dotnet/eng/check-vulnerable-packages.sh

dotnet/eng/check-vulnerable-packages.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (c) Microsoft. All rights reserved.
+# Licensed under the MIT license. See LICENSE file in the project root for full license information.
+#
+# Fails if any project under dotnet/ references a NuGet package, direct or transitive, with a
+# known vulnerability (NuGet advisory data). Every .csproj is checked, including projects that
+# Project.slnx does not list.
+#
+#   dotnet/eng/check-vulnerable-packages.sh
+
+set -euo pipefail
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+command -v jq >/dev/null || { echo "jq not found" 1>&2; exit 1; }
+
+mapfile -t projects < <(find "${root_dir}" -name '*.csproj' -not -path '*/obj/*' -not -path '*/bin/*' | sort)
+[ "${#projects[@]}" -gt 0 ] || { echo "no projects under ${root_dir}" 1>&2; exit 1; }
+
+found=0
+for project in "${projects[@]}"; do
+    dotnet restore "${project}" --verbosity quiet
+    report="$(dotnet list "${project}" package --vulnerable --include-transitive --format json)"
+    hits="$(jq -r '
+        .projects[]? | .frameworks[]? | ((.topLevelPackages // []) + (.transitivePackages // []))[]
+        | select((.vulnerabilities // []) | length > 0)
+        | . as $p | .vulnerabilities[]
+        | "\($p.id) \($p.resolvedVersion): \(.severity) \(.advisoryurl)"' <<<"${report}" | sort -u)"
+    if [ -n "${hits}" ]; then
+        echo "${project#"${root_dir}/"}:"
+        sed 's/^/  /' <<<"${hits}"
+        found=1
+    fi
+done
+
+if [ "${found}" -ne 0 ]; then
+    echo "Vulnerable packages found. Update them (a transitive one can be pinned with a direct PackageReference)."
+    exit 1
+fi
+echo "No known vulnerable packages in ${#projects[@]} projects."