Add support for PackageGuard and use it in the pipeline - #659
Open
dennisdoomen wants to merge 2 commits into
Open
Add support for PackageGuard and use it in the pipeline#659dennisdoomen wants to merge 2 commits into
dennisdoomen wants to merge 2 commits into
Conversation
dennisdoomen
added
enhancement
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
August 25, 2026 19:16
d0c4f43 to
f3da768
Compare
Collaborator
Author
|
@ChrisonSimtian what do you think about this PR? |
Collaborator
I love the idea of having this baked in, it adds real value to the CI |
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
2 times, most recently
from
August 28, 2026 07:09
e5d1a2a to
331023a
Compare
3 tasks
dennisdoomen
added a commit
that referenced
this pull request
Aug 28, 2026
Its NuGet metadata carries no license expression or URL, same gap as FluentAssertions above it — PackageGuard can't auto-detect either despite both being MIT. See #659.
Explicitly allows NetArchTest.Rules alongside FluentAssertions in .packageguard/config.json — both are MIT-licensed but publish no license expression or URL for PackageGuard to auto-detect.
Fixes a race with PromptConfirmationGlyphSpecs: both mutate the shared static ConsoleUtility.ConsoleWrapper/IsInterrupted, but only the glyph specs opted into ProcessGlobalStateCollection. xUnit runs different collections in parallel, so the two classes intermittently stomped on each other's console wrapper, surfacing as a FakeConsole.LastLine 'Sequence contains no matching element' failure in CI.
dennisdoomen
force-pushed
the
claude/packageguard-generated-support-e39906
branch
from
August 28, 2026 09:04
c926a33 to
2d4db33
Compare
dennisdoomen
marked this pull request as ready for review
August 28, 2026 09:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Fallout CLI tool wrapper for PackageGuard's
analyzecommand, based onAnalyzeCommandSettings.cs, and wires it into the build pipeline as a compliance gate plus SBOM/risk-reporting.Tool wrapper
src/Fallout.Common/Tools/PackageGuard/PackageGuard.json— spec covering all 18analyzesettings, plusNpmPackageManagerandSbomFormatenumerations for the properties restricted to a fixed set of values.PackageGuard.Generated.cs— regenerated via./build.ps1 GenerateTools.docs/website/03-common/08-cli-tools.md.TestPackageGuardtotests/Fallout.Common.Specs/SettingsSpecs.cs.Build pipeline
PackageGuardtarget (build/Build.PackageGuard.cs) runs the policy-violation check on every PR (added tobuild.yml's required gate, alongsideVerifyGeneratedTools/Test/Pack) — a license/package-policy violation now blocks the PR gate like any other check.main,develop,release/*, orsupport/*— viaGitRepository.IsOn*Branch()(including a newIsOnSupportBranch()extension), or, for the tag-triggered release workflow where HEAD is detached, because that workflow's ownvalidate-refjob already proved the tag is reachable from a production branch.security-scanworkflow (generated from a third[GitHubActions]attribute) runs on every push to those branches and uploads the SARIF report to GitHub code scanning viagithub/codeql-action/upload-sarif.publish-packages-release.ymlnow runsPackageGuardalongsideTest+Packand attaches both the SBOM and the HTML risk report to the GitHub Release as assets..packageguard/config.json— an allowlist covering the permissive license family this repo's actual dependencies use (MIT, Apache-2.0, BSD-2/3-Clause, ISC, 0BSD, MS-PL), plus an explicit package-name allowance forFluentAssertions(its pinned 8.10.0 reports no SPDX license expression at all — alicenseFileplus a note that commercial use requires a paid Xceed license — so no license-based match would cover it; mirrors the same allowance PackageGuard's own repo uses on itself). Without a config file, PackageGuard's NuGet analysis throws on every run instead of defaulting permissive, which would have broken every PR the moment this became a required check.Purely additive — no breaking changes.
🤖 Generated with Claude Code