From f0fb94179988ce15e7033d0efd4747f7daa0c7e1 Mon Sep 17 00:00:00 2001 From: James Crosswell Date: Thu, 27 Aug 2026 15:35:27 +1200 Subject: [PATCH] ci: fail the nightly vulnerable-packages scan when vulnerabilities are found The `List vulnerable packages` workflow has never been able to fail: `dotnet package list` doesn't set an exit code on detection, and the grep that was meant to compensate has been commented out since #2814 (closed 2025-11-26). The job prints its findings into logs nobody reads and always exits 0. Enable the check, and drop the `pull_request` trigger so it runs on the nightly schedule only. `--vulnerable` consults live advisory data, so keeping it on PRs means a GHSA published overnight can turn every open PR red and halt unrelated work. Co-Authored-By: Claude Opus 5 --- .github/workflows/vulnerabilities.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/vulnerabilities.yml b/.github/workflows/vulnerabilities.yml index 5ad377fa07..029e421b2c 100644 --- a/.github/workflows/vulnerabilities.yml +++ b/.github/workflows/vulnerabilities.yml @@ -1,10 +1,16 @@ name: List vulnerable packages +# Deliberately NOT triggered on `pull_request`. +# +# `dotnet package list --vulnerable` consults live advisory data, so a GHSA published +# overnight against one of our transitive dependencies would turn every open PR red - +# halting unrelated work until the dependency is updated, which is routine maintenance +# rather than a defect in the PR. Running on a schedule keeps the signal without making +# it a gate on everybody's work. on: workflow_dispatch: schedule: - cron: "0 0 * * *" # once a day - pull_request: jobs: list-vulnerable-packages: @@ -31,5 +37,8 @@ jobs: shell: bash run: | dotnet package list --project Sentry.slnx --vulnerable --include-transitive --no-restore | tee vulnerable.txt - # https://github.com/getsentry/sentry-dotnet/issues/2814 - # ! grep 'has the following vulnerable packages' vulnerable.txt + + if grep -q 'has the following vulnerable packages' vulnerable.txt; then + echo "::error::Vulnerable packages detected - see the job output above for the affected projects and advisories." + exit 1 + fi