search

github / ossar-action

Run multiple open source security static analysis tools without the added complexity with OSSAR (Open Source Static Analysis Runner).
MIT License
94 stars 27 forks source link

Use latest channel-version of dotnet #9

Closed litetex closed 4 years ago

litetex commented 4 years ago

Use latest channel-version of dotnet instead of a fixed one.

actions/setup-dotnet allows you to use the latest patch-version, so why not use it?

At the moment the hardcoded version 3.1.201 is used

litetex commented 4 years ago

Note: The latest channel-version is also not used at the "Get started with code scanning" page (of a repo):

grafik grafik

davidknise commented 4 years ago

so why not use it?

We compile the private core with dotnet version 3.1.201, so that's what we recommend and default the configuration to.

It's not hardcoded in our business logic, which is: 1) dotnet as an installer for the private core 2) In the guardian launcher file that gets called to run the application,

You are welcome to configure your setup-dotnet task to use the latest version or version you already have in use on your project. If there are issues with the version of dotnet that is installed, actionable information about that need should be bubbled up through error messages.

I don't think I will update our defaults and documentation to use the latest, because I do not want to give a false impression that we have properly tested each version of dotnet, but I will certainly add how to configure latest to the documentation.

davidknise commented 4 years ago

So, for remote runners, dotnet is already installed, meaning the setup-dotnet task is only required for desktop runners that do not have a compatible version of dotnet installed on their PATH.

I've updated the two sample workflows and the readme with this information.

I will reach out to our partners on the GitHub code scanning side to update the template on the Code scanning alerts tab.