Component Governance errors tracking

[ellahathaway]

NuGet problems

⚠️ NuGet security analysis - Potential upstreams in a feed

• [x] nuget-client/Nuget.Config
  • WONT FIX
  • Silence with pipeline variables as specified below

⚠️ CFS0012 - NuGet.config file(s) are missing a element

• [x] source-build-externals/src/spectre-console/NuGet.Config https://github.com/dotnet/installer/pull/18260

⚠️ Multiple Feeds Declared

• [x] source-build-externals/src/xunit/NuGet.Config https://github.com/dotnet/installer/pull/18260

⚠️ MyGet Feed(s) Declared

• [x] source-build-externals/src/xunit/NuGet.Config https://github.com/dotnet/installer/pull/18260

⚠️ CFS0013 - Package source has value that is not an Azure Artifacts feed

Usually, these usually have nuget.org inside.

• [x] format/tests/projects/for_analyzer_formatter/analyzer_project/NuGet.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] nuget-client/test/EndToEnd/NuGet.Config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] nuget-client/test/NuGet.Tests.Apex/NuGet.OptProf/Assets/PackageReferenceSdk/nuget.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] sdk/template_feed/Microsoft.DotNet.Common.ItemTemplates/content/Nuget/nuget.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] sdk/test/dotnet-new.Tests/Approvals/AllCommonItemsCreate.-o#NuGet-Config#-n#item.Linux.verified/NuGet-Config/nuget.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] sdk/test/dotnet-new.Tests/Approvals/AllCommonItemsCreate.-o#NuGet-Config#-n#item.OSX.verified/NuGet-Config/nuget.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] sdk/test/dotnet-new.Tests/Approvals/AllCommonItemsCreate.-o#NuGet-Config#-n#item.Windows.verified/NuGet-Config/nuget.config
  • WONT FIX
  • Silence with pipeline variables as specified below
• [x] source-build-externals/src/spectre-console/NuGet.Config https://github.com/dotnet/installer/pull/18260
• [x] source-build-externals/src/xunit/NuGet.Config https://github.com/dotnet/installer/pull/18260

NPM problems

⚠️ CFS0001 - Node.js project(s) are missing feed configuration

Missing .npmrc files

• [x] aspire/tests/testproject/nodeapp/package.json
  • https://github.com/dotnet/installer/pull/18258#event-11502121919
  • https://github.com/dotnet/aspire/issues/1670

Kubernetes Problems

⚠️ Deployment File Analysis - Discovered a reference to an image from an unapproved registry that violates the security policies and standards for containers within Microsoft.

• [x] Reference to image 'localhost:5001/api-gateway' on line 19 of src/aspire/samples/eShopLite/Deployment/api-gateway.yml.
  • Not causing errors but is a warning affecting build status (yellow)
  • https://github.com/dotnet/aspire/issues/1419
• [x] Reference to image 'localhost:5001/basket-service' on line 19 of src/aspire/samples/eShopLite/Deployment/basket-service.yml.
  • Not causing errors but is a warning affecting build status (yellow)
  • https://github.com/dotnet/aspire/issues/1419
• [x] Reference to image 'localhost:5001/catalog-service' on line 19 of src/aspire/samples/eShopLite/Deployment/catalog-service.yml.
  • Not causing errors but is a warning affecting build status (yellow)
  • https://github.com/dotnet/aspire/issues/1419
• [x] Reference to image 'localhost:5001/my-frontend' on line 19 of src/aspire/samples/eShopLite/Deployment/my-frontend.yml.
  • Not causing errors but is a warning affecting build status (yellow)
  • https://github.com/dotnet/aspire/issues/1419

[dotnet-issue-labeler[bot]]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[ellahathaway]

Ensure that the following variables & values are present in the pipeline:

• cfsNPMWarnLevel=none
• cfsNugetWarnLevel=none
• myGetWarnLevel=none
• nugetMultiFeedWarnLevel=none
• NuGetSecurityAnalysisWarningLevel=none

Errors can also be disabled (as appropriate) via Component Governance.

[ellahathaway]

Since these are no longer causing errors in the build, I am closing this issue.