dotnet-cli-release-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The workflow demonstrates secure secret management by utilizing the
secretscontext for API keys (e.g.,NUGET_API_KEY,WINGET_GITHUB_TOKEN), ensuring sensitive credentials are not hardcoded. - [SAFE]: The skill proactively addresses supply-chain security by advising users to pin third-party GitHub Actions to specific commit SHAs in production environments.
- [SAFE]: The input for versioning is restricted by a specific regex pattern in the GitHub Actions trigger (
v[0-9]+.[0-9]+.[0-9]+*), which serves as an effective boundary against injection attacks via malicious git tag names. - [SAFE]: External dependencies are restricted to standard GitHub Actions and well-known community tools used for their intended purposes within the .NET and package management ecosystems.
Audit Metadata