nuget-reference-check.yml

name: "nuget package reference check"

on:
  push:
  pull_request:
  schedule:
    - cron: '0 8 * * *'

permissions:
  contents: read
  issues: write

jobs:
  nuget-package-check:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 2

      - name: Setup .NET Environment
        uses: actions/setup-dotnet@v5.1.0
        with:
          dotnet-version: '10.0.x'

      - name: Check for outdated packages
        id: outdated
        run: |
          set -e

          IGNORE_PACKAGES="Microsoft\.NETCore\.Platforms|Microsoft\.NETCore\.Targets"

          # Full report for the workflow logs only, including transitive packages
          dotnet list SysML2.NET.sln package --outdated --include-transitive > outdated-full-raw.log
          grep -v -E "$IGNORE_PACKAGES" outdated-full-raw.log > outdated-full.log || true

          echo "=== Full outdated packages report including transitive packages ==="
          cat outdated-full.log

          # Direct/top-level outdated packages only, used for GitHub issue creation
          dotnet list SysML2.NET.sln package --outdated > outdated-raw.log
          grep -v -E "$IGNORE_PACKAGES" outdated-raw.log > outdated.log || true

          echo "=== Direct outdated packages report used for issue detection ==="
          cat outdated.log

          awk '
            /^Project .*.Tests/ { skip=1; next }
            /^Project / { skip=0 }
            !skip { print }
          ' outdated.log > outdated-issue.log

          if grep -q "^ *>" outdated-issue.log; then
            echo "Outdated direct packages found in non-test projects"
            echo "outdated=true" >> $GITHUB_OUTPUT
          else
            echo "No outdated direct packages found in non-test projects"
            echo "outdated=false" >> $GITHUB_OUTPUT
          fi
          
      - name: Check for deprecated packages
        id: deprecated
        run: |
          set -e
          
          dotnet list SysML2.NET.sln package --deprecated --include-transitive > deprecated.log
          
          echo "=== Full deprecated packages report ==="
          cat deprecated.log
          
          awk '
            /^Project .*.Tests/ { skip=1; next }
            /^Project / { skip=0 }
            !skip { print }
          ' deprecated.log > deprecated-issue.log
          
          if grep -q "^ *>" deprecated-issue.log; then
            echo "Deprecated packages found in non-test projects"
            echo "deprecated=true" >> $GITHUB_OUTPUT
          else
            echo "No deprecated packages found in non-test projects"
            echo "deprecated=false" >> $GITHUB_OUTPUT
          fi

      - name: Check for vulnerable packages
        id: vulnerable
        run: |
          set -e
          
          dotnet list SysML2.NET.sln package --vulnerable --include-transitive > vulnerabilities.log
          
          echo "=== Full vulnerable packages report ==="
          cat vulnerabilities.log
          
          awk '
            /^Project .*.Tests/ { skip=1; next }
            /^Project / { skip=0 }
            !skip { print }
          ' vulnerabilities.log > vulnerabilities-issue.log
          
          if grep -q "^ *>" vulnerabilities-issue.log; then
            echo "Security vulnerabilities found in non-test projects"
            echo "vulnerable=true" >> $GITHUB_OUTPUT
          else
            echo "No security vulnerabilities found in non-test projects"
            echo "vulnerable=false" >> $GITHUB_OUTPUT
          fi

      - name: Synchronize NuGet package issue
        if: github.event_name != 'pull_request'
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const fs = require('fs');
            
            const issueTitle = 'NuGet Package Issues Detected';
            
            const hasOutdated = '${{ steps.outdated.outputs.outdated }}' === 'true';
            const hasDeprecated = '${{ steps.deprecated.outputs.deprecated }}' === 'true';
            const hasVulnerable = '${{ steps.vulnerable.outputs.vulnerable }}' === 'true';
            
            const hasIssues = hasOutdated || hasDeprecated || hasVulnerable;
            
            const { data: issues } = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
            });
            
            const existingIssue = issues.find(issue => issue.title === issueTitle);
            
            if (!hasIssues) {
              if (existingIssue) {
                await github.rest.issues.createComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: existingIssue.number,
                  body: 'NuGet package check is clean again. Closing this issue automatically.',
                });
            
                await github.rest.issues.update({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: existingIssue.number,
                  state: 'closed',
                });
              }
            
              return;
            }
            
            let issueBody = `### NuGet Package Issues Detected in [SysML2.NET](${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY})\n\n`;
            
            if (hasOutdated) {
              const outdatedLog = fs.readFileSync('outdated-issue.log', 'utf8');
              issueBody += `#### Outdated Packages\n\`\`\`\n${outdatedLog}\n\`\`\`\n\n`;
            }
            
            if (hasDeprecated) {
              const deprecatedLog = fs.readFileSync('deprecated-issue.log', 'utf8');
              issueBody += `#### Deprecated Packages\n\`\`\`\n${deprecatedLog}\n\`\`\`\n\n`;
            }
            
            if (hasVulnerable) {
              const vulnerabilitiesLog = fs.readFileSync('vulnerabilities-issue.log', 'utf8');
              issueBody += `#### Vulnerable Packages\n\`\`\`\n${vulnerabilitiesLog}\n\`\`\`\n\n`;
            }
            
            issueBody += '**Action Required:** Please review and update the affected packages.';
            
            if (existingIssue) {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: existingIssue.number,
                body: `New check results:\n\n${issueBody}`,
              });
            } else {
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: issueTitle,
                body: issueBody,
              });
            }