ci: fail the nightly vulnerable-packages scan when vulnerabilities are found

[jamescrosswell]

Closes #5275

#skip-changelog

Summary

The List vulnerable packages workflow has never been able to fail. dotnet package list doesn't set an exit code on detection, and the grep that was meant to compensate has been commented out since #2814 — which was closed as completed on 2025-11-26, so the original blocker is gone. Today the job prints its findings into logs nobody reads and always exits 0.

This enables the check, and drops the pull_request trigger so it runs on the nightly schedule (and workflow_dispatch) only.

Why not run the gate on PRs

--vulnerable consults live advisory data rather than anything in the diff. Leaving it on pull_request means a GHSA published overnight against one of our transitive dependencies turns every open PR red until the dependency is updated — halting unrelated work over what is routine maintenance, not a defect in the PR.

The tradeoff is that a PR which introduces a vulnerable dependency is caught by the next nightly rather than on the PR itself. That seems like the right trade given the alternative is a repo-wide stop-the-world on someone else's advisory.

I checked both repo rulesets (Default branch, Default production ruleset [don't modify]) — neither has a required_status_checks rule, and classic branch protection isn't configured, so removing the trigger won't leave PRs waiting on a check that no longer reports.

Heads-up: the first nightly after this merges will be red

I dispatched this workflow against the branch to check end-to-end: run 33036863576 fails at the List vulnerable packages step with exit code 1, as intended. 16 projects currently report vulnerable transitive packages, including four shipped ones:

Shipped package	Vulnerable transitive
Sentry.Hangfire	Newtonsoft.Json 5.0.1 / 11.0.1 — High (GHSA-5crp-9r3c-p9vr)
Sentry.Log4Net	log4net 2.0.12 — Moderate (GHSA-4f7c-pmjv-c25w)
Sentry.OpenTelemetry	OpenTelemetry.Api 1.6.0 — Moderate (GHSA-g94r-2vxg-569j)
Sentry.OpenTelemetry.Exporter	OpenTelemetry.Api 1.10.0, OpenTelemetry.Exporter.OpenTelemetryProtocol 1.10.0 — Moderate

The rest are samples and tests (plus SQLitePCLRaw.lib.e_sqlite3 — High — in Sentry.DiagnosticSource.Tests).

These are all minimum-version floors inherited from our direct dependencies, not versions we picked. Clearing them means adding explicit references that raise the floor, which for the four shipped packages raises our published minimums — consistent with the Breaking Change / Next Major labels already on #5275.

So this PR makes the signal real but does not clear the backlog. Worth deciding before merge whether we'd rather land the floor bumps first so the nightly goes green immediately, or land this now and accept a red nightly while they're worked through. Happy to do either.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.73%. Comparing base (5cd6ad6) to head (f0fb941).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5513      +/-   ##
==========================================
- Coverage   74.74%   74.73%   -0.02%     
==========================================
  Files         513      513              
  Lines       18829    18829              
  Branches     3682     3682              
==========================================
- Hits        14074    14071       -3     
- Misses       3875     3877       +2     
- Partials      880      881       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.