Security Vulnerability Check on Release Tags

.github/workflows/Security Vulnerability Check on Release Tags.yml

@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: Apache-2.0
+# Licensed to the Ed-Fi Alliance under one or more agreements.
+# The Ed-Fi Alliance licenses this file to you under the Apache License, Version 2.0.
+# See the LICENSE and NOTICES files in the project root for more information.
+
+name: Security Vulnerability Check on Release Tags
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  
+  pull_request:
+    branches: [main] 
+
+env:
+  EDFI_ODS_IMP_TOKEN: ${{ secrets.REPO_DISPATCH_TOKEN }}
+  REPOSITORY_OWNER: ${{ GITHUB.REPOSITORY_OWNER }}   
+jobs:
+  Security-Vulnerability-Check-Each-Release-Tag:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        tag: ["v5.3-patch5","v6.1-patch3","v7.1-patch1"]   
+    name: ${{ matrix.tag }} Security-Vulnerabilities Check
+
+    steps:
+    - name: Checkout Ed-Fi-ODS
+      uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4
+      with:
+        repository: Ed-Fi-Alliance-OSS/Ed-Fi-ODS
+        path: Ed-Fi-ODS/    
+        ref: ${{ matrix.tag }}
+    - name: Execute vulnerability 
+      working-directory: ./Ed-Fi-ODS/
+      run: |
+        $slnFiles = Get-ChildItem -Path . -Filter "*.sln" -Recurse | Where-Object { $_.Name -ne "EdFi.ProjectTemplates.sln" }
+
+        foreach ($file in $slnFiles) {
+          dotnet restore $file.FullName  | Out-Null
+          dotnet list $file.FullName package --vulnerable  2>&1 | Tee-Object -FilePath "build.log" -Append | Out-Null
+        }
+
+        # Analyze dotnet list package command log output
+        $logContent = Get-Content -Path "build.log" -Raw
+
+        # Check for vulnerabilities in the log output
+        if ($logContent -match "critical|high|moderate") {
+            Write-Error "Security Vulnerabilities found"
+            exit 1
+        }
+      shell: pwsh        
+    - name: Upload vulnerability Artifacts
+      if: success() || failure()
+      uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      with:
+        name: vulnerability-report-${{ matrix.tag }}-Artifacts
+        path: ${{ github.workspace }}/Ed-Fi-ODS/build.log