|
| 1 | +# File: CheckNugetStatus.yml |
| 2 | +# the template will write lists of outdated, deprecated or vulnerable nuget packages to build log for every C# project. If a deprecated or vulnerable package is detected, an error will be written to the build log. |
| 3 | +# Precondition: restore and build was executed before this template is used |
| 4 | +# Limitation: dotnet SDK does not provide .NET framework MSBuild targets like "Microsoft.WebApplication.targets". This c# projects will be ignored and "An error occurred for <file name of C# project>" message is added in build log. |
| 5 | + |
| 6 | +parameters: |
| 7 | + condition: 'succeeded()' |
| 8 | + enableQualitySteps: true |
| 9 | + sourcePath: '' |
| 10 | + nugetConfig: '' |
| 11 | + breakBuild: false |
| 12 | + |
| 13 | +steps: |
| 14 | +- task: NuGetAuthenticate@0 |
| 15 | + condition: ${{parameters.condition}} |
| 16 | + enabled: ${{parameters.enableQualitySteps}} |
| 17 | + |
| 18 | +- task: PowerShell@2 |
| 19 | + displayName: 'Check nuget package status' |
| 20 | + inputs: |
| 21 | + targetType: 'inline' |
| 22 | + pwsh: true |
| 23 | + script: | |
| 24 | + Write-Information -MessageData "sourcePath='${{parameters.sourcePath}}'" -InformationAction Continue |
| 25 | + Write-Information -MessageData "nugetConfig='${{parameters.nugetConfig}}'" -InformationAction Continue |
| 26 | + Write-Information -MessageData "#########################################" -InformationAction Continue |
| 27 | + if (!(Test-Path "${{parameters.sourcePath}}" -PathType Container)) { |
| 28 | + Write-Host "##vso[task.LogIssue type=error;]sourcePath does not exist." |
| 29 | + } |
| 30 | + $existsDeprecatedPackage = $false |
| 31 | + $existsVulnerablePackage = $false |
| 32 | +
|
| 33 | + $projectFiles = Get-ChildItem -Path ${{parameters.sourcePath}} -Filter *.csproj -Recurse |
| 34 | + foreach ($project in $projectFiles) { |
| 35 | + try { |
| 36 | + $outdatedList = dotnet list $project package --outdated --include-transitive --source https://api.nuget.org/v3/index.json |
| 37 | + if ($LASTEXITCODE -gt 0) { |
| 38 | + Throw "The command exited with error code: $lastexitcode" |
| 39 | + } |
| 40 | + $outdatedList |
| 41 | + $deprecatedList = dotnet list $project package --deprecated --include-transitive --source https://api.nuget.org/v3/index.json |
| 42 | + if ($deprecatedList.Length -gt 5) { |
| 43 | + $deprecatedList |
| 44 | + $existsDeprecatedPackage = $true |
| 45 | + } else { |
| 46 | + $deprecatedList[4] |
| 47 | + } |
| 48 | + $vulnerableList = dotnet list $project package --vulnerable --source https://api.nuget.org/v3/index.json |
| 49 | + if ($vulnerableList.Length -gt 5) { |
| 50 | + $vulnerableList |
| 51 | + $existsVulnerablePackage = $true |
| 52 | + } else { |
| 53 | + $vulnerableList[4] |
| 54 | + } |
| 55 | + } catch { "An error occurred for $($project.PSChildName)" } |
| 56 | + } |
| 57 | + if ( $existsDeprecatedPackage -or $existsVulnerablePackage) { |
| 58 | + Write-Host "##vso[task.LogIssue type=error;]Detected nuget package: Deprecated = $existsDeprecatedPackage, Vulnerable = $existsVulnerablePackage" |
| 59 | + if ("${{parameters.breakBuild}}" -eq "true") { |
| 60 | + exit 42 |
| 61 | + } |
| 62 | + } else { |
| 63 | + Write-Information -MessageData "Did not detected deprecated or vulnerable nuget package." -InformationAction Continue |
| 64 | + } |
| 65 | + exit 0 |
| 66 | + env: |
| 67 | + SYSTEM_ACCESSTOKEN: $(System.AccessToken) |
| 68 | + condition: ${{parameters.condition}} |
| 69 | + enabled: ${{parameters.enableQualitySteps}} |
0 commit comments