Release/examples

.editorconfig

@@ -14,3 +14,7 @@ trim_trailing_whitespace = true
 # Markdown
 [*.md]
 trim_trailing_whitespace = false
+
+[/.githooks/**]
+end_of_line = lf
+insert_final_newline = false

.gitattributes

@@ -1 +1,4 @@
 * text=auto eol=crlf
+
+# Force githooks to be LF
+.githooks/* eol=lf

.githooks/commit-msg

@@ -0,0 +1,3 @@
+#!/bin/sh
+COMMIT_MSG_FILE=$1
+pwsh -ExecutionPolicy RemoteSigned -File 'scripts/githooks/commit-msg-check.ps1' "$COMMIT_MSG_FILE"

.githooks/pre-commit

@@ -0,0 +1,2 @@
+#!/bin/sh
+pwsh -ExecutionPolicy RemoteSigned -File 'scripts/githooks/pre-commit-file-list.ps1'

.github/workflows/lab00-hello-github-actions.yml

@@ -1,11 +1,40 @@
+# Name of the workflow
 name: Lab00 Hello GitHub Actions
+# How the workflow run is named in GitHub
 run-name: Lab00 - ${{ github.actor }} is testing out GitHub Actions 🚀
 permissions: read-all
+# Set your preferences for the script
+defaults:
+  run:
+    shell: pwsh
 on:
+  # Make it possible to other workflows to call this
+  workflow_call:
+  # Make it possible to manually run this workflow
   workflow_dispatch:
+# The actual jobs
 jobs:
-  example-job:
+  # Job named Hello-job that runs on ubuntu-latest virtual machine
+  Hello-Job:
     runs-on: ubuntu-latest
+    # Steps that are being run to complete the job
     steps:
       - name: Run hello world
         run: echo "🎉 Step of the job is running on ${{ runner.os }}!"
+  # Job named Build-Job that builds the example applications
+  Build-Job:
+    runs-on: ubuntu-latest
+    # Steps to actually build the application
+    steps:
+      # Check out the git repository
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Ensure proper version of .NET
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: "8.0.x"
+      - name: Install .NET dependencies
+        run: dotnet restore
+      - name: Build application
+        run: dotnet build

.github/workflows/lab01-variables-and-secrets.yml

@@ -4,8 +4,28 @@ permissions: read-all
 on:
   workflow_dispatch:
 jobs:
-  example-job:
+  demo:
     runs-on: ubuntu-latest
+    # Define a global environment variable for this job
+    env:
+      MY_VARIABLE: "Hello from the environment variable!"
+
     steps:
-      - name: Run hello world
-        run: echo "🎉 Step of the job is running on ${{ runner.os }}!"
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Echo Variable and Secret
+        env:
+          # For this to work, you need to create a repository secret on GitHub.com
+          # 1. Go to your repository on GitHub.com
+          # 2.  Navigate to Settings > Secrets and variables > Actions
+          # 3. Click "New repository secret"
+          # 4. Name: DEMO_SECRET
+          # 5. Secret: your-secret-value
+
+          # Assign the repository secret to an environment variable for this step
+          DEMO_SECRET: ${{ secrets.DEMO_SECRET }}
+        run: |
+          echo "Environment Variable: $MY_VARIABLE"
+          echo "Secret Value: $DEMO_SECRET"
+          echo "Note how the secret value is not printed to the log"

.github/workflows/lab02-reuse-and-artifacts.yml

@@ -4,8 +4,25 @@ permissions: read-all
 on:
   workflow_dispatch:
 jobs:
-  example-job:
+  run-composite:
     runs-on: ubuntu-latest
     steps:
-      - name: Run hello world
-        run: echo "🎉 Step of the job is running on ${{ runner.os }}!"
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Run the template with parameters
+      - id: dotnet-build
+        uses: ./.github/actions/build-dotnet-app
+        with:
+          folder-path: "apps/uptodate-app"
+      # Publish output folder as an artifact
+      - name: Publish Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: dotnet-app
+          path: ${{ steps.dotnet-build.outputs.output-directory-path }}
+
+  greeter:
+    uses: ./.github/workflows/greeter.yml
+    with:
+      person-name: "${{ github.actor }}"

.github/workflows/lab10-software-composition-analysis.yml

@@ -1,11 +1,136 @@
+# Name of the workflow
 name: Lab10 SCA
+# How the workflow run is named in GitHub
 run-name: Lab10 - ${{ github.actor }} is finding vulns🚀
 permissions: read-all
+# Set your preferences for the script
+defaults:
+  run:
+    shell: pwsh
 on:
+  # Make it possible to other workflows to call this
+  workflow_call:
+  # Make it possible to manually run this workflow
   workflow_dispatch:
+  # Dependency review is meant to work with prs
+  pull_request:
 jobs:
-  example-job:
+  Test-Vulnerabilities-With-Dependency-Check:
+    name: OWASP Dependency Check
     runs-on: ubuntu-latest
+    # Steps to actually build the application
     steps:
-      - name: Run hello world
-        run: echo "🎉 Step of the job is running on ${{ runner.os }}!"
+      # Check out the git repository
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Ensure proper version of .NET
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: "8.0.x"
+      # Ensure this to make sure to actually test against real deal
+      - name: Install .NET dependencies
+        run: dotnet restore
+      # Sometimes (even when considered as a bad practice) part of the dependencies are fetched during build, so better to build first
+      - name: Build application
+        run: dotnet build
+      # Run OWASP Dependency check
+      - name: Dependency Check
+        uses: dependency-check/Dependency-Check_Action@main
+        id: Depcheck
+        with:
+          project: "ci-security"
+          path: "."
+          format: "HTML"
+          out: "reports" # this is the default, no need to specify unless you wish to override it
+          args: >
+            --failOnCVSS 7
+            --enableRetired
+      # Use always() to ensure that even if the above fails on threshold the results are uploaded
+      - name: Upload Test results
+        uses: actions/upload-artifact@master
+        if: ${{ always() }}
+        with:
+          name: OWASP Dependency Check report
+          path: ${{github.workspace}}/reports
+
+  Test-Vulnerabilities-Natively:
+    name: "dotnet native check"
+    runs-on: ubuntu-latest
+    # Steps to actually build the application
+    steps:
+      # Check out the git repository
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Ensure proper version of .NET
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: "8.0.x"
+      # Ensure this to make sure to actually test against real deal
+      - name: Install .NET dependencies
+        run: dotnet restore
+      # Sometimes (even when considered as a bad practice) part of the dependencies are fetched during build, so better to build first
+      - name: Build application
+        run: dotnet build
+      - name: Use dotnet tools to test vulns and to fail the job
+        run: | # Use | to tell github actions that this is multiline operation
+          $vulnCount = .\scripts\dotnetaudit.ps1
+          Write-Host "Run dotnetaudit.ps1 with total of $vulnCount vulnerabilities"
+          Write-Host "---OUTPUT---"
+          Get-content vulnerable.out
+          if ($vulnCount -gt 0) {
+            # Set proper error message
+            echo "::error file=scripts/dotnetaudit.ps1,line=19,col=1,endColumn=21,title=Vulnerabilities above zero::Vulnerabilities found for total of $vulnCount"
+            # Error message does not fail the job, use exit 1 to actually make it fail
+            exit 1
+          }
+
+  Test-Vulnerabilities-With-RetireJS:
+    name: "RetireJS check"
+    runs-on: ubuntu-latest
+    # Steps to actually build the application
+    steps:
+      # Check out the git repository
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Ensure proper version of .NET
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: "8.0.x"
+      # Ensure this to make sure to actually test against real deal
+      - name: Install .NET dependencies
+        run: dotnet restore
+      # Sometimes (even when considered as a bad practice) part of the dependencies are fetched during build, so better to build first
+      - name: Build application
+        run: dotnet build
+      # Setup Node
+      - name: Use Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "23.x"
+      - name: Setup RetireJS and create folder for reports
+        run: |
+          npm install -g retire
+          mkdir reports
+      - name: Run RetireJS
+        run: retire --path . --outputformat text --outputpath ./reports/output.txt --severity low --exitwith 1 --deep
+      - name: Upload Test results
+        uses: actions/upload-artifact@master
+        if: ${{ always() }}
+        with:
+          name: RetireJS report
+          path: ${{github.workspace}}/reports
+
+  Test-with-dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@v4
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: low
+          #allow-licenses: MIT
+          #deny-licenses: AGPL

.github/workflows/lab11-create-package-lock.yml

@@ -1,11 +1,44 @@
+# Name of the workflow
 name: Lab11 Package Locks
+# How the workflow run is named in GitHub
 run-name: Lab11 - ${{ github.actor }} is locking packages 🔒
 permissions: read-all
+# Set your preferences for the script
+defaults:
+  run:
+    shell: pwsh
 on:
+  # Make it possible to other workflows to call this
+  workflow_call:
+  # Make it possible to manually run this workflow
   workflow_dispatch:
+# The actual jobs
 jobs:
-  example-job:
+  Create-Package-Locks:
+    name: "Create Package Lock"
     runs-on: ubuntu-latest
+    # Steps to actually build the application
     steps:
-      - name: Run hello world
-        run: echo "🎉 Step of the job is running on ${{ runner.os }}!"
+      # Check out the git repository
+      - name: Checkout
+        uses: actions/checkout@v4
+      # Ensure proper version of .NET
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: "8.0.x"
+      # Generate lock file
+      - name: Generate lock file
+        run: dotnet restore --force --use-lock-file
+      # Test restore with locked mode
+      - name: Restore with locked mode
+        run: dotnet restore --locked-mode
+      # Dotnet by default restores implicitly if missing something. It is unneccessary and unwanted in CI-situations.
+      - name: Build application
+        run: dotnet build --no-restore
+      - name: Print the package locks
+        run: |
+          get-childitem *.lock.json -Recurse | % {
+            Write-Host $_
+            Get-Content $_
+          }