Scan vulnerable packages

- https://devblogs.microsoft.com/nuget/how-to-scan-nuget-packages-for-security-vulnerabilities/
- dotnet/sdk#16852

Author: akunzai

.github/workflows/ci.yml

@@ -42,6 +42,12 @@ jobs:
           dotnet build samples/AspNetCoreSingleLogoutSample/AspNetCoreSingleLogoutSample.csproj -c Release
           msbuild samples/OwinSample/OwinSample.csproj -noLogo -verbosity:minimal -restore -p:Configuration=Release
           msbuild samples/OwinSingleLogoutSample/OwinSingleLogoutSample.csproj -noLogo -verbosity:minimal -restore -p:Configuration=Release
+      - name: Scan vulnerable packages
+        # https://github.com/dotnet/sdk/issues/16852
+        run: |
+          dotnet restore
+          dotnet list package --vulnerable --include-transitive | tee vulnerable.out
+          test `grep -cm 1 'has the following vulnerable packages' vulnerable.out` = 0
       - name: Test
         run: |
           dotnet test --collect:"XPlat Code Coverage"

.gitignore

@@ -4,6 +4,7 @@ appsettings.*.json
 launchSettings.json
 *.db
 log.txt
+vulnerable.out
 # JetBrians Rider
 .idea/
 .run/*.run.xml