Update licenses & CI (#234)

* Fix build warnings
* Update licenses & fix nuget scan
* Split CodeQL actions
* Make CodeQL-Analyze required for release
* Fix minio client setup in integration test

Signed-off-by: Victor Chang <[email protected]>

Author: mocsharp

.github/workflows/ci.yml

@@ -59,16 +59,53 @@ jobs:
           useConfigFile: true
           configFilePath: .github/.gitversion.yml
 
+  CodeQL-Analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+
+    - uses: actions/setup-dotnet@v3
+      with:
+        dotnet-version: "6.0.x"
+
+    - name: Enable NuGet cache
+      uses: actions/[email protected]
+      with:
+        path: ~/.nuget/packages
+        key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
+        restore-keys: |
+          ${{ runner.os }}-nuget
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: csharp
+
+    - name: Restore dependencies
+      run: dotnet restore
+      working-directory: ./src
+
+    - name: Build Solution
+      run: dotnet build -c ${{ env.BUILD_CONFIG }} --nologo ${{ env.SOLUTION }}
+      working-directory: ./src
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+
   analyze:
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'csharp' ]
 
     steps:
     - name: Checkout repository
@@ -97,13 +134,12 @@ jobs:
         restore-keys: |
           ${{ runner.os }}-nuget
 
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Install NuGetDefense
-      run: dotnet tool install --global NuGetDefense.Tool
+    - name: Nuget Vulnerabiilty Scan
+      run: |
+        dotnet list package --vulnerable 2>&1 | tee vulnerable.txt
+        echo "Analyzing dotnet list package command log output..."
+        sh -c "! grep 'has the following vulnerable packages' vulnerable.txt"
+      working-directory: ./src
 
     - name: Restore dependencies
       run: dotnet restore
@@ -120,17 +156,14 @@ jobs:
         sed -i "s/OSSINDEXAPI_USERNAME/$OSSINDEXAPI_USERNAME/g" NuGetDefense.json
         nugetdefense -p src/${{ env.SOLUTION }} --settings-file NuGetDefense.json
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-
     - name: Secret detection
       uses: gitleaks/[email protected]
 
     - name: Perform License Scanning
       run: license_finder -r
 
     - name: Check License Header
-      uses: apache/skywalking-eyes@main
+      uses: apache/skywalking-eyes@v0.4.0
 
   unit-test:
     runs-on: ubuntu-latest
@@ -448,7 +481,7 @@ jobs:
   release:
     if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.ref, 'refs/heads/develop') ||contains(github.head_ref, 'release/') || contains(github.head_ref, 'feature/') || contains(github.head_ref, 'develop') }}
     runs-on: ubuntu-latest
-    needs: [calc-version, unit-test, docs, integration-test]
+    needs: [calc-version, unit-test, docs, integration-test, analyze]
     env:
       SEMVER: ${{ needs.calc-version.outputs.semVer }}
       PRERELEASELABEL: ${{ needs.calc-version.outputs.preReleaseLabel }}

doc/dependency_decisions.yml

@@ -74,14 +74,14 @@
   - :who: mocsharp
     :why: MIT (https://github.com/dotnet/dotNext/raw/master/LICENSE)
     :versions:
-    - 4.7.3
+    - 4.7.4
     :when: 2022-09-01 23:05:32.857032968 Z
 - - :approve
   - DotNext.Threading
   - :who: mocsharp
     :why: MIT (https://github.com/dotnet/dotNext/raw/master/LICENSE)
     :versions:
-    - 4.7.3
+    - 4.7.4
     :when: 2022-09-01 23:05:33.298402277 Z
 - - :approve
   - FluentAssertions
@@ -778,19 +778,13 @@
     :versions:
     - 4.5.0
     :when: 2022-08-16 23:06:19.647254594 Z
-- - :approve
-  - Minio
-  - :who: mocsharp
-    :why: Apache-2.0 (https://github.com/minio/minio-dotnet/raw/master/LICENSE)
-    :versions:
-    - 4.0.4
-    :when: 2022-08-16 23:06:20.140413803 Z
 - - :approve
   - Minio
   - :who: mocsharp
     :why: Apache-2.0 (https://github.com/minio/minio-dotnet/raw/master/LICENSE)
     :versions:
     - 4.0.5
+    - 4.0.6
     :when: 2022-08-16 23:06:20.598551507 Z
 - - :approve
   - Monai.Deploy.Messaging
@@ -1816,7 +1810,7 @@
   - :who: mocsharp
     :why: MIT (https://github.com/coverlet-coverage/coverlet/raw/master/LICENSE)
     :versions:
-    - 3.1.2
+    - 3.2.0
     :when: 2022-08-16 23:07:29.112978564 Z
 - - :approve
   - fo-dicom
@@ -2363,21 +2357,21 @@
   - :who: mocsharp
     :why: BSD 3-Clause License (https://github.com/NLog/NLog/raw/dev/LICENSE.txt)
     :versions:
-    - 5.0.4
+    - 5.0.5
     :when: 2022-10-12 03:14:06.538744982 Z
 - - :approve
   - NLog.Extensions.Logging
   - :who: mocsharp
     :why: BSD 2-Clause Simplified License (https://github.com/NLog/NLog.Extensions.Logging/raw/master/LICENSE)
     :versions:
-    - 5.0.4
+    - 5.1.0
     :when: 2022-10-12 03:14:06.964203977 Z
 - - :approve
   - NLog.Web.AspNetCore
   - :who: mocsharp
     :why: BSD 3-Clause License (https://github.com/NLog/NLog.Web/raw/master/LICENSE)
     :versions:
-    - 5.1.4
+    - 5.1.5
     :when: 2022-10-12 03:14:07.396706995 Z
 - - :approve
   - fo-dicom.NLog

docs/compliance/third-party-licenses.md

@@ -746,14 +746,14 @@ SOFTWARE.
 
 
 <details>
-<summary>DotNext 4.7.1</summary>
+<summary>DotNext 4.7.4</summary>
 
 ## DotNext
 
-- Version: 4.7.1
+- Version: 4.7.4
 - Authors: .NET Foundation and Contributors
 - Project URL: https://dotnet.github.io/dotNext/
-- Source: [NuGet](https://www.nuget.org/packages/DotNext/4.7.1)
+- Source: [NuGet](https://www.nuget.org/packages/DotNext/4.7.4)
 - License: [MIT](https://github.com/dotnet/dotNext/raw/master/LICENSE)
 
 
@@ -824,14 +824,14 @@ SOFTWARE.
 
 
 <details>
-<summary>DotNext.Threading 4.7.1</summary>
+<summary>DotNext.Threading 4.7.4</summary>
 
 ## DotNext.Threading
 
-- Version: 4.7.1
+- Version: 4.7.4
 - Authors: .NET Foundation and Contributors
 - Project URL: https://dotnet.github.io/dotNext/
-- Source: [NuGet](https://www.nuget.org/packages/DotNext.Threading/4.7.1)
+- Source: [NuGet](https://www.nuget.org/packages/DotNext.Threading/4.7.4)
 - License: [MIT](https://github.com/dotnet/dotNext/raw/master/LICENSE)
 
 
@@ -7098,14 +7098,14 @@ Apache License
 
 
 <details>
-<summary>Minio 4.0.5</summary>
+<summary>Minio 4.0.6</summary>
 
 ## Minio
 
-- Version: 4.0.5
+- Version: 4.0.6
 - Authors: MinIO, Inc.
 - Project URL: https://github.com/minio/minio-dotnet
-- Source: [NuGet](https://www.nuget.org/packages/Minio/4.0.5)
+- Source: [NuGet](https://www.nuget.org/packages/Minio/4.0.6)
 - License: [Apache-2.0](https://github.com/minio/minio-dotnet/raw/master/LICENSE)
 
 
@@ -8791,14 +8791,14 @@ SOFTWARE.
 
 
 <details>
-<summary>NLog 5.0.4</summary>
+<summary>NLog 5.0.5</summary>
 
 ## NLog
 
-- Version: 5.0.4
+- Version: 5.0.5
 - Authors: Jarek Kowalski,Kim Christensen,Julian Verdurmen
 - Project URL: https://nlog-project.org/
-- Source: [NuGet](https://www.nuget.org/packages/NLog/5.0.4)
+- Source: [NuGet](https://www.nuget.org/packages/NLog/5.0.5)
 - License: [BSD 3-Clause License](https://github.com/NLog/NLog/raw/dev/LICENSE.txt)
 
 
@@ -8839,14 +8839,14 @@ THE POSSIBILITY OF SUCH DAMAGE.
 
 
 <details>
-<summary>NLog.Extensions.Logging 5.0.4</summary>
+<summary>NLog.Extensions.Logging 5.1.0</summary>
 
 ## NLog.Extensions.Logging
 
-- Version: 5.0.4
+- Version: 5.1.0
 - Authors: Microsoft,Julian Verdurmen
 - Project URL: https://github.com/NLog/NLog.Extensions.Logging
-- Source: [NuGet](https://www.nuget.org/packages/NLog.Extensions.Logging/5.0.4)
+- Source: [NuGet](https://www.nuget.org/packages/NLog.Extensions.Logging/5.1.0)
 - License: [BSD 2-Clause Simplified License](https://github.com/NLog/NLog.Extensions.Logging/raw/master/LICENSE)
 
 
@@ -8880,14 +8880,14 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 <details>
-<summary>NLog.Web.AspNetCore 5.1.4</summary>
+<summary>NLog.Web.AspNetCore 5.1.5</summary>
 
 ## NLog.Web.AspNetCore
 
-- Version: 5.1.4
+- Version: 5.1.5
 - Authors: Julian Verdurmen
 - Project URL: https://github.com/NLog/NLog.Web
-- Source: [NuGet](https://www.nuget.org/packages/NLog.Web.AspNetCore/5.1.4)
+- Source: [NuGet](https://www.nuget.org/packages/NLog.Web.AspNetCore/5.1.5)
 - License: [BSD 3-Clause License](https://github.com/NLog/NLog.Web/raw/master/LICENSE)
 
 
@@ -27675,14 +27675,14 @@ accept this license. If you do not accept the license, do not use the software.
 
 
 <details>
-<summary>coverlet.collector 3.1.2</summary>
+<summary>coverlet.collector 3.2.0</summary>
 
 ## coverlet.collector
 
-- Version: 3.1.2
+- Version: 3.2.0
 - Authors: tonerdo
 - Project URL: https://github.com/coverlet-coverage/coverlet
-- Source: [NuGet](https://www.nuget.org/packages/coverlet.collector/3.1.2)
+- Source: [NuGet](https://www.nuget.org/packages/coverlet.collector/3.2.0)
 - License: [MIT](https://github.com/coverlet-coverage/coverlet/raw/master/LICENSE)
 
 

src/CLI/Monai.Deploy.InformaticsGateway.CLI.csproj

@@ -20,11 +20,8 @@
     <OutputType>Exe</OutputType>
     <TargetFramework>net6.0</TargetFramework>
     <PublishSingleFile>true</PublishSingleFile>
-    <SelfContained>true</SelfContained>
     <PublishTrimmed>false</PublishTrimmed>
     <PublishReadyToRun>true</PublishReadyToRun>
-    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
-    <RuntimeIdentifiers>win-x64;linux-x64</RuntimeIdentifiers>
     <AssemblyName>mig-cli</AssemblyName>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
     <CodeAnalysisRuleSet>..\.sonarlint\project-monai_monai-deploy-informatics-gatewaycsharp.ruleset</CodeAnalysisRuleSet>

src/InformaticsGateway/Services/Storage/ObjectUploadService.cs

@@ -69,7 +69,7 @@ public ObjectUploadService(
 
         }
 
-        private async Task BackgroundProcessing(CancellationToken cancellationToken)
+        private void BackgroundProcessing(CancellationToken cancellationToken)
         {
             _logger.ServiceRunning(ServiceName);
             var tasks = new List<Task>();
@@ -111,7 +111,7 @@ private async Task StartWorker(int thread, CancellationToken cancellationToken)
                 }
                 catch (OperationCanceledException ex)
                 {
-                    _logger.ServiceCancelled(ServiceName);
+                    _logger.ServiceCancelledWithException(ServiceName, ex);
                     break;
                 }
                 catch (Exception ex)
@@ -123,9 +123,9 @@ private async Task StartWorker(int thread, CancellationToken cancellationToken)
 
         public Task StartAsync(CancellationToken cancellationToken)
         {
-            var task = Task.Run(async () =>
+            var task = Task.Run(() =>
             {
-                await BackgroundProcessing(cancellationToken);
+                BackgroundProcessing(cancellationToken);
             }, CancellationToken.None);
 
             Status = ServiceStatus.Running;

src/InformaticsGateway/appsettings.Test.json

@@ -11,14 +11,14 @@
     },
     "messaging": {
       "publisherSettings": {
-        "endpoint": "172.18.0.4",
+        "endpoint": "172.28.0.1",
         "username": "rabbitmq",
         "password": "rabbitmq",
         "virtualHost": "monaideploy",
         "exchange": "monaideploy"
       },
       "subscriberSettings": {
-        "endpoint": "172.18.0.4",
+        "endpoint": "172.28.0.1",
         "username": "rabbitmq",
         "password": "rabbitmq",
         "virtualHost": "monaideploy",
@@ -31,7 +31,7 @@
       "bucketName": "monai",
       "temporaryBucketName": "monai",
       "settings": {
-        "endpoint": "172.18.0.2:9000",
+        "endpoint": "172.28.0.1:9000",
         "accessKey": "minioadmin",
         "accessToken": "minioadmin",
         "securedConnection": false,
@@ -59,4 +59,4 @@
       }
     }
   }
-}
+}

tests/Integration.Test/StepDefinitions/AcrApiStepDefinitions.cs

@@ -193,7 +193,8 @@ public async Task ThenAStudyIsUploadedToTheStorageService()
         {
             var minioClient = new MinioClient()
                 .WithEndpoint(_configuration.StorageServiceOptions.Endpoint)
-                .WithCredentials(_configuration.StorageServiceOptions.AccessKey, _configuration.StorageServiceOptions.AccessToken);
+                .WithCredentials(_configuration.StorageServiceOptions.AccessKey, _configuration.StorageServiceOptions.AccessToken)
+                .Build();
 
             var dicomSizes = _scenarioContext[KeyDicomHashes] as Dictionary<string, string>;
             _rabbitMqHooks.MessageWaitHandle.Wait(MessageWaitTimeSpan).Should().BeTrue();

tests/Integration.Test/StepDefinitions/ExportServicesStepDefinitions.cs

@@ -118,7 +118,8 @@ public async Task GivenDICOMInstances(int studyCount, string modality)
 
             var minioClient = new MinioClient()
                 .WithEndpoint(_configuration.StorageServiceOptions.Endpoint)
-                .WithCredentials(_configuration.StorageServiceOptions.AccessKey, _configuration.StorageServiceOptions.AccessToken);
+                .WithCredentials(_configuration.StorageServiceOptions.AccessKey, _configuration.StorageServiceOptions.AccessToken)
+                .Build();
 
             _outputHelper.WriteLine($"Uploading {fileSpecs.FileCount} files to MinIO...");
             foreach (var file in fileSpecs.Files)