[304NotModified]

Plus build on Linux :)

• vulnerable check

dotnet list ./ package --vulnerable --include-transitive | findstr /S /c:"has the following vulnerable packages"
if (-Not $LastExitCode -eq 1)
{
	dotnet list ./ package --vulnerable --include-transitive
	exit 1
}

Moved to NuGetAudit

<PropertyGroup>
  <NuGetAudit>true</NuGetAudit>
  <NuGetAuditMode>all</NuGetAuditMode>
  <NuGetAuditLevel>low</NuGetAuditLevel>
  <WarningsAsErrors>$(WarningsAsErrors);NU1900;NU1901;NU1902;NU1903;NU1904</WarningsAsErrors>
</PropertyGroup>

• and this publish?

dotnet publish -r win-x64 -c release --self-contained .\examples\NetCore2\HostingExample
if (-Not $LastExitCode -eq 0)
	{ exit $LastExitCode }

from https://github.com/NLog/NLog.Extensions.Logging/blob/GitHub-actions-and-trusted-publishing/run-tests.ps1

See NLog/NLog#6306

• snupkg is missing
• fix linux build
• check nupkg changes (versions etc)
• fix version number
• fix embedded untracked
• configure nuget.org
• fix SonarQube PR comments - dotnet-sonarscanner : The format of the analysis property sonar.github.oauth= is invalid
• fix "productionversion" in csproj
• move creation of package to separate job
• document in csproj/.md where the version number lives
• update github config checks
• check frameworks
• compare to prev versions
• update badge
• cleanup dotnet install versions
• aot test doesn't need another restore? -> it needs a restore
• format documents

[304NotModified]

looks good so far

[304NotModified]

logging 6.2.2 vs 6.2.3-pr

looks all good (note, changed current version back to 6.2.2)

[304NotModified]

Maybe move some stuff to Linux build. The Linux build is way more faster than Windows. E.g. the AOT publish?

Also move the changelog to the .props? As there is also one changelog.md

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[snakefoot]

Maybe move some stuff to Linux build. The Linux build is way more faster than Windows. E.g. the AOT publish?

I like testing (including AOT-testing) on both Windows and Linux platform

Do we need this? dotnet list ./ package --vulnerable --include-transitive

I like that we don't test / publish nuget-packages that contain known vulnerabilities.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[304NotModified]

hosting looks good:

logging looks good:

[304NotModified]

@snakefoot could you please double check?

• I replaced the vulnerable check with nuget audit.
• I removed dotnet install. It's slow on Windows, and not needed :)
• I move creation of the package to a separate job (faster and more clear)
• The version is now in the props. We could also deduplicate the csproj, but that could be a new PR
• I checked the packages, see screenshots

[304NotModified]

Ignore SonarQube/AppVeyor, it's also broken for master