Secrets and Dependencies

using System.Text;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

// Development only, and masked by allow-list: a value prints only when its
// path is known to be harmless. A deny-list of words misses Smtp:Pass,
// Payments:Stripe:Sk or a URL with credentials under Database:Url.
if (app.Environment.IsDevelopment())
{
    string[] safePrefixes = ["Logging", "AllowedHosts", "Urls", "Kestrel:Endpoints", "Orders:PageSize"];
    var view = builder.Configuration.GetDebugView(context =>
        safePrefixes.Any(prefix => context.Path.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
            ? context.Value ?? ""
            : "***");
    app.Logger.LogInformation("Effective configuration:{NewLine}{Configuration}", Environment.NewLine, view);
}

app.MapGet("/", () => "ok");
app.Run();

public sealed record PaymentGatewayOptions
{
    public required Uri BaseAddress { get; init; }
    public required string MerchantId { get; init; }
    public required string ApiKey { get; init; }

    // Replace the generated member list so ToString and logging never print the key.
    private bool PrintMembers(StringBuilder builder)
    {
        builder.Append($"BaseAddress = {BaseAddress}, MerchantId = {MerchantId}, ApiKey = ***");
        return true;
    }
}

<Project>
  <PropertyGroup>
    <!-- Audit direct and transitive packages on every restore. -->
    <NuGetAudit>true</NuGetAudit>
    <NuGetAuditMode>all</NuGetAuditMode>
    <NuGetAuditLevel>moderate</NuGetAuditLevel>

    <!-- Advisories stay warnings in pull-request and local builds. -->
    <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>

    <!-- packages.lock.json per project; CI restores with locked mode. -->
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
    <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode>
  </PropertyGroup>

  <!-- High (NU1903) and critical (NU1904) advisories fail the scheduled audit and
       main-branch builds, which pass -p:StrictAudit=true. -->
  <PropertyGroup Condition="'$(StrictAudit)' == 'true'">
    <WarningsAsErrors>$(WarningsAsErrors);NU1903;NU1904</WarningsAsErrors>
  </PropertyGroup>
</Project>

name: supply-chain
on:
  push:
    branches: [main]
  schedule:
    - cron: "0 6 * * 3"   # weekly, so new advisories surface without a code change

jobs:
  audit:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.x

      # Only scheduled and main runs reach this job, so high and critical advisories fail here.
      - name: Restore exactly what the lock files say
        run: dotnet restore --locked-mode -p:StrictAudit=true

      # A report for the log, not a gate: it exits 0 even when it finds something.
      - name: Report vulnerable packages
        run: dotnet list package --vulnerable --include-transitive

      - name: Publish and generate an SBOM
        run: |
          dotnet publish src/Orders.Api -o out
          dotnet tool install --global Microsoft.Sbom.DotNetTool
          sbom-tool generate -b out -bc src/Orders.Api -pn orders-api -pv ${{ github.sha }} -ps "Example Shop" -nsb https://sbom.example.com

      - name: Build and scan the image
        run: |
          docker build -t orders-api:${{ github.sha }} .
          trivy image --exit-code 1 --severity HIGH,CRITICAL orders-api:${{ github.sha }}