_dotnet.yml

name: .NET

# Checks one .NET app in one job: restore, format, Release build, tests with coverage, then NuGet audit.
# `ci.yml` calls this building block once per app; the app jobs run independently in parallel.
# Setup and restore run once. Coverage is uploaded as `coverage-dotnet-<workspace>` for `_sonar.yml`.

on:
  workflow_call:
    inputs:
      workspace:
        description: Short app name, used for the coverage artifact.
        type: string
        required: true
      directory:
        description: Directory of the app.
        type: string
        required: true
      solution:
        description: Solution file, relative to the directory.
        type: string
        required: true
      format-exclude:
        description: Glob that `dotnet format` skips, e.g. generated migrations; empty skips nothing.
        type: string
        default: ""

permissions:
  contents: read

jobs:
  checks:
    name: "✅ Checks"
    runs-on: ubuntu-latest
    timeout-minutes: 30
    defaults:
      run:
        working-directory: ${{ inputs.directory }}

    steps:
      - name: "🏖️ Checkout Repository"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: "🔧 Set up .NET"
        uses: ./.github/actions/setup-dotnet

      - name: "📦 Restore dependencies"
        run: dotnet restore "${{ inputs.solution }}" --locked-mode

      - name: "🧹 Format"
        env:
          FORMAT_EXCLUDE: ${{ inputs.format-exclude }}
        run: |
          exclude=()
          if [ -n "$FORMAT_EXCLUDE" ]; then exclude=(--exclude "$FORMAT_EXCLUDE"); fi
          dotnet format "${{ inputs.solution }}" --no-restore --verify-no-changes --verbosity detailed "${exclude[@]}"

      - name: "🧱 Build"
        run: dotnet build "${{ inputs.solution }}" --configuration Release --no-restore

      # Microsoft.Testing.Platform writes one `<guid>.xml` coverage report per test project.
      - name: "🧪 Tests and coverage"
        run: |
          dotnet test --solution "${{ inputs.solution }}" \
            --configuration Release \
            --no-build \
            --results-directory TestResults \
            --coverage \
            --coverage-output-format xml

      - name: "📎 Upload coverage"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: coverage-dotnet-${{ inputs.workspace }}
          path: ${{ inputs.directory }}/TestResults/*.xml
          if-no-files-found: error
          retention-days: 7

      - name: "🔍 Audit"
        run: |
          dotnet list "${{ inputs.solution }}" package --vulnerable --include-transitive --format=json > list.json
          high_or_critical="$(jq '.projects | [.. | objects | .severity? // empty | select(. == "High" or . == "Critical")] | length' list.json)"
          jq . list.json
          if [ "$high_or_critical" -gt 0 ]; then
            echo 'High or critical vulnerabilities found! Exiting...'
            exit 1
          else
            echo 'No high or critical vulnerabilities found.'
          fi