Code and security cleanups

.github/workflows/build.yaml

@@ -1,3 +1,4 @@
+---
 on:
   workflow_call:
     inputs:
@@ -14,110 +15,114 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: read       # To read repository contents
+      pull-requests: write # To write pull requests analysis results and artifacts
+
     runs-on: ${{ inputs.os }}
 
     steps:
 
-    - name: Checkout 
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Setup dotnet 6/8
-      uses: actions/setup-dotnet@v4
-      with:
-        dotnet-version: |
-          6.x
-          8.x
-
-    - name: Restore Tools
-      run: >
-        dotnet tool restore
-      
-    - name: Restore Dependencies
-      run: > 
-        dotnet restore
-      
-    - name: Start Sonar Scanner
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: >
-        dotnet dotnet-sonarscanner
-        begin
-        /k:"demaconsulting_SpdxModel"
-        /o:"demaconsulting"
-        /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
-        /d:sonar.host.url="https://sonarcloud.io"
-        /d:sonar.cs.opencover.reportsPaths=**/*.opencover.xml
-        /d:sonar.scanner.scanAll=false
-
-    - name: Build
-      run: >
-        dotnet build
-        --no-restore
-        --configuration Release
-        --property:Version=${{ inputs.version }}
-
-    - name: Test
-      run: >
-        dotnet test
-        --no-build
-        --configuration Release
-        --property:Version=${{ inputs.version }}
-        --collect "XPlat Code Coverage;Format=opencover"
-
-    - name: End Sonar Scanner
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: >
-        dotnet dotnet-sonarscanner
-        end
-        /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
-
-    - name: Generate SBOM
-      run: >
-        dotnet sbom-tool generate
-        -b src/DemaConsulting.SpdxModel/bin/Release
-        -bc src/DemaConsulting.SpdxModel
-        -pn DemaConsulting.SpdxModel
-        -pv ${{ inputs.version }}
-        -ps DemaConsulting
-        -nsb https://DemaConsulting.com/SpdxModel
-        -pm true
-        -li true
-
-    - name: Generate Tests SBOM
-      run: >
-        dotnet sbom-tool generate
-        -b test/DemaConsulting.SpdxModel.Tests/bin/Release
-        -bc test/DemaConsulting.SpdxModel.Tests
-        -cd "--DirectoryExclusionList **/Examples/**"
-        -pn DemaConsulting.SpdxModel.Tests
-        -pv ${{ inputs.version }}
-        -ps DemaConsulting
-        -nsb https://DemaConsulting.com/SpdxModel.Tests
-        -pm true
-        -li true
-
-    - name: Run SBOM Workflow
-      run: >
-        dotnet spdx-tool
-        run-workflow spdx-workflow.yaml
-
-    - name: Create Dotnet Tool
-      run: >
-        dotnet pack
-        --no-build
-        --no-restore
-        --property:PackageVersion=${{ inputs.version }}
-
-    - name: Upload Artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: artifacts-${{ inputs.os }}
-        path: |
-          **/*.nupkg
-          **/*.snupkg
-          **/manifest.spdx.json
-          **/manifest.spdx.json.sha256
-          *summary.md
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup dotnet 6/8
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            6.x
+            8.x
+
+      - name: Restore Tools
+        run: >
+          dotnet tool restore
+
+      - name: Restore Dependencies
+        run: >
+          dotnet restore
+
+      - name: Start Sonar Scanner
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >
+          dotnet dotnet-sonarscanner
+          begin
+          /k:"demaconsulting_SpdxModel"
+          /o:"demaconsulting"
+          /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
+          /d:sonar.host.url="https://sonarcloud.io"
+          /d:sonar.cs.opencover.reportsPaths=**/*.opencover.xml
+          /d:sonar.scanner.scanAll=false
+
+      - name: Build
+        run: >
+          dotnet build
+          --no-restore
+          --configuration Release
+          --property:Version=${{ inputs.version }}
+
+      - name: Test
+        run: >
+          dotnet test
+          --no-build
+          --configuration Release
+          --property:Version=${{ inputs.version }}
+          --collect "XPlat Code Coverage;Format=opencover"
+
+      - name: End Sonar Scanner
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >
+          dotnet dotnet-sonarscanner
+          end
+          /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
+
+      - name: Generate SBOM
+        run: >
+          dotnet sbom-tool generate
+          -b src/DemaConsulting.SpdxModel/bin/Release
+          -bc src/DemaConsulting.SpdxModel
+          -pn DemaConsulting.SpdxModel
+          -pv ${{ inputs.version }}
+          -ps DemaConsulting
+          -nsb https://DemaConsulting.com/SpdxModel
+          -pm true
+          -li true
+
+      - name: Generate Tests SBOM
+        run: >
+          dotnet sbom-tool generate
+          -b test/DemaConsulting.SpdxModel.Tests/bin/Release
+          -bc test/DemaConsulting.SpdxModel.Tests
+          -cd "--DirectoryExclusionList **/Examples/**"
+          -pn DemaConsulting.SpdxModel.Tests
+          -pv ${{ inputs.version }}
+          -ps DemaConsulting
+          -nsb https://DemaConsulting.com/SpdxModel.Tests
+          -pm true
+          -li true
+
+      - name: Run SBOM Workflow
+        run: >
+          dotnet spdx-tool
+          run-workflow spdx-workflow.yaml
+
+      - name: Create Dotnet Tool
+        run: >
+          dotnet pack
+          --no-build
+          --no-restore
+          --property:PackageVersion=${{ inputs.version }}
+
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts-${{ inputs.os }}
+          path: |
+            **/*.nupkg
+            **/*.snupkg
+            **/manifest.spdx.json
+            **/manifest.spdx.json.sha256
+            *summary.md

.github/workflows/build_on_push.yaml

@@ -1,10 +1,14 @@
+---
 name: Build
 
 on: [push, workflow_dispatch]
 
 jobs:
   build-windows:
     name: Build Windows
+    permissions:
+      contents: read       # To read repository contents
+      pull-requests: write # To write pull requests analysis results and artifacts
     uses: ./.github/workflows/build.yaml
     with:
       os: windows-latest
@@ -14,6 +18,9 @@ jobs:
 
   build-linux:
     name: Build Linux
+    permissions:
+      contents: read       # To read repository contents
+      pull-requests: write # To write pull requests analysis results and artifacts
     uses: ./.github/workflows/build.yaml
     with:
       os: ubuntu-latest

.github/workflows/release.yaml

@@ -1,3 +1,4 @@
+---
 name: Release
 
 on:
@@ -13,13 +14,15 @@ on:
         default: 'publish'
         type: choice
         options:
-        - none
-        - release
-        - publish
+          - none
+          - release
+          - publish
 
 jobs:
   build:
     name: Build Linux
+    permissions:
+      contents: write # To create releases
     uses: ./.github/workflows/build.yaml
     with:
       os: ubuntu-latest
@@ -33,41 +36,41 @@ jobs:
       packages: write
 
     runs-on: ubuntu-latest
-    
+
     needs: build
-    
+
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+
+      - name: Setup dotnet 8
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            8.x
 
-    - name: Setup dotnet 8
-      uses: actions/setup-dotnet@v4
-      with:
-        dotnet-version: |
-          8.x
+      - name: Download Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts-ubuntu-latest
+          path: artifacts
 
-    - name: Download Artifacts
-      uses: actions/download-artifact@v4
-      with:
-        name: artifacts-ubuntu-latest
-        path: artifacts
+      - name: Clean Artifacts
+        shell: bash
+        run: rm -rf artifacts/test
 
-    - name: Clean Artifacts
-      shell: bash
-      run: rm -rf artifacts/test
-
-    - name: Create release
-      if: ${{ inputs.publish == 'release' || inputs.publish == 'publish' }}
-      uses: ncipollo/release-action@v1
-      with:
-        artifacts: 'artifacts/**/*'
-        generateReleaseNotes: true
-        tag: ${{ inputs.version }}
+      - name: Create release
+        if: ${{ inputs.publish == 'release' || inputs.publish == 'publish' }}
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: 'artifacts/**/*'
+          generateReleaseNotes: true
+          tag: ${{ inputs.version }}
 
-    - name: Publish to Nuget
-      if: ${{ inputs.publish == 'publish' }}
-      run: >
-        dotnet
-        nuget push
-        artifacts/src/DemaConsulting.SpdxModel/bin/Release/*.nupkg
-        --source "https://api.nuget.org/v3/index.json"
-        --api-key "${{ secrets.DEMACONSULTINGNUGETKEY }}"
+      - name: Publish to Nuget
+        if: ${{ inputs.publish == 'publish' }}
+        run: >
+          dotnet
+          nuget push
+          artifacts/src/DemaConsulting.SpdxModel/bin/Release/*.nupkg
+          --source "https://api.nuget.org/v3/index.json"
+          --api-key "${{ secrets.DEMACONSULTINGNUGETKEY }}"

src/DemaConsulting.SpdxModel/SpdxAnnotationType.cs

@@ -54,12 +54,12 @@ public static class SpdxAnnotationTypeExtensions
     /// <exception cref="InvalidOperationException">on error</exception>
     public static SpdxAnnotationType FromText(string annotationType)
     {
-        return annotationType switch
+        return annotationType.ToUpperInvariant() switch
         {
             "" => SpdxAnnotationType.Missing,
             "REVIEW" => SpdxAnnotationType.Review,
             "OTHER" => SpdxAnnotationType.Other,
-            _ => throw new InvalidOperationException($"Unsupported SPDX Annotation Type {annotationType}")
+            _ => throw new InvalidOperationException($"Unsupported SPDX Annotation Type '{annotationType}'")
         };
     }
 
@@ -77,7 +77,7 @@ public static string ToText(this SpdxAnnotationType annotationType)
                 "Attempt to serialize missing SPDX Annotation Type"),
             SpdxAnnotationType.Review => "REVIEW",
             SpdxAnnotationType.Other => "OTHER",
-            _ => throw new InvalidOperationException($"Unsupported SPDX Annotation Type {annotationType}")
+            _ => throw new InvalidOperationException($"Unsupported SPDX Annotation Type '{annotationType}'")
         };
     }
 }