From 45d81dc706c397a51238a8b87398b7cd6be5c2b9 Mon Sep 17 00:00:00 2001
From: Thomas Ardal <thomasardal@gmail.com>
Date: Fri, 3 May 2024 10:10:44 +0200
Subject: [PATCH] Added check for vulnerable packages to GitHub Actions

---
 .github/workflows/dotnet-core.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml
index 379ce3c..8835225 100644
--- a/.github/workflows/dotnet-core.yml
+++ b/.github/workflows/dotnet-core.yml
@@ -25,6 +25,20 @@ jobs:
     - name: Install dependencies
       run: dotnet restore
 
+    - name: Check for vulnerable packages
+      run: |
+        set -e # This will cause the script to exit on the first error
+        OUTPUT=$(dotnet list package --vulnerable)
+        echo "$OUTPUT"
+        if echo "$OUTPUT" | grep -q 'no vulnerable packages'; then
+          echo "No vulnerable packages found"
+        else
+          if echo "$OUTPUT" | grep -q 'vulnerable'; then
+            echo "Vulnerable packages found"
+            exit 1
+          fi
+        fi
+
     - name: Build
       run: dotnet build --configuration Release --no-restore