#!/usr/bin/env bash
# Fail if any NuGet package (direct or transitive) has a known advisory — the .NET half of
# `npm audit --omit=dev`, which only ever covered the frontend (RB-14/BIO-016).
#
# `dotnet list package --vulnerable` is a REPORTING command: it prints the advisory table and
# still exits 0. Verified against a deliberately vulnerable project — System.Net.Http 4.3.0,
# GHSA-7jgj-8wvc-jh57, severity High, exit code 0. So `- run: dotnet list package --vulnerable`
# on its own is a gate that enforces nothing, which is worse than no gate: it reads like
# coverage in the workflow file. Matching its output is what makes it block.
#
# Shared by .github/workflows/ci.yml and scripts/ci-local.sh so the two cannot drift.
set -euo pipefail
cd "$(dirname "$0")/.."

report=$(dotnet list backend/BigRegister.slnx package --vulnerable --include-transitive)
echo "$report"

# The exact sentence `dotnet list` prints per project when it finds something; the clean case
# prints "has no vulnerable packages given the current sources" instead.
if grep -q "has the following vulnerable packages" <<<"$report"; then
  echo
  echo "✖ Vulnerable NuGet packages found (table above)." >&2
  echo "  Transitive hits can be pinned with a direct PackageReference to a patched version." >&2
  exit 1
fi