Skip to content

Commit c5cee24

Browse files
committed
Update vulnerability check in dotnet-core workflow
Replaced vulnerable NuGet packages check with a custom command to list vulnerable packages and log the output.
1 parent 5973bec commit c5cee24

1 file changed

Lines changed: 5 additions & 2 deletions

File tree

.github/workflows/dotnet-core.yml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,11 @@ jobs:
3636
run: dotnet tool install -g nbgv
3737
- name: Set Version
3838
run: nbgv cloud
39-
- name: Check vulnerable NuGet packages
40-
uses: elmahio/github-check-vulnerable-nuget-packages-action@v2
39+
- name: Checking for external vulnerabilites
40+
run: |
41+
dotnet list package --vulnerable --include-transitive 2>&1 | tee vuln.log
42+
echo "Analyze dotnet list package..."
43+
! grep -q -i "has the following vulnerable packages" vuln.log
4144
- name: Build
4245
run: dotnet build --configuration Release --no-restore
4346

0 commit comments

Comments
 (0)