action.yml

name: 'SecurityCodeScan'
description: 'Security Code Scan action to add NuGet packages and set up projects'
branding:
  icon: 'check-circle'
  color: 'purple'
runs:
  using: "composite"
  steps:
    - name: Set up Security-Code-Scan
      shell: pwsh
      run: |
        $ErrorActionPreference = "Stop";
        [string]$SecurityCodeScanPackageName = 'SecurityCodeScan.VS2019'
        [string]$SecurityCodeScanPackagePath = $null

        # get the latest security code scan package version
        $scs2019packages = Invoke-RestMethod -Uri "https://api-v2v3search-0.nuget.org/query?q=packageid:SecurityCodeScan.VS2019&top=true"
        $SecurityCodeScanPackageVersion = ($scs2019packages.data.versions | Sort-Object  -Property version -Descending | Select-Object -First 1).version

        foreach ($projectFile in Get-ChildItem -Path . -Include *.csproj, *.vbproj -File -Recurse -Force) {

          $project = [xml](Get-Content -LiteralPath $projectFile.FullName -Raw)
          $propertyGroup = $project.CreateElement('PropertyGroup', $project.Project.NamespaceURI)

          # redirect all warnings to analysis.sarif file
          $errorLog = $project.CreateElement('ErrorLog', $project.Project.NamespaceURI)
          $errorLog.InnerText = 'analysis.sarif'
          $propertyGroup.AppendChild($errorLog) | Out-Null

          # add AdditionalFileItemNames to enable scanning of web.config
          # should we check if the AdditionalFileItemNames already exists?
          $additionalFileItemNames = $project.CreateElement("AdditionalFileItemNames", $project.Project.NamespaceURI)
          $additionalFileItemNames.InnerText = '$(AdditionalFileItemNames);Content'
          $propertyGroup.AppendChild($additionalFileItemNames) | Out-Null

          $project.Project.AppendChild($propertyGroup) | Out-Null
          $project.Save($projectFile.FullName)

          $packagesConfigFile = $projectFile.Directory.GetFileSystemInfos('packages.config')

          # if the project is new .NET Core style or the old one, but uses PackageReference
          if ($project.Project.Sdk -or ($project.Project.ItemGroup.PackageReference | Where-Object { $_ }) -or (-not $packagesConfigFile.Exists)) {
            # delete existing SecurityCodeScan PackageReference entities
            $project.Project.ItemGroup.PackageReference |
            Where-Object Include -like 'SecurityCodeScan*' |
            ForEach-Object { $_.SelectSingleNode('..').RemoveChild($_) | Out-Null }

            $packageReference = $project.CreateElement('PackageReference')
            $packageReferenceInclude = $project.CreateAttribute('Include')
            $packageReferenceInclude.Value = $SecurityCodeScanPackageName
            $packageReference.Attributes.Append($packageReferenceInclude) | Out-Null
            $packageReferenceVersion = $project.CreateAttribute('Version')
            $packageReferenceVersion.Value = $SecurityCodeScanPackageVersion
            $packageReference.Attributes.Append($packageReferenceVersion) | Out-Null
            $packageReferencePrivateAssets = $project.CreateAttribute('PrivateAssets')
            $packageReferencePrivateAssets.Value = 'All'
            $packageReference.Attributes.Append($packageReferencePrivateAssets) | Out-Null
            $packageReferenceIncludeAssets = $project.CreateAttribute('IncludeAssets')
            $packageReferenceIncludeAssets.Value = 'runtime; build; native; contentfiles; analyzers; buildtransitive'
            $packageReference.Attributes.Append($packageReferenceIncludeAssets) | Out-Null
            $itemGroup = $project.CreateElement('ItemGroup')
            $itemGroup.AppendChild($packageReference) | Out-Null
            $project.Project.AppendChild($itemGroup) | Out-Null

            # create RestoreProjectStyle element
            if (-not $project.Project.Sdk) {
              $restoreProjectStyle = $project.CreateElement('RestoreProjectStyle')
              $restoreProjectStyle.InnerText = 'PackageReference'
              $propertyGroup = $project.CreateElement('PropertyGroup')
              $propertyGroup.AppendChild($restoreProjectStyle) | Out-Null
              $project.Project.AppendChild($propertyGroup) | Out-Null
            }

            $project.Save($projectFile.FullName)
          }
          else { # Old style Full DotNet Framework project with packages.config

            # create or get the full path to the solution path directory
            if (-not $SecurityCodeScanPackagePath) {
              if (-not (Test-Path packages -PathType Container)) {
                $SecurityCodeScanPackagePath = (New-Item -Name packages -ItemType Directory).FullName
              }
              else {
                $SecurityCodeScanPackagePath = (Get-Item -Path packages).FullName
              }
            }

            # delete existing SecurityCodeScan analyzer entities
            $project.Project.ItemGroup.Analyzer |
            Where-Object Include -like '*SecurityCodeScan*' |
            ForEach-Object { $_.SelectSingleNode('..').RemoveChild($_) | Out-Null }

            # create RestoreProjectStyle element
            $restoreProjectStyle = $project.CreateElement('RestoreProjectStyle', $project.Project.NamespaceURI)
            $restoreProjectStyle.InnerText = 'PackagesConfig'
            $propertyGroup = $project.CreateElement('PropertyGroup', $project.Project.NamespaceURI)
            $propertyGroup.AppendChild($restoreProjectStyle) | Out-Null
            $project.Project.AppendChild($propertyGroup) | Out-Null

            # create Analyzer elements
            $itemGroup = $project.CreateElement('ItemGroup', $project.Project.NamespaceURI)

            $analyzer = $project.CreateElement('Analyzer', $project.Project.NamespaceURI)
            $analyzerInclude = $project.CreateAttribute('Include')
            # since the changes to the project will be discarded it is ok to set a Full path to SecurityCodeScanPackagePath
            $analyzerInclude.Value = Join-Path -Path $SecurityCodeScanPackagePath -ChildPath "$($SecurityCodeScanPackageName).$($SecurityCodeScanPackageVersion)\analyzers\dotnet\SecurityCodeScan.VS2019.dll"
            $analyzer.Attributes.Append($analyzerInclude) | Out-Null
            $itemGroup.AppendChild($analyzer) | Out-Null

            $analyzer = $project.CreateElement('Analyzer', $project.Project.NamespaceURI)
            $analyzerInclude = $project.CreateAttribute('Include')
            $analyzerInclude.Value = Join-Path -Path $SecurityCodeScanPackagePath -ChildPath "$($SecurityCodeScanPackageName).$($SecurityCodeScanPackageVersion)\analyzers\dotnet\YamlDotNet.dll"
            $analyzer.Attributes.Append($analyzerInclude) | Out-Null
            $itemGroup.AppendChild($analyzer) | Out-Null

            $project.Project.AppendChild($itemGroup) | Out-Null

            $project.Save($projectFile.FullName)

            $packagesConfig = [xml](Get-Content -LiteralPath $packagesConfigFile.FullName -Raw)

            # delete existing SecurityCodeScan package entities
            $packagesConfig.packages.package |
            Where-Object id -like '*SecurityCodeScan*' |
            ForEach-Object { $_.SelectSingleNode('..').RemoveChild($_) | Out-Null }

            # create a SecurityCodeScan package entity
            $package = $packagesConfig.CreateElement('package')
            $packageId = $packagesConfig.CreateAttribute('id')
            $packageId.Value = $SecurityCodeScanPackageName
            $package.Attributes.Append($packageId) | Out-Null
            $packageVersion = $packagesConfig.CreateAttribute('version')
            $packageVersion.Value = $SecurityCodeScanPackageVersion
            $package.Attributes.Append($packageVersion) | Out-Null
            $packageDevelopmentDependency = $packagesConfig.CreateAttribute('developmentDependency')
            $packageDevelopmentDependency.Value = 'true'
            $package.Attributes.Append($packageDevelopmentDependency) | Out-Null

            $packagesConfig.packages.AppendChild($package) | Out-Null

            $packagesConfig.Save($packagesConfigFile.FullName)
          }
        }