Harden repository for v1.3.0-beta.1 #18

	name: Dependency security review

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: dependency-security-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	env:
	DOTNET_NOLOGO: true
	DOTNET_CLI_TELEMETRY_OPTOUT: true

	jobs:
	dependency-security:
	name: Audit dependency changes
	runs-on: ubuntu-latest
	timeout-minutes: 12

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Setup .NET
	uses: actions/setup-dotnet@v4
	with:
	dotnet-version: 8.0.x

	- name: Run NuGet high/critical vulnerability audit
	id: nuget-audit
	continue-on-error: true
	shell: bash
	run: \|
	set -o pipefail
	dotnet restore ./ProcessBusSuite.sln \
	-p:AuditPipeline=true \
	-p:EnableWindowsTargeting=true \
	2>&1 \| tee nuget-audit.log

	- name: Upload NuGet audit evidence
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: nuget-audit-${{ github.run_id }}
	path: nuget-audit.log
	if-no-files-found: error
	retention-days: 14

	- name: Enforce NuGet audit result
	if: steps.nuget-audit.outcome != 'success'
	shell: bash
	run: \|
	echo "NuGet high/critical vulnerability audit failed. See the uploaded nuget-audit artifact."
	exit 1

	- name: GitHub dependency delta review
	uses: actions/dependency-review-action@v5
	with:
	fail-on-severity: high
	retry-on-snapshot-warnings: true
	retry-on-snapshot-warnings-timeout: 180

Provide feedback