Add PackageGuard to the build pipeline

.github/workflows/build.yml

@@ -31,6 +31,7 @@ jobs:
       run: ./build.ps1
       env:
         NuGetApiKey: ${{ secrets.NUGETAPIKEY }}
+        GitHubApiKey: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Check for 'lcov.info' existence
       id: check_files

.nuke/build.schema.json

@@ -32,7 +32,8 @@
         "Pack",
         "Push",
         "Restore",
-        "RunTests"
+        "RunTests",
+        "ScanPackages"
       ]
     },
     "Verbosity": {
@@ -114,6 +115,11 @@
             "Release"
           ]
         },
+        "GitHubApiKey": {
+          "type": "string",
+          "description": "The key to use for scanning packages on GitHub",
+          "default": "Secrets must be entered via 'nuke :secrets [profile]'"
+        },
         "NuGetApiKey": {
           "type": "string",
           "description": "The key to push to Nuget",

.packageguard/config.json

@@ -0,0 +1,16 @@
+{
+    "Settings": {
+        "Allow": {
+            "Licenses": [
+                "MIT",
+                "Apache-2.0",
+                "BSD-3-Clause",
+                "BSD-2-Clause"
+            ],
+            "Packages": [
+                "FluentAssertions",
+                "NETStandard.Library"
+            ]
+        }
+    }
+}

Build/Build.cs

@@ -36,6 +36,10 @@ class Build : NukeBuild
     [Secret]
     readonly string NuGetApiKey;
 
+    [Parameter("The key to use for scanning packages on GitHub")]
+    [Secret]
+    readonly string GitHubApiKey;
+
     [Solution]
     readonly Solution Solution;
 
@@ -48,6 +52,9 @@ class Build : NukeBuild
 
     string SemVer;
 
+    [NuGetPackage("PackageGuard", "PackageGuard.dll")]
+    Tool PackageGuard;
+
     Target CalculateNugetVersion => _ => _
         .Executes(() =>
         {
@@ -144,10 +151,19 @@ class Build : NukeBuild
             Information($"Code coverage report: \x1b]8;;file://{link.Replace('\\', '/')}\x1b\\{link}\x1b]8;;\x1b\\");
         });
 
+    Target ScanPackages => _ => _
+        .DependsOn(Compile)
+        .Executes(() =>
+        {
+            Environment.SetEnvironmentVariable("GITHUB_API_KEY", GitHubApiKey);
+            PackageGuard($"--config-path={RootDirectory / ".packageguard" / "config.json"} --use-caching {RootDirectory}");
+        });
+
     Target Pack => _ => _
         .DependsOn(CalculateNugetVersion)
         .DependsOn(ApiChecks)
         .DependsOn(CodeCoverage)
+        .DependsOn(ScanPackages)
         .Executes(() =>
         {
             ReportSummary(s => s

Build/_build.csproj

@@ -16,6 +16,7 @@
     <PackageReference Include="Nuke.Components" Version="9.0.4" />
     <PackageDownload Include="ReportGenerator" Version="[5.2.0]" />
     <PackageDownload Include="GitVersion.Tool" Version="[6.0.2]" />
+    <PackageDownload Include="PackageGuard" Version="[1.4.1]" />
   </ItemGroup>
 
 </Project>