Upgrade dependencies and enhance build security

DevOps/ContinuousIntegration.yml

@@ -25,13 +25,38 @@ stages:
       vmImage: 'windows-latest' # Need windows to get code coverage report - https://github.com/actions/virtual-environments/tree/master/images/win
       #name: Self-Hosted
     steps:
+    #
+    # Remove Azure DevOps access token ...
+    - powershell: |
+        Remove-Item Env:SYSTEM_ACCESSTOKEN -ErrorAction SilentlyContinue
+      displayName: "Remove Azure DevOps access token"
+    #
+    # Secret usage detection ...
+    - powershell: |
+        $patterns = @("ghp_","github_pat_","gho_","azdops_")
+        $hits = Get-ChildItem -Recurse -File | Select-String -Pattern $patterns
+        if ($hits) {
+            Write-Host "Long-lived token detected — pipeline must not use secrets"
+            exit 1
+        }
+      displayName: "Check for PAT usage"
+    #
     # Set-up build environment ...
     - task: UseDotNet@2
       displayName: 'Ensure CI uses correct sdk Version'
       inputs:
         packageType: 'sdk'
         version: '10.0.100'
         includePreviewVersions: false
+    #
+    # Clear NuGet cache ...
+    - powershell: |
+        $nuget = Join-Path $HOME ".nuget/packages"
+        if (Test-Path $nuget) {
+            Remove-Item -Recurse -Force $nuget
+        }
+      displayName: "Clear NuGet cache"
+    #
     # Restore dependencies ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet restore'
@@ -40,6 +65,8 @@ stages:
         projects: 'src/AdminAssistant.slnx'
         feedsToUse: 'config'
         nugetConfigPath: 'DevOps/NuGet.config'
+        arguments: '--locked-mode'
+    #
     # Sonar Cloud Prepare ...
 #    - task: SonarCloudPrepare@1
 #      inputs:
@@ -48,13 +75,15 @@ stages:
 #        scannerMode: 'MSBuild'
 #        projectKey: 'SimonGeering_AdminAssistant'
 #        projectName: 'AdminAssistant'
+    #
     # Build ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet build'
       inputs:
         command: 'build'
         projects: 'src/AdminAssistant.slnx'
         arguments: '--configuration Release --no-restore'
+    #
     # Run Unit Tests ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet test'
@@ -64,6 +93,16 @@ stages:
         arguments: '--configuration Release --no-build --collect "Code coverage" --settings "$(Build.SourcesDirectory)\src\AdminAssistant.Test\.runsettings" --filter "Category=Unit"'
         publishTestResults: true
         testRunTitle: 'Unit Tests'
+    #
+    # Dependency provenance report ...
+    - task: DotNetCoreCLI@2
+      displayName: "dotnet list package"
+      inputs:
+        command: 'custom'
+        custom: 'list'
+        arguments: 'package --include-transitive'
+        projects: 'src/AdminAssistant.slnx'
+    #
     # Sonar Cloud Analyze and Publish ...
 #    - task: SonarCloudAnalyze@1
 #    - task: SonarCloudPublish@1

DevOps/ManualFullBuild.yml

@@ -14,13 +14,38 @@ stages:
     pool: # https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops
       vmImage: 'windows-latest' # Need windows to get code coverage report - https://github.com/actions/virtual-environments/tree/master/images/win
     steps:
+    #
+    # Remove Azure DevOps access token ...
+    - powershell: |
+        Remove-Item Env:SYSTEM_ACCESSTOKEN -ErrorAction SilentlyContinue
+      displayName: "Remove Azure DevOps access token"
+    #
+    # Secret usage detection ...
+    - powershell: |
+        $patterns = @("ghp_","github_pat_","gho_","azdops_")
+        $hits = Get-ChildItem -Recurse -File | Select-String -Pattern $patterns
+        if ($hits) {
+            Write-Host "Long-lived token detected — pipeline must not use secrets"
+            exit 1
+        }
+      displayName: "Check for PAT usage"
+    #
     # Set-up build environment ...
     - task: UseDotNet@2
       displayName: 'Ensure CI uses correct sdk Version'
       inputs:
         packageType: 'sdk'
         version: '10.0.100'
         includePreviewVersions: false
+    #
+    # Clear NuGet cache ...
+    - powershell: |
+        $nuget = Join-Path $HOME ".nuget/packages"
+        if (Test-Path $nuget) {
+            Remove-Item -Recurse -Force $nuget
+        }
+      displayName: "Clear NuGet cache"
+    #
     # Restore dependencies ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet restore'
@@ -29,6 +54,8 @@ stages:
         projects: 'src/AdminAssistant.slnx'
         feedsToUse: 'config'
         nugetConfigPath: 'DevOps/NuGet.config'
+        arguments: '--locked-mode'
+    #
     # Sonar Cloud Prepare ...
 #    - task: SonarCloudPrepare@1
 #      inputs:
@@ -37,13 +64,15 @@ stages:
 #        scannerMode: 'MSBuild'
 #        projectKey: 'SimonGeering_AdminAssistant'
 #        projectName: 'AdminAssistant'
+    #
     # Build ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet build'
       inputs:
         command: 'build'
         projects: 'src/AdminAssistant.slnx'
         arguments: '--configuration Release --no-restore'
+    #
     # Run Unit Tests ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet test'
@@ -53,6 +82,16 @@ stages:
         arguments: '--configuration Release --no-build --collect "Code coverage" --settings "$(Build.SourcesDirectory)\src\AdminAssistant.Test\.runsettings" --filter "Category=Unit"'
         publishTestResults: true
         testRunTitle: 'Unit Tests'
+    #
+    # Dependency provenance report ...
+    - task: DotNetCoreCLI@2
+      displayName: "dotnet list package"
+      inputs:
+        command: 'custom'
+        custom: 'list'
+        arguments: 'package --include-transitive'
+        projects: 'src/AdminAssistant.slnx'
+    #
     # Sonar Cloud Analyze and Publish ...
 #    - task: SonarCloudAnalyze@1
 #    - task: SonarCloudPublish@1

DevOps/PullRequest.yml

@@ -24,13 +24,38 @@ stages:
     pool: # https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops
       vmImage: 'windows-latest' # Need windows to get code coverage report - https://github.com/actions/virtual-environments/tree/master/images/win
     steps:
+    #
+    # Remove Azure DevOps access token ...
+    - powershell: |
+        Remove-Item Env:SYSTEM_ACCESSTOKEN -ErrorAction SilentlyContinue
+      displayName: "Remove Azure DevOps access token"
+    #
+    # Secret usage detection ...
+    - powershell: |
+        $patterns = @("ghp_","github_pat_","gho_","azdops_")
+        $hits = Get-ChildItem -Recurse -File | Select-String -Pattern $patterns
+        if ($hits) {
+            Write-Host "Long-lived token detected — pipeline must not use secrets"
+            exit 1
+        }
+      displayName: "Check for PAT usage"
+    #
     # Set-up build environment ...
     - task: UseDotNet@2
       displayName: 'Ensure CI uses correct sdk Version'
       inputs:
         packageType: 'sdk'
         version: '10.0.100'
         includePreviewVersions: false
+    #
+    # Clear NuGet cache ...
+    - powershell: |
+        $nuget = Join-Path $HOME ".nuget/packages"
+        if (Test-Path $nuget) {
+            Remove-Item -Recurse -Force $nuget
+        }
+      displayName: "Clear NuGet cache"
+    #
     # Restore dependencies ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet restore'
@@ -39,6 +64,8 @@ stages:
         projects: 'src/AdminAssistant.slnx'
         feedsToUse: 'config'
         nugetConfigPath: 'DevOps/NuGet.config'
+        arguments: '--locked-mode'
+    #
     # Sonar Cloud Prepare ...
 #    - task: SonarCloudPrepare@1
 #      inputs:
@@ -47,13 +74,15 @@ stages:
 #        scannerMode: 'MSBuild'
 #        projectKey: 'SimonGeering_AdminAssistant'
 #        projectName: 'AdminAssistant'
+    #
     # Build ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet build'
       inputs:
         command: 'build'
         projects: 'src/AdminAssistant.slnx'
         arguments: '--configuration Release --no-restore'
+    #
     # Run Unit Tests ...
     - task: DotNetCoreCLI@2
       displayName: 'dotnet test'
@@ -63,6 +92,16 @@ stages:
         arguments: '--configuration Release --no-build --collect "Code coverage" --settings "$(Build.SourcesDirectory)\src\AdminAssistant.Test\.runsettings" --filter "Category=Unit"'
         publishTestResults: true
         testRunTitle: 'Unit Tests'
+    #
+    # Dependency provenance report ...
+    - task: DotNetCoreCLI@2
+      displayName: "dotnet list package"
+      inputs:
+        command: 'custom'
+        custom: 'list'
+        arguments: 'package --include-transitive'
+        projects: 'src/AdminAssistant.slnx'
+    #
     # Sonar Cloud Analyze and Publish ...
 #    - task: SonarCloudAnalyze@1
 #    - task: SonarCloudPublish@1

models/likec4/AdminAssistant.c4

@@ -0,0 +1,11 @@
+
+views {
+  view index {
+
+    include adminAssistant
+    include user
+    include admin
+
+    include adminAssistant.*
+  }
+}