Repository navigation
Fix dependency auditing failures in documentation CI - #473
Merged
Merged
Conversation
Build the pinned Npgsql and EFCore.PG snapshots for API documentation without failing on newly published dependency advisories. Keep this setting scoped to the documentation build job, including docfx metadata restore. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cf2cf862-ca6f-4cf0-8ea4-467b158df3b5
There was a problem hiding this comment.
🟢 Approval recommended
The narrowly scoped change addresses the reported audit failures without changing dependencies or other build checks.
0 open findings
What changed in this PR
Scopes the dependency-audit workaround to the documentation build job so pinned source snapshots can build for API documentation.
Changes:
- Sets job-level
NuGetAudit=falsefor source builds and docfx restores. - Leaves dependencies, submodule pins, and other warning/error handling unchanged.
| File | Description |
|---|---|
.github/workflows/build-documentation.yml |
Disables dependency auditing only for the documentation build job. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Set
NuGetAudit=falseonly on the documentation build job. This covers the two source builds and docfx's metadata restores without changing either source submodule, provider dependencies, or warning/error handling.Root cause
The failed documentation run stops during Build Npgsql, before EFCore.PG or docfx:
Microsoft.Build.Tasks.Git8.0.0, pulled in byMicrosoft.SourceLink.GitHub, triggers NU1902 promoted to an error for GHSA-23fw-v26w-5fgq.System.Security.Cryptography.PkcsNU1902/NU1903 messages are benchmark-project warnings, not the fatal error.Microsoft.Build.Tasks.Git10.0.200, so a Npgsql-only workaround would leave the workflow broken.These builds extract API documentation from fixed source snapshots; they do not ship the provider packages. The tradeoff is that this docs job no longer reports dependency vulnerability findings. It does not remediate those dependencies; their audit/remediation belongs in the source repositories. All other build errors and docfx warnings-as-errors remain enabled.
Validation
dotnet build -c Releasecommands succeed with 0 warnings and 0 errors.docfx --warningsAsErrorswith 0 warnings and 0 errors, including metadata extraction for both repositories.NuGet.config.Separate from #472; no changes to that PR.