From 0ae2b9f628c0c7bee33c351614e06c14de157af7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lu=C3=ADs=20Amorim?= Date: Thu, 13 Aug 2026 16:22:40 +0100 Subject: [PATCH] Add a nightly NuGet audit run so new advisories surface on their own schedule NuGet audit validates against the live advisory database at restore time, so a green check can silently go stale: GHSA-q939-rpr3-3284 was published hours after PR #17's CI passed and turned master red the moment the stale-green PR merged. A scheduled restore on master catches new advisories within a day and attributes the failure to the advisory instead of to the next unrelated merge. Co-Authored-By: Claude Fable 5 --- .github/workflows/nightly-audit.yml | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/nightly-audit.yml diff --git a/.github/workflows/nightly-audit.yml b/.github/workflows/nightly-audit.yml new file mode 100644 index 0000000..b58ee57 --- /dev/null +++ b/.github/workflows/nightly-audit.yml @@ -0,0 +1,30 @@ +name: Nightly Audit + +# NuGet audit checks the live advisory database at restore time, so a newly +# published vulnerability can turn a previously green master red with zero code +# change (this is how GHSA-q939-rpr3-3284 broke the merge of the OS-matrix PR). +# This nightly restore surfaces new advisories on their own schedule, attributed +# to the advisory itself rather than to whoever happens to merge next. +on: + schedule: + # 03:00 UTC, before the working day starts in any contributor timezone. + - cron: '0 3 * * *' + workflow_dispatch: + +jobs: + audit: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v7 + + - name: Setup .NET + uses: actions/setup-dotnet@v6 + with: + global-json-file: global.json + + - name: Restore (NuGet audit) + # TreatWarningsAsErrors in Directory.Build.props escalates NU19xx audit + # warnings to restore failures, so a plain restore is the whole check. + run: dotnet restore