Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: .Net Pinned dependency check ignores using RestoreLockedMode #4251

Open
balteravishay opened this issue Jul 23, 2024 · 0 comments
Open
Labels
kind/bug Something isn't working

Comments

@balteravishay
Copy link
Contributor

balteravishay commented Jul 23, 2024

Describe the bug
The current implementation of checking for locking dependencies in .net only checks if the command that is used is of type "dotnet.exe restore --locked-mode" or "msbuild.exe -t:restore -p:RestoreLockedMode=true", but ignores cases in which the maintainer opts for using RestoreLockedMode MSBuild property in their project file as such:

<PropertyGroup>
    <!--- ... -->
    <RestoreLockedMode>true</RestoreLockedMode>
    <!--- ... -->
</PropertyGroup>

more info here

Reproduction steps
Steps to reproduce the behavior:

  1. when scanning for pinned dependency a repo which leverages RestoreLockedMode MSBuild property, the pinning should be detected.
  2. example: go run main.go --repo elastic/elasticsearch-net --checks Pinned-Dependencies --format json --show-details | jq

Expected behavior
.net repositories can leverage either restore behavior with lock file that is documented and the pinned dependency score should be similar.
For the example given above (elastic/elasticsearch-net), the score for pinned nugetCommand dependencies should be 3 out of 3.

@balteravishay balteravishay added the kind/bug Something isn't working label Jul 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Something isn't working
Projects
Status: No status
Development

No branches or pull requests

1 participant