ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-test:
    name: Build & Test
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
        with:
          global-json-file: global.json

      - name: Restore
        run: dotnet restore IronTrace.sln

      - name: Build
        run: dotnet build IronTrace.sln -c Release --no-restore

      - name: Test
        run: dotnet test IronTrace.sln -c Release --no-build --verbosity normal

      - name: Vulnerable package scan
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $output = dotnet list IronTrace.sln package --vulnerable --include-transitive 2>&1 | Out-String
          Write-Host $output
          if ($output -match '(?i)\b(Critical|High)\b') {
            Write-Error 'High or Critical NuGet vulnerabilities detected.'
            exit 1
          }