The policy says Trip Mode keeps a copy on your device #357

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	build-test-scan:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-dotnet@v4
	with:
	dotnet-version: '9.0.x'

	# The MAUI app (FinApp.App.Maui) needs mobile workloads the runner doesn't have, and it isn't
	# deployed from CI. Build/test everything else via a solution filter so CI actually validates the
	# server, web and shared UI. (The MAUI app is built locally with the workloads when needed.)
	- name: Restore
	run: dotnet restore FinApp.NoMaui.slnf

	- name: Build
	run: dotnet build FinApp.NoMaui.slnf --configuration Release --no-restore

	- name: Test
	run: dotnet test FinApp.NoMaui.slnf --configuration Release --no-build

	# Fail the build if any (including transitive) package has a known vulnerability.
	- name: Vulnerable package scan
	run: \|
	set -euo pipefail
	dotnet list FinApp.NoMaui.slnf package --vulnerable --include-transitive 2>&1 \| tee vuln.txt
	if grep -q -E "Critical\|High\|Moderate\|Low" vuln.txt; then
	echo "::error::Vulnerable NuGet packages found (see log above)."
	exit 1
	fi
	echo "No vulnerable packages."

Navigation Menu