Bump SSH.NET from 2025.1.0 to 2026.0.0 #876
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: .NET Build | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| workflow_dispatch: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages | |
| steps: | |
| # checkout code from repository | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # install the latest .NET SDK on the local worker | |
| - name: Install .NET SDK | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: 11.0.100-preview.7.26381.103 | |
| # restore nuget packages | |
| - name: Restore | |
| run: dotnet restore | |
| # build the solution (Release) | |
| - name: Build (Release) | |
| run: dotnet build -c Release --no-restore -nowarn:CS1591 | |
| # Pack the libraries and tools | |
| - name: NuGet Pack | |
| env: | |
| DISABLE_NATIVE_PACKAGE: true | |
| run: dotnet pack -c Release --no-restore --no-build --output Redist -p:ContinuousIntegrationBuild=true | |
| # Capture the build packages | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: NuGet Packages | |
| path: | | |
| Redist/*.nupkg | |
| Redist/*.snupkg | |
| if-no-files-found: error | |
| # In case of error, we want to capture any generated file for troubleshooting | |
| - name: Capture generated source files | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: Generated Source Files | |
| path: '**/*.g.cs' | |
| # Submit the RESOLVED dependency graph (with transitives) to GitHub, so that Dependabot alerts | |
| # track what this repository actually restores with its pinned .NET SDK. GitHub's managed | |
| # "automatic dependency submission" resolves with its own toolchain, which cannot restore this | |
| # solution (preview SDK pinned in global.json), so its snapshots go stale and alerts get stuck | |
| # on versions that no current restore produces. | |
| dependency-graph: | |
| # only the default branch feeds the dependency graph and Dependabot | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master' | |
| runs-on: ubuntu-latest | |
| # the dependency submission API requires write access to repository contents | |
| permissions: | |
| contents: write | |
| # note: unlike the build job, the NuGet cache stays at its default location (~/.nuget), OUTSIDE | |
| # the workspace, so that component-detection does not scan the cached packages themselves | |
| steps: | |
| # checkout code from repository | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # install the same .NET SDK used by the build (matches global.json) | |
| - name: Install .NET SDK | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: 11.0.100-preview.7.26381.103 | |
| # restore so that component-detection can read the resolved graphs (obj/project.assets.json). | |
| # RIDs are cleared for this restore: with RuntimeIdentifiers active, the SDK records runtime-pack | |
| # downloads (Microsoft.NETCore.App.Runtime.<rid>, ...) in the assets, and Dependabot then alerts | |
| # on THE SDK'S bundled pack versions - which a preview SDK chronically pins one servicing patch | |
| # behind. Nothing in this repository ships a runtime (the tools are framework-dependent), so the | |
| # packs do not belong in the reported dependency graph. Package references are unaffected. | |
| - name: Restore (without runtime packs) | |
| run: dotnet restore "-p:RuntimeIdentifiers=" "-p:RuntimeIdentifier=" | |
| # run microsoft/component-detection and submit the snapshot to the dependency graph | |
| - name: Submit dependency snapshot | |
| uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4 |