KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

Post-1.0 hardening: deps, release/CodeQL gates, engine containment and clone recovery, account consistency, NuGet update workflow #51

Merged
KofTwentyTwo merged 10 commits from dev into main 2026-10-09 11:22:49 +00:00
Conversation 1 Commits 10 Files Changed 25
+1482 -122
KofTwentyTwo commented 2026-10-09 11:09:22 +00:00 (Migrated from github.com)
Copy link
Copy source

What

Post-1.0 hardening wave from dev (10 commits, CI + CodeQL green on every push):

Dependencies

  • actions/setup-dotnet v5 → v6 in all workflows; LibGit2Sharp 0.31 → 0.32 (security release, libgit2 1.8.6); Velopack 1.2.0 → 1.2.161; Microsoft.Windows.SDK.BuildTools → 10.0.28000.2705; Microsoft.NET.Test.Sdk 18.10.1; coverlet.collector 10.1.0; xunit.runner.visualstudio 4.0.0.
  • Microsoft.WindowsAppSDK 2.2.0 → 2.5.1, verified with a clean x64 build and the full FlaUI end-to-end suite (8/8).

CI / release

  • #45: CodeQL runs on dev pushes and PRs as well as main.
  • #44: the release workflow is now three gated jobs: verify (strict semver and the tagged commit must be contained in main) → gates (calls ci.yml via a new workflow_call trigger: zero-warning build, 100% coverage, format) → release. The FlaUI UI smoke suite runs in the gates but is advisory for a release (ui-tests-advisory input), matching its non-required status on main, so a flaky hosted-runner UI run cannot block an immutable tag; this is the documented exception #44 allows. contents: write is scoped to the release job only. docs/RELEASING.md describes the stages.
  • #52: Dependabot's NuGet ecosystem is replaced by .github/workflows/nuget-updates.yml + .github/scripts/Update-NuGetPackages.ps1. Dependabot cannot evaluate the WinUI target framework (dependabot/dependabot-core#13923) and had silently blocked every WindowsAppSDK/Velopack/xunit-runner update since July. The workflow bumps minor/patch versions via dotnet list package --outdated, holds majors for review, runs the gates on the bumped tree, and opens one PR against dev. GitHub Actions updates stay with Dependabot.
  • #53: the dependency-review license check exempts the three packages whose nuspec declares a file license (LibGit2Sharp, Microsoft.WindowsAppSDK, Microsoft.Windows.SDK.BuildTools); the dependency graph cannot read those and every bump failed the gate. Their real licenses are recorded beside the exemption; vulnerability scanning is unchanged.

Engine

  • #47: new public RepositoryPathResolver. Every repository name must be exactly one safe path segment and resolve strictly under TargetRoot; the engine resolves all targets before creating anything, so a bad descriptor fails the call with nothing touched on disk.
  • #46: the gclo.checkoutpending marker is set the moment a clone's fetch lands and cleared only after checkout completes, so a clone whose cleanup failed is checked out again on the next pull instead of being reported "up to date" from equal commit tips.

ViewModels

  • #43: AccountsStore.Save/Delete now write the vault first and compensate when the metadata write fails (previous token restored, or new entry removed; removed token re-stored). A failed compensation surfaces as AccountConsistencyException describing the leftover state, which a plain retry reconciles. No path logs or surfaces a token.

Why

Closes #43
Closes #44
Closes #45
Closes #46
Closes #47
Closes #52
Closes #53

After merge

  • #55 rehearses the new release chain with v1.0.1-beta.1 (dev channel) once the remaining known issues are fixed; #56 verifies self-update on it. #54 tracks making the UI suite a required check.
  • The NuGet updates workflow becomes dispatchable (workflow_dispatch requires the file on main); it is scheduled for Mondays 06:00 ET. The optional DEPS_PAT secret is on the owner checklist (#7).

Checklist

  • dotnet build gclo.slnx -p:Platform=x64 -warnaserror succeeds with 0 warnings
  • dotnet test gclo.Engine.Tests passes (new engine behavior has tests) — 344 Engine + 65 CLI + 8 e2e; coverage gate 100% on gclo.Engine, gclo.ViewModels, gclo
  • dotnet format gclo.slnx --verify-no-changes --severity error is clean
  • No business logic in the gclo UI project — engine work lives in gclo.Engine
  • Docs updated (README.md, docs/RELEASING.md, CONTRIBUTING.md)

🤖 Generated with Claude Code

## What Post-1.0 hardening wave from `dev` (10 commits, CI + CodeQL green on every push): **Dependencies** - actions/setup-dotnet v5 → v6 in all workflows; LibGit2Sharp 0.31 → 0.32 (security release, libgit2 1.8.6); Velopack 1.2.0 → 1.2.161; Microsoft.Windows.SDK.BuildTools → 10.0.28000.2705; Microsoft.NET.Test.Sdk 18.10.1; coverlet.collector 10.1.0; xunit.runner.visualstudio 4.0.0. - Microsoft.WindowsAppSDK 2.2.0 → 2.5.1, verified with a clean x64 build and the full FlaUI end-to-end suite (8/8). **CI / release** - #45: CodeQL runs on `dev` pushes and PRs as well as `main`. - #44: the release workflow is now three gated jobs: `verify` (strict semver **and** the tagged commit must be contained in `main`) → `gates` (calls `ci.yml` via a new `workflow_call` trigger: zero-warning build, 100% coverage, format) → `release`. The FlaUI UI smoke suite runs in the gates but is **advisory** for a release (`ui-tests-advisory` input), matching its non-required status on `main`, so a flaky hosted-runner UI run cannot block an immutable tag; this is the documented exception #44 allows. `contents: write` is scoped to the release job only. `docs/RELEASING.md` describes the stages. - #52: Dependabot's NuGet ecosystem is replaced by `.github/workflows/nuget-updates.yml` + `.github/scripts/Update-NuGetPackages.ps1`. Dependabot cannot evaluate the WinUI target framework (dependabot/dependabot-core#13923) and had silently blocked every WindowsAppSDK/Velopack/xunit-runner update since July. The workflow bumps minor/patch versions via `dotnet list package --outdated`, holds majors for review, runs the gates on the bumped tree, and opens one PR against `dev`. GitHub Actions updates stay with Dependabot. - #53: the dependency-review license check exempts the three packages whose nuspec declares a file license (LibGit2Sharp, Microsoft.WindowsAppSDK, Microsoft.Windows.SDK.BuildTools); the dependency graph cannot read those and every bump failed the gate. Their real licenses are recorded beside the exemption; vulnerability scanning is unchanged. **Engine** - #47: new public `RepositoryPathResolver`. Every repository name must be exactly one safe path segment and resolve strictly under `TargetRoot`; the engine resolves all targets before creating anything, so a bad descriptor fails the call with nothing touched on disk. - #46: the `gclo.checkoutpending` marker is set the moment a clone's fetch lands and cleared only after checkout completes, so a clone whose cleanup failed is checked out again on the next pull instead of being reported "up to date" from equal commit tips. **ViewModels** - #43: `AccountsStore.Save`/`Delete` now write the vault first and compensate when the metadata write fails (previous token restored, or new entry removed; removed token re-stored). A failed compensation surfaces as `AccountConsistencyException` describing the leftover state, which a plain retry reconciles. No path logs or surfaces a token. ## Why Closes #43 Closes #44 Closes #45 Closes #46 Closes #47 Closes #52 Closes #53 **After merge** - #55 rehearses the new release chain with `v1.0.1-beta.1` (dev channel) once the remaining known issues are fixed; #56 verifies self-update on it. #54 tracks making the UI suite a required check. - The NuGet updates workflow becomes dispatchable (`workflow_dispatch` requires the file on `main`); it is scheduled for Mondays 06:00 ET. The optional `DEPS_PAT` secret is on the owner checklist (#7). ## Checklist - [x] `dotnet build gclo.slnx -p:Platform=x64 -warnaserror` succeeds with **0 warnings** - [x] `dotnet test gclo.Engine.Tests` passes (new engine behavior has tests) — 344 Engine + 65 CLI + 8 e2e; coverage gate 100% on `gclo.Engine`, `gclo.ViewModels`, `gclo` - [x] `dotnet format gclo.slnx --verify-no-changes --severity error` is clean - [x] No business logic in the `gclo` UI project — engine work lives in `gclo.Engine` - [x] Docs updated (`README.md`, `docs/RELEASING.md`, `CONTRIBUTING.md`) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
github-actions[bot] commented 2026-10-09 11:09:35 +00:00 (Migrated from github.com)
Copy link
Copy source

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 3 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

gclo.Engine/gclo.Engine.csproj

PackageVersionLicenseIssue Type
LibGit2Sharp0.32.0LicenseRef-scancode-unknownIncompatible License

gclo/gclo.csproj

PackageVersionLicenseIssue Type
Microsoft.Windows.SDK.BuildTools10.0.28000.2705LicenseRef-scancode-unknownIncompatible License
Microsoft.WindowsAppSDK2.5.1LicenseRef-github-NOASSERTIONIncompatible License

.github/workflows/release.yml

PackageVersionLicenseIssue Type
actions/setup-dotnet6.*.*NullUnknown License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, ISC, MS-PL, Unlicense, CC0-1.0, GPL-2.0-only WITH Classpath-exception-2.0, GPL-2.0-or-later WITH Classpath-exception-2.0, GPL-2.0-only WITH GCC-exception-2.0

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/setup-dotnet 6.*.* 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1014 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
nuget/Microsoft.NET.Test.Sdk 18.10.1 🟢 6.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 10all changesets reviewed
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts⚠️ 0binaries present in source code
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/coverlet.collector 10.1.0 🟢 4.2
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/19 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 7binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST🟢 7SAST tool detected but not run on all commits
nuget/xunit.runner.visualstudio 4.0.0 UnknownUnknown
nuget/Microsoft.NET.Test.Sdk 18.10.1 🟢 6.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 10all changesets reviewed
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts⚠️ 0binaries present in source code
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/coverlet.collector 10.1.0 🟢 4.2
Details
CheckScoreReason
Code-Review⚠️ 2Found 4/19 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 7binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST🟢 7SAST tool detected but not run on all commits
nuget/xunit.runner.visualstudio 4.0.0 UnknownUnknown
nuget/LibGit2Sharp 0.32.0 🟢 3.6
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Code-Review🟢 4Found 6/15 approved changesets -- score normalized to 4
Maintained🟢 43 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 4
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
nuget/Microsoft.NET.Test.Sdk 18.10.1 🟢 6.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 10all changesets reviewed
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts⚠️ 0binaries present in source code
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/xunit.runner.visualstudio 4.0.0 UnknownUnknown
nuget/Microsoft.Windows.SDK.BuildTools 10.0.28000.2705 UnknownUnknown
nuget/Microsoft.WindowsAppSDK 2.5.1 UnknownUnknown
nuget/Velopack 1.2.161 UnknownUnknown

Scanned Files

  • .github/workflows/release.yml
  • gclo.Cli.Tests/gclo.Cli.Tests.csproj
  • gclo.Engine.Tests/gclo.Engine.Tests.csproj
  • gclo.Engine/gclo.Engine.csproj
  • gclo.UiTests/gclo.UiTests.csproj
  • gclo/gclo.csproj
<h1>Dependency Review</h1> The following issues were found:<ul><li>✅ 0 vulnerable package(s)</li><li>❌ 3 package(s) with incompatible licenses</li><li>✅ 0 package(s) with invalid SPDX license definitions</li><li>⚠️ 1 package(s) with unknown licenses.</li></ul> See the Details below.<h2>License Issues</h2> <h4><em>gclo.Engine/gclo.Engine.csproj</em></h4> <table><tr><td>Package</td><td>Version</td><td>License</td><td>Issue Type</td></tr><tr><td>LibGit2Sharp</td><td>0.32.0</td><td>LicenseRef-scancode-unknown</td><td>Incompatible License</td></tr></table> <h4><em>gclo/gclo.csproj</em></h4> <table><tr><td>Package</td><td>Version</td><td>License</td><td>Issue Type</td></tr><tr><td>Microsoft.Windows.SDK.BuildTools</td><td>10.0.28000.2705</td><td>LicenseRef-scancode-unknown</td><td>Incompatible License</td></tr><tr><td>Microsoft.WindowsAppSDK</td><td>2.5.1</td><td>LicenseRef-github-NOASSERTION</td><td>Incompatible License</td></tr></table> <h4><em>.github/workflows/release.yml</em></h4> <table><tr><td>Package</td><td>Version</td><td>License</td><td>Issue Type</td></tr><tr><td>actions/setup-dotnet</td><td>6.*.*</td><td>Null</td><td>Unknown License</td></tr></table> <blockquote><details><summary><strong>Allowed Licenses</strong>:</summary> MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, ISC, MS-PL, Unlicense, CC0-1.0, GPL-2.0-only WITH Classpath-exception-2.0, GPL-2.0-or-later WITH Classpath-exception-2.0, GPL-2.0-only WITH GCC-exception-2.0</details></blockquote> <h2>OpenSSF Scorecard</h2> <details><summary>Scorecard details</summary> <table><tr><th>Package</th><th>Version</th><th>Score</th><th>Details</th></tr> <tr><td> actions/actions/setup-dotnet </td><td>6.*.*</td> <td>:green_circle: 6.6</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>14 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Code-Review</td><td>:green_circle: 10</td><td>all changesets reviewed</td></tr><tr><td>Binary-Artifacts</td><td>:green_circle: 10</td><td>no binaries found in the repo</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Token-Permissions</td><td>:warning: 0</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Pinned-Dependencies</td><td>:green_circle: 8</td><td>dependency not pinned by hash detected -- score normalized to 8</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>Signed-Releases</td><td>:warning: -1</td><td>no releases found</td></tr><tr><td>Security-Policy</td><td>:green_circle: 9</td><td>security policy file detected</td></tr><tr><td>Branch-Protection</td><td>:warning: 0</td><td>branch protection not enabled on development/release branches</td></tr><tr><td>SAST</td><td>:green_circle: 9</td><td>SAST tool is not run on all commits -- score normalized to 9</td></tr></table></details></td></tr> <tr><td> nuget/Microsoft.NET.Test.Sdk </td><td>18.10.1</td> <td>:green_circle: 6.2</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Security-Policy</td><td>:green_circle: 10</td><td>security policy file detected</td></tr><tr><td>Code-Review</td><td>:green_circle: 10</td><td>all changesets reviewed</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Binary-Artifacts</td><td>:warning: 0</td><td>binaries present in source code</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: -1</td><td>no releases found</td></tr><tr><td>Token-Permissions</td><td>:green_circle: 9</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Pinned-Dependencies</td><td>:green_circle: 10</td><td>all dependencies are pinned</td></tr><tr><td>Branch-Protection</td><td>:warning: 1</td><td>branch protection is not maximal on development and all release branches</td></tr><tr><td>SAST</td><td>:warning: 0</td><td>SAST tool is not run on all commits -- score normalized to 0</td></tr></table></details></td></tr> <tr><td> nuget/coverlet.collector </td><td>10.1.0</td> <td>:green_circle: 4.2</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Code-Review</td><td>:warning: 2</td><td>Found 4/19 approved changesets -- score normalized to 2</td></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Token-Permissions</td><td>:warning: 0</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Binary-Artifacts</td><td>:green_circle: 7</td><td>binaries present in source code</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Pinned-Dependencies</td><td>:warning: 0</td><td>dependency not pinned by hash detected -- score normalized to 0</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: 0</td><td>Project has not signed or included provenance with any releases.</td></tr><tr><td>Branch-Protection</td><td>:warning: -1</td><td>internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md</td></tr><tr><td>Security-Policy</td><td>:warning: 0</td><td>security policy file not detected</td></tr><tr><td>SAST</td><td>:green_circle: 7</td><td>SAST tool detected but not run on all commits</td></tr></table></details></td></tr> <tr><td> nuget/xunit.runner.visualstudio </td><td>4.0.0</td> <td> Unknown</td><td>Unknown</td></tr> <tr><td> nuget/Microsoft.NET.Test.Sdk </td><td>18.10.1</td> <td>:green_circle: 6.2</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Security-Policy</td><td>:green_circle: 10</td><td>security policy file detected</td></tr><tr><td>Code-Review</td><td>:green_circle: 10</td><td>all changesets reviewed</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Binary-Artifacts</td><td>:warning: 0</td><td>binaries present in source code</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: -1</td><td>no releases found</td></tr><tr><td>Token-Permissions</td><td>:green_circle: 9</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Pinned-Dependencies</td><td>:green_circle: 10</td><td>all dependencies are pinned</td></tr><tr><td>Branch-Protection</td><td>:warning: 1</td><td>branch protection is not maximal on development and all release branches</td></tr><tr><td>SAST</td><td>:warning: 0</td><td>SAST tool is not run on all commits -- score normalized to 0</td></tr></table></details></td></tr> <tr><td> nuget/coverlet.collector </td><td>10.1.0</td> <td>:green_circle: 4.2</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Code-Review</td><td>:warning: 2</td><td>Found 4/19 approved changesets -- score normalized to 2</td></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Token-Permissions</td><td>:warning: 0</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Binary-Artifacts</td><td>:green_circle: 7</td><td>binaries present in source code</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Pinned-Dependencies</td><td>:warning: 0</td><td>dependency not pinned by hash detected -- score normalized to 0</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: 0</td><td>Project has not signed or included provenance with any releases.</td></tr><tr><td>Branch-Protection</td><td>:warning: -1</td><td>internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md</td></tr><tr><td>Security-Policy</td><td>:warning: 0</td><td>security policy file not detected</td></tr><tr><td>SAST</td><td>:green_circle: 7</td><td>SAST tool detected but not run on all commits</td></tr></table></details></td></tr> <tr><td> nuget/xunit.runner.visualstudio </td><td>4.0.0</td> <td> Unknown</td><td>Unknown</td></tr> <tr><td> nuget/LibGit2Sharp </td><td>0.32.0</td> <td>:green_circle: 3.6</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Token-Permissions</td><td>:warning: 0</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Code-Review</td><td>:green_circle: 4</td><td>Found 6/15 approved changesets -- score normalized to 4</td></tr><tr><td>Maintained</td><td>:green_circle: 4</td><td>3 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 4</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Pinned-Dependencies</td><td>:warning: 0</td><td>dependency not pinned by hash detected -- score normalized to 0</td></tr><tr><td>Binary-Artifacts</td><td>:green_circle: 10</td><td>no binaries found in the repo</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: -1</td><td>no releases found</td></tr><tr><td>Security-Policy</td><td>:warning: 0</td><td>security policy file not detected</td></tr><tr><td>SAST</td><td>:warning: 0</td><td>SAST tool is not run on all commits -- score normalized to 0</td></tr><tr><td>Branch-Protection</td><td>:warning: 0</td><td>branch protection not enabled on development/release branches</td></tr></table></details></td></tr> <tr><td> nuget/Microsoft.NET.Test.Sdk </td><td>18.10.1</td> <td>:green_circle: 6.2</td><td><details><summary>Details</summary><table><tr><th>Check</th><th>Score</th><th>Reason</th></tr><tr><td>Maintained</td><td>:green_circle: 10</td><td>30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10</td></tr><tr><td>Security-Policy</td><td>:green_circle: 10</td><td>security policy file detected</td></tr><tr><td>Code-Review</td><td>:green_circle: 10</td><td>all changesets reviewed</td></tr><tr><td>License</td><td>:green_circle: 10</td><td>license file detected</td></tr><tr><td>CII-Best-Practices</td><td>:warning: 0</td><td>no effort to earn an OpenSSF best practices badge detected</td></tr><tr><td>Dangerous-Workflow</td><td>:green_circle: 10</td><td>no dangerous workflow patterns detected</td></tr><tr><td>Binary-Artifacts</td><td>:warning: 0</td><td>binaries present in source code</td></tr><tr><td>Packaging</td><td>:warning: -1</td><td>packaging workflow not detected</td></tr><tr><td>Fuzzing</td><td>:warning: 0</td><td>project is not fuzzed</td></tr><tr><td>Signed-Releases</td><td>:warning: -1</td><td>no releases found</td></tr><tr><td>Token-Permissions</td><td>:green_circle: 9</td><td>detected GitHub workflow tokens with excessive permissions</td></tr><tr><td>Pinned-Dependencies</td><td>:green_circle: 10</td><td>all dependencies are pinned</td></tr><tr><td>Branch-Protection</td><td>:warning: 1</td><td>branch protection is not maximal on development and all release branches</td></tr><tr><td>SAST</td><td>:warning: 0</td><td>SAST tool is not run on all commits -- score normalized to 0</td></tr></table></details></td></tr> <tr><td> nuget/xunit.runner.visualstudio </td><td>4.0.0</td> <td> Unknown</td><td>Unknown</td></tr> <tr><td> nuget/Microsoft.Windows.SDK.BuildTools </td><td>10.0.28000.2705</td> <td> Unknown</td><td>Unknown</td></tr> <tr><td> nuget/Microsoft.WindowsAppSDK </td><td>2.5.1</td> <td> Unknown</td><td>Unknown</td></tr> <tr><td> nuget/Velopack </td><td>1.2.161</td> <td> Unknown</td><td>Unknown</td></tr> </table></details><h2>Scanned Files</h2> <ul><li>.github/workflows/release.yml</li><li>gclo.Cli.Tests/gclo.Cli.Tests.csproj</li><li>gclo.Engine.Tests/gclo.Engine.Tests.csproj</li><li>gclo.Engine/gclo.Engine.csproj</li><li>gclo.UiTests/gclo.UiTests.csproj</li><li>gclo/gclo.csproj</li></ul> <!-- dependency-review-pr-comment-marker -->
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#51