@@ -18,8 +18,12 @@ permissions:
1818
1919jobs :
2020 test :
21- name : Build & Test
22- runs-on : ubuntu-latest
21+ name : Build & Test (${{ matrix.os }})
22+ runs-on : ${{ matrix.os }}
23+ strategy :
24+ fail-fast : false
25+ matrix :
26+ os : [ubuntu-latest, windows-latest, macos-latest]
2327
2428 steps :
2529 - name : Checkout
@@ -30,25 +34,71 @@ jobs:
3034 with :
3135 dotnet-version : ' 10.0.x'
3236
37+ # Cache restored NuGet packages keyed on the project/props files.
38+ # (setup-dotnet's built-in cache needs a packages.lock.json, which this repo
39+ # does not use, so we cache the global packages folder directly.)
40+ - name : Cache NuGet packages
41+ uses : actions/cache@v4
42+ with :
43+ path : ~/.nuget/packages
44+ key : ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/Directory.Build.props') }}
45+ restore-keys : |
46+ ${{ runner.os }}-nuget-
47+
3348 - name : Restore
3449 run : dotnet restore FixedWidthParser.slnx
3550
3651 - name : Build (Release)
3752 run : dotnet build FixedWidthParser.slnx --configuration Release --no-restore
3853
39- - name : Test (Release)
54+ - name : Test (Release) + collect coverage
4055 run : >-
4156 dotnet test FixedWidthParser.slnx
4257 --configuration Release
4358 --no-build
4459 --verbosity normal
4560 --logger "trx;LogFileName=test-results.trx"
4661 --results-directory ./TestResults
62+ --collect:"XPlat Code Coverage"
4763
4864 - name : Upload test results
4965 if : always()
5066 uses : actions/upload-artifact@v4
5167 with :
52- name : test-results
53- path : ./TestResults/*.trx
68+ name : test-results-${{ matrix.os }}
69+ path : ./TestResults/**/* .trx
5470 if-no-files-found : ignore
71+
72+ # Coverage is uploaded once, from the Linux leg only, to avoid duplicate reports.
73+ - name : Upload coverage to Codecov
74+ if : matrix.os == 'ubuntu-latest'
75+ uses : codecov/codecov-action@v5
76+ with :
77+ token : ${{ secrets.CODECOV_TOKEN }}
78+ files : ./TestResults/**/coverage.cobertura.xml
79+ fail_ci_if_error : false
80+
81+ # Surfaces vulnerable transitive/direct packages regardless of NoWarn suppressions
82+ # in Directory.Build.props (NU190x warnings are silenced there).
83+ audit :
84+ name : Dependency audit
85+ runs-on : ubuntu-latest
86+ steps :
87+ - uses : actions/checkout@v4
88+
89+ - uses : actions/setup-dotnet@v4
90+ with :
91+ dotnet-version : ' 10.0.x'
92+
93+ - name : Restore
94+ run : dotnet restore FixedWidthParser.slnx
95+
96+ - name : Check for vulnerable packages
97+ run : |
98+ echo "Scanning for known-vulnerable packages…"
99+ output=$(dotnet list FixedWidthParser.slnx package --vulnerable --include-transitive)
100+ echo "$output"
101+ if echo "$output" | grep -q -E '\b(High|Critical)\b'; then
102+ echo "::error::High or Critical severity vulnerability found in dependencies."
103+ exit 1
104+ fi
0 commit comments