Add support for PackageGuard and use it in the pipeline - #658
Closed
dennisdoomen wants to merge 3 commits into
Closed
Add support for PackageGuard and use it in the pipeline#658dennisdoomen wants to merge 3 commits into
dennisdoomen wants to merge 3 commits into
Conversation
Adds a Fallout CLI tool wrapper for PackageGuard's `analyze` command, based on its AnalyzeCommandSettings.cs (https://github.com/dennisdoomen/packageguard/blob/main/Src/PackageGuard/AnalyzeCommandSettings.cs). - Add src/Fallout.Common/Tools/PackageGuard/PackageGuard.json, covering all 18 analyze settings plus NpmPackageManager and SbomFormat enumerations for the properties restricted to a fixed set of values. - Regenerate PackageGuard.Generated.cs via ./build.ps1 GenerateTools. - Add a row to the supported-tools table in docs/website/03-common/08-cli-tools.md. - Add a TestPackageGuard smoke test to tests/Fallout.Common.Specs/SettingsSpecs.cs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
dennisdoomen
added
enhancement
Adds a PackageGuard target (build/Build.PackageGuard.cs) that scans the solution's dependencies, generates a CycloneDX SBOM, and writes an HTML + SARIF risk report. - Only runs on main, develop, release/*, or support/* — either directly (GitRepository.IsOn*Branch(), including a new IsOnSupportBranch() extension) or, for the tag-triggered release workflow where HEAD is detached, because that workflow's own validate-ref job already proved the tag is reachable from a production branch. - New dedicated "security-scan" workflow (generated via a third [GitHubActions] attribute in Build.CI.GitHubActions.cs) runs the scan on every push to those branches and uploads the SARIF risk report to GitHub code scanning via github/codeql-action/upload-sarif, using the IConfigureGitHubActions custom-step-injection hook. - publish-packages-release.yml now runs the PackageGuard target alongside Test + Pack and attaches the generated SBOM to the GitHub Release as an asset. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Alongside the SBOM, publish-github-releases now uploads output/packageguard/risk-report.html as a release asset when present — the human-readable counterpart of the SARIF report already sent to GitHub code scanning (security-scan.yml). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
dennisdoomen
changed the title
Collaborator
Author
|
Superseded by #659 — moved the branch to the upstream repo (Fallout-build/Fallout) instead of the fork, same commits/content. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Fallout CLI tool wrapper for PackageGuard's
analyzecommand, based onAnalyzeCommandSettings.cs, and wires it into the build pipeline as a compliance/SBOM scan.Tool wrapper
src/Fallout.Common/Tools/PackageGuard/PackageGuard.json— spec covering all 18analyzesettings, plusNpmPackageManagerandSbomFormatenumerations for the properties restricted to a fixed set of values.PackageGuard.Generated.cs— regenerated via./build.ps1 GenerateTools.docs/website/03-common/08-cli-tools.md.TestPackageGuardtotests/Fallout.Common.Specs/SettingsSpecs.cs.Build pipeline
PackageGuardtarget (build/Build.PackageGuard.cs) generates a CycloneDX SBOM and an HTML + SARIF risk report.main,develop,release/*, orsupport/*— viaGitRepository.IsOn*Branch()(including a newIsOnSupportBranch()extension), or, for the tag-triggered release workflow where HEAD is detached, because that workflow's ownvalidate-refjob already proved the tag is reachable from a production branch.security-scanworkflow (generated from a third[GitHubActions]attribute) runs the scan on every push to those branches and uploads the SARIF report to GitHub code scanning viagithub/codeql-action/upload-sarif.publish-packages-release.ymlnow runsPackageGuardalongsideTest+Packand attaches both the SBOM and the HTML risk report to the GitHub Release as assets.Purely additive — no breaking changes.
🤖 Generated with Claude Code