-
Notifications
You must be signed in to change notification settings - Fork 565
Closed
Labels
kind/bugSomething isn't workingSomething isn't working
Description
Describe the bug
The current implementation of checking for locking dependencies in .net only checks if the command that is used is of type "dotnet.exe restore --locked-mode" or "msbuild.exe -t:restore -p:RestoreLockedMode=true", but ignores cases in which the maintainer opts for using RestoreLockedMode MSBuild property in their project file as such:
<PropertyGroup>
<!--- ... -->
<RestoreLockedMode>true</RestoreLockedMode>
<!--- ... -->
</PropertyGroup>
more info here
Reproduction steps
Steps to reproduce the behavior:
- when scanning for pinned dependency a repo which leverages RestoreLockedMode MSBuild property, the pinning should be detected.
- example: go run main.go --repo elastic/elasticsearch-net --checks Pinned-Dependencies --format json --show-details | jq
Expected behavior
.net repositories can leverage either restore behavior with lock file that is documented and the pinned dependency score should be similar.
For the example given above (elastic/elasticsearch-net), the score for pinned nugetCommand dependencies should be 3 out of 3.
Metadata
Metadata
Assignees
Labels
kind/bugSomething isn't workingSomething isn't working
Type
Projects
Status
Done