Add support for PackageGuard and use it in the pipeline - #659
Merged
dennisdoomen merged 1 commit intoSep 19, 2026
Merged
Conversation
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
August 25, 2026 19:16
d0c4f43 to
f3da768
Compare
Collaborator
Author
|
@ChrisonSimtian what do you think about this PR? |
Collaborator
I love the idea of having this baked in, it adds real value to the CI |
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
2 times, most recently
from
August 28, 2026 07:09
e5d1a2a to
331023a
Compare
3 tasks
dennisdoomen
added a commit
that referenced
this pull request
Aug 28, 2026
Its NuGet metadata carries no license expression or URL, same gap as FluentAssertions above it — PackageGuard can't auto-detect either despite both being MIT. See #659.
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
August 28, 2026 09:04
c926a33 to
2d4db33
Compare
dennisdoomen
marked this pull request as ready for review
August 28, 2026 09:12
ChrisonSimtian
approved these changes
Sep 8, 2026
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
September 19, 2026 06:30
2d4db33 to
1e47fed
Compare
Adds a Fallout CLI tool wrapper for PackageGuard's analyze command and wires it into the build pipeline as a compliance gate plus SBOM/risk-reporting: - New PackageGuard target (build/Build.PackageGuard.cs) runs the policy-violation check on every PR; the SBOM (CycloneDX) and HTML+SARIF risk report are only generated on main/develop/release/ support branches, uploaded to GitHub code scanning via a new security-scan workflow, and attached to GitHub Releases. - .packageguard/config.json allow-lists this repo's permissive license family, plus FluentAssertions and NetArchTest.Rules, which are MIT-licensed but publish no license expression or URL for PackageGuard to auto-detect. - Pins PackageGuard at 2.7.1 and passes the risk-report path via the CLI's --report-risk path argument (added in 2.5.0) rather than the undocumented env var override that 2.4.0 required. - Points the CLI tools doc at PackageGuard's new packageguard.org site instead of its GitHub repo. Also serialises ConsoleUtilitySpecs with the process-global-state collection: it races with PromptConfirmationGlyphSpecs over the shared static ConsoleUtility wrapper, which xUnit's parallel collection runs intermittently surfaced as a FakeConsole.LastLine failure in CI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
September 19, 2026 07:48
485ea32 to
9bdfa51
Compare
dennisdoomen
enabled auto-merge (rebase)
September 19, 2026 07:49
dennisdoomen
deleted the
claude/packageguard-generated-support-e39906
branch
September 19, 2026 07:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Fallout CLI tool wrapper for PackageGuard's
analyzecommand, based onAnalyzeCommandSettings.cs, and wires it into the build pipeline as a compliance gate plus SBOM/risk-reporting.Tool wrapper
src/Fallout.Common/Tools/PackageGuard/PackageGuard.json— spec covering all 18analyzesettings, plusNpmPackageManagerandSbomFormatenumerations for the properties restricted to a fixed set of values.PackageGuard.Generated.cs— regenerated via./build.ps1 GenerateTools.docs/website/03-common/08-cli-tools.md.TestPackageGuardtotests/Fallout.Common.Specs/SettingsSpecs.cs.Build pipeline
PackageGuardtarget (build/Build.PackageGuard.cs) runs the policy-violation check on every PR (added tobuild.yml's required gate, alongsideVerifyGeneratedTools/Test/Pack) — a license/package-policy violation now blocks the PR gate like any other check.main,develop,release/*, orsupport/*— viaGitRepository.IsOn*Branch()(including a newIsOnSupportBranch()extension), or, for the tag-triggered release workflow where HEAD is detached, because that workflow's ownvalidate-refjob already proved the tag is reachable from a production branch.security-scanworkflow (generated from a third[GitHubActions]attribute) runs on every push to those branches and uploads the SARIF report to GitHub code scanning viagithub/codeql-action/upload-sarif.publish-packages-release.ymlnow runsPackageGuardalongsideTest+Packand attaches both the SBOM and the HTML risk report to the GitHub Release as assets..packageguard/config.json— an allowlist covering the permissive license family this repo's actual dependencies use (MIT, Apache-2.0, BSD-2/3-Clause, ISC, 0BSD, MS-PL), plus an explicit package-name allowance forFluentAssertions(its pinned 8.10.0 reports no SPDX license expression at all — alicenseFileplus a note that commercial use requires a paid Xceed license — so no license-based match would cover it; mirrors the same allowance PackageGuard's own repo uses on itself). Without a config file, PackageGuard's NuGet analysis throws on every run instead of defaulting permissive, which would have broken every PR the moment this became a required check.Purely additive — no breaking changes.
🤖 Generated with Claude Code