.NET
Preparing the Lifecycle scan input for NuGet projects.
Ecosystem Guides
For each language, what to prepare for the Lifecycle scan, and the Tier 1 job that prepares it.
2 minute read
DRAFT. These guides are drawn from Sonatype’s published analysis documentation. The snippets have not been run end to end, and where Sonatype’s documentation is silent the guide says so, rather than guessing.
What these guides are
Under the Pull Request CI & Secrets standard, a Tier 1 job (no secrets) prepares a scan input, and a separate Tier 2 job (with secrets) hands it to Sonatype Lifecycle. Which files Lifecycle can accurately evaluate depends on the language. These guides record, for each one:
- What Lifecycle reads, and so what the scan input must contain.
- A
prepare-scan-inputjob to paste into yourci.yaml(see Reference Workflows). - What accuracy you give up compared with scanning a full build, so that nobody is surprised.
The Tier 2 workflow is the same for every language. Only the preparation differs.
Two kinds of ecosystem
| Kind | Examples | What the scan input is | Accuracy |
|---|---|---|---|
| Manifest | Go, Rust, PHP, Ruby, Python, .NET, R | A lockfile or a dependency list, produced by the language’s own tooling | Good, if the lockfile or list pins exact versions. Transitive dependencies depend on what the file contains. |
| Binary | Java, npm with node_modules, Docker | The built artifact, or the installed dependencies | Best. Lifecycle fingerprints the files themselves, which also finds modified or repackaged dependencies. |
Binary inputs are large. Allow for that in the artifact limits (see Reference Workflows).
The guides
| Ecosystem | Used by | Guide |
|---|---|---|
| Go | Nancy, Cheque, Terraform providers, API clients | Go |
| Java (Maven, Gradle) | Sherlock Trunks, Nexus CasC Plugin, API clients | Java |
| JavaScript (npm, Yarn) | AuditJS, API clients | JavaScript |
| Python | Jake, API clients | Python |
| .NET (NuGet) | No current Project | .NET |
| Rust (Cargo) | Cargo Pants | Rust |
| Ruby (Bundler) | Chelsea | Ruby |
| PHP (Composer) | Bach | PHP |
| R (CRAN) | OysterR | R |
| C/C++ (Conan) | No current Project | C/C++ |
| Docker images | Container image Projects | Docker |
Terraform providers are written in Go, so their Lifecycle scan is the Go guide.
Not yet covered: Dart and Flutter, Swift, Objective-C, Conda, RPM, and Hugging Face. Sonatype supports these. If your Project needs one of them, or uses a tool or ecosystem not listed at all, see Your tool or ecosystem is not covered.
Adding a guide
Each guide follows the same shape so they can be compared: what Lifecycle reads, the prepare-scan-input job, what you give up, and a link to the Sonatype page it came from. Quote Sonatype’s documentation, and say “not documented” where it is silent.
C/C++
Preparing the Lifecycle scan input for Conan-based C and C++ projects.
Docker
Preparing the Lifecycle scan input for container images.
Go
Preparing the Lifecycle scan input for Go modules, including Terraform providers.
Java
Preparing the Lifecycle scan input for Maven and Gradle projects.
JavaScript
Preparing the Lifecycle scan input for npm and Yarn projects.
PHP
Preparing the Lifecycle scan input for Composer projects.
Python
Preparing the Lifecycle scan input for Python projects using pip or Poetry.
R
Preparing the Lifecycle scan input for R (CRAN) packages.
Ruby
Preparing the Lifecycle scan input for Bundler projects.
Rust
Preparing the Lifecycle scan input for Cargo projects.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.