Include PackageGuard risk report and SBOM in pipeline by dennisdoomen · Pull Request #3324 · fluentassertions/fluentassertions

dennisdoomen · 2026-08-23T06:21:30Z

This update integrates the PackageGuard risk report and Software Bill of Materials (SBOM) generation into the pipeline, enhancing supply chain security and visibility.

IMPORTANT

If the PR touches the public API, the changes have been approved in a separate issue with the "api-approved" label.
The code complies with the Coding Guidelines for C#.
The changes are covered by unit tests which follow the Arrange-Act-Assert syntax and the naming conventions such as is used in these tests.
If the PR adds a feature or fixes a bug, please update the release notes with a functional description that explains what the change means to consumers of this library, which are published on the website.
If the PR changes the public API the changes needs to be included by running AcceptApiChanges.ps1 or AcceptApiChanges.sh.
If the PR affects the documentation, please include your changes in this pull request so the documentation will appear on the website.
- Please also run ./build.sh --target spellcheck or .\build.ps1 --target spellcheck before pushing and check the good outcome

CONTRIBUTOR LICENSE GRANT

By submitting this contribution, the contributor hereby irrevocably grants to the project owners and maintainers a perpetual, worldwide, royalty-free, irrevocable license to use, reproduce, modify, distribute, sublicense, and create derivative works of the contribution for any purpose and under any terms, including proprietary licensing.

The contributor waives any moral rights in the contribution to the extent permitted by law and agrees not to assert any claim of authorship or control over the contribution. The contributor represents that they are the sole author of the contribution and that it is provided free of any third-party claims.

The contributor understands and agrees that the maintainers may, at their sole discretion, use, license, or redistribute the contribution as part of any work and under any terms they choose, without further permission or attribution.

I have read the Contributor License Grant and accept the conditions
I'm interested in a free license for Fluent Assertions and will share my email address through sales@xceed.com

github-actions · 2026-08-23T06:29:54Z

Test Results

37 files ±0 37 suites ±0 2m 54s ⏱️ -1s
6 527 tests ±0 6 526 ✅ ±0 1 💤 ±0 0 ❌ ±0
40 508 runs ±0 40 502 ✅ ±0 6 💤 ±0 0 ❌ ±0

Results for commit 0ab2e20. ± Comparison against base commit 9f01be4.

This pull request removes 10 and adds 8 tests. Note that renamed tests count towards both.

FluentAssertions.Specs.Streams.StreamAssertionSpecs+HaveLength ‑ When_a_throwing_stream_should_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HaveLength ‑ When_a_throwing_stream_should_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HavePosition ‑ When_a_throwing_stream_should_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HavePosition ‑ When_a_throwing_stream_should_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHaveLength ‑ When_a_throwing_stream_should_not_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHaveLength ‑ When_a_throwing_stream_should_not_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHavePosition ‑ When_a_throwing_stream_should_not_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHavePosition ‑ When_a_throwing_stream_should_not_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetLengthExceptionMessage'.)
Object name: 'GetPositionExceptionMessage'.)

FluentAssertions.Specs.Streams.StreamAssertionSpecs+HaveLength ‑ When_a_throwing_stream_should_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetLengthExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HaveLength ‑ When_a_throwing_stream_should_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetLengthExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HavePosition ‑ When_a_throwing_stream_should_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetPositionExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+HavePosition ‑ When_a_throwing_stream_should_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetPositionExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHaveLength ‑ When_a_throwing_stream_should_not_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetLengthExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHaveLength ‑ When_a_throwing_stream_should_not_have_a_length_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetLengthExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHavePosition ‑ When_a_throwing_stream_should_not_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetPositionExceptionMessage'.)
FluentAssertions.Specs.Streams.StreamAssertionSpecs+NotHavePosition ‑ When_a_throwing_stream_should_not_have_a_position_it_should_fail(exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'GetPositionExceptionMessage'.)

♻️ This comment has been updated with latest results.

coveralls · 2026-08-23T06:30:51Z

Coverage Report for CI Build 33795236473

Coverage decreased (-0.01%) to 97.601%

Details

Coverage decreased (-0.01%) from the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	13530
Covered Lines:	13343
Line Coverage:	98.62%
Relevant Branches:	4394
Covered Branches:	4151
Branch Coverage:	94.47%
Branches in Coverage %:	Yes
Coverage Strength:	68481.2 hits per line

💛 - Coveralls

github-actions · 2026-09-03T12:41:56Z

Qodana for .NET

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Or via our issue tracker: https://jb.gg/qodana-issue
Or share your feedback: https://jb.gg/qodana-discussions

github-advanced-security · 2026-09-03T18:54:17Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

jnyrup · 2026-09-04T08:02:43Z

FYI: the cache file includes absolute paths like C:\Workspaces\fluentassertions\
Would it also make sense to have a non-binary output, such that it can be diffed as part of a PR?

PackageGuard uses a binary file on purpose, so it can be written and read fast enough. It was never meant to be updated or reviewed.

Updated [FluentAssertions](https://github.com/fluentassertions/fluentassertions) from 8.10.0 to 8.11.0. <details> <summary>Release notes</summary> _Sourced from [FluentAssertions's releases](https://github.com/fluentassertions/fluentassertions/releases)._ ## 8.11.0  ## What's Changed ### New features * Add `ThatSatisfy` for methods and properties by @jnyrup in fluentassertions/fluentassertions#3257 * Add BeSupersetOf, BeProperSubsetOf and BeProperSupersetOf collection assertions by @dennisdoomen in fluentassertions/fluentassertions#3271 * Add BeJsonSerializable round-trip assertions by @dennisdoomen in fluentassertions/fluentassertions#3293 * Support asserting on delegates that return a value task by @dennisdoomen in fluentassertions/fluentassertions#3301 ### Improvements * BeEmpty for IEnumerable<T> assertions now lists the first 10 items in… by @Xceed-DelvaJB in fluentassertions/fluentassertions#3198 * Clean-up the stack trace further by @jnyrup in fluentassertions/fluentassertions#3290 * Add HaveLineCount()/NotHaveLineCount() and ContainLine()/NotContainLine() to StringAssertions by @dennisdoomen in fluentassertions/fluentassertions#3297 * Add public ValueTypeAssertions<TSubject, TAssertions> base class by @dennisdoomen in fluentassertions/fluentassertions#3308 ### Fixes * Fix JsonNodeAssertions.HaveProperty/NotHaveProperty for properties with explicit null values by @dennisdoomen with @Copilot in fluentassertions/fluentassertions#3282 * Fix exception on `HaveProperty` on `JsonArray` by @jnyrup in fluentassertions/fluentassertions#3295 * Fix potential NREs when using AssertionScope (#3178) by @dennisdoomen in fluentassertions/fluentassertions#3323 ### Documentation * Fix typos by @jnyrup in fluentassertions/fluentassertions#3310 * Fix typo in exceptions page by @jpgomezv in fluentassertions/fluentassertions#3317 ### Others * Simplify GetMinValue/GetMaxValue by @jnyrup in fluentassertions/fluentassertions#3210 * Revert "Bump coverlet.collector from 6.0.4 to 8.0.1" by @jnyrup in fluentassertions/fluentassertions#3218 * Update nugets by @jnyrup in fluentassertions/fluentassertions#3226 * Convert the build pipeline from Nuke to Fallout by @dennisdoomen in fluentassertions/fluentassertions#3234 * Expose ShouldThrowOnCyclicReference on IEquivalencyValidationContext by @dennisdoomen in fluentassertions/fluentassertions#3242 * Prevent pwn-request RCE via the Qodana workflow by @dennisdoomen in fluentassertions/fluentassertions#3217 * Harden NPM install by @jnyrup in fluentassertions/fluentassertions#3258 * Pin System.Security.Cryptography.Xml to patched version to fix build restore failures by @dennisdoomen in fluentassertions/fluentassertions#3283 * Exclude dependabot PRs from auto-generated release notes by @dennisdoomen in fluentassertions/fluentassertions#3294 * Fix Qodana PR scans failing on pull requests from forks by @dennisdoomen in fluentassertions/fluentassertions#3299 * Cancel duplicate CI runs when a push triggers both push and pull_request events by @dennisdoomen in fluentassertions/fluentassertions#3298 * Fix Qodana-flagged possible multiple enumeration and unused auto-property warnings by @dennisdoomen in fluentassertions/fluentassertions#3300 * Document lessons learned from #3291 in agents.md by @dennisdoomen in fluentassertions/fluentassertions#3307 * Pin SDK to workaround 10.0.400 by @jnyrup in fluentassertions/fluentassertions#3309 * Stop the Build workflow from running twice on same-repo PRs by @dennisdoomen in fluentassertions/fluentassertions#3311 * Update NuGet.Frameworks to workaround Fallout issue by @jnyrup in fluentassertions/fluentassertions#3318 * Prefer Count > 0 over Any() by @jnyrup in fluentassertions/fluentassertions#3321 * Correct the arguments passed to `string.Format` on failure by @jnyrup in fluentassertions/fluentassertions#3325 * Migrate xunit v3 test projects off the VSTest pipeline by @dennisdoomen in fluentassertions/fluentassertions#3320 * Include PackageGuard risk report and SBOM in pipeline by @dennisdoomen in fluentassertions/fluentassertions#3324 ## New Contributors * @jpgomezv made their first contribution in fluentassertions/fluentassertions#3317 **Full Changelog**: fluentassertions/fluentassertions@8.10.0...8.11.0 Commits viewable in [compare view](fluentassertions/fluentassertions@8.10.0...8.11.0). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dennisdoomen requested a deployment to qodana-pr August 23, 2026 06:21 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from f567ca9 to 564a3ce Compare August 23, 2026 06:42

dennisdoomen requested a deployment to qodana-pr August 23, 2026 06:42 — with GitHub Actions Waiting

jnyrup reviewed Aug 23, 2026

View reviewed changes

Comment thread package-lock.json Outdated

dennisdoomen force-pushed the bump-package-guard branch from 564a3ce to 9345e8e Compare August 23, 2026 07:06

dennisdoomen requested a deployment to qodana-pr August 23, 2026 07:06 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from 9345e8e to 269ccce Compare August 23, 2026 09:09

dennisdoomen requested a deployment to qodana-pr August 23, 2026 09:09 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from 269ccce to 1ca47c0 Compare August 23, 2026 09:21

dennisdoomen requested a deployment to qodana-pr August 23, 2026 09:21 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from 1ca47c0 to df1183e Compare September 1, 2026 08:38

dennisdoomen requested a deployment to qodana-pr September 1, 2026 08:38 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from df1183e to 8fd4348 Compare September 3, 2026 12:23

dennisdoomen temporarily deployed to qodana-pr September 3, 2026 12:23 — with GitHub Actions Inactive

dennisdoomen force-pushed the bump-package-guard branch from 8fd4348 to 05b31fd Compare September 3, 2026 12:39

dennisdoomen requested a deployment to qodana-pr September 3, 2026 12:39 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from 05b31fd to ff1da7d Compare September 3, 2026 17:40

dennisdoomen requested a deployment to qodana-pr September 3, 2026 17:40 — with GitHub Actions Waiting

dennisdoomen force-pushed the bump-package-guard branch from ff1da7d to a063dd3 Compare September 3, 2026 18:13

dennisdoomen requested a deployment to qodana-pr September 3, 2026 18:13 — with GitHub Actions Waiting

Include the PackageGuard risk report and SBOM in the pipeline

0ab2e20

dennisdoomen force-pushed the bump-package-guard branch from a063dd3 to 0ab2e20 Compare September 3, 2026 19:14

dennisdoomen temporarily deployed to qodana-pr September 3, 2026 19:14 — with GitHub Actions Inactive

dennisdoomen requested a review from jnyrup September 4, 2026 06:18

jnyrup approved these changes Sep 4, 2026

View reviewed changes

dennisdoomen merged commit feedb49 into main Sep 4, 2026
14 of 15 checks passed

Navigation Menu

Uh oh!

Include PackageGuard risk report and SBOM in pipeline - #3324

Include PackageGuard risk report and SBOM in pipeline#3324
dennisdoomen merged 1 commit into
mainfrom
bump-package-guard

dennisdoomen commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

coveralls commented Aug 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Sep 3, 2026

Uh oh!

jnyrup Sep 4, 2026

Uh oh!

dennisdoomen Sep 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

dennisdoomen commented Aug 23, 2026

IMPORTANT

CONTRIBUTOR LICENSE GRANT

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

coveralls commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 33795236473

Coverage decreased (-0.01%) to 97.601%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Qodana for .NET

Uh oh!

github-advanced-security AI commented Sep 3, 2026

What Enabling Code Scanning Means:

Uh oh!

jnyrup Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

dennisdoomen Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Aug 23, 2026 •

edited

Loading

coveralls commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Sep 3, 2026 •

edited

Loading