This tool is used to gather actual dependencies used by a .net/npm/pypi project and publish them to a ProGet instance. It is available as a standalone tool for Windows/Linux, an installable dotnet tool, or a .net class library. Its functionality is also available in OtterScript directly using the ProGet::Record-Dependencies operation.

Download the latest version from the Releases page.

Install the tool using dotnet. For example, to install the tool locally to the current tool manifest:

dotnet tool install pgscan

Execute pgscan with the identify command. For example, to generate an SBOM and submit the dependencies of v1.0.0 the MyLibrary project to ProGet:

pgscan identify --input=MyLibrary.csproj --proget-url=https://proget.local --version=1.0.0

Note that the identify command requires ProGet 2022 and later. If you're using ProGet 6.0, you'll need to use the now-deprecated publish command; see the old version of this README to learn how.

Use the ProGet::Record-Dependencies operation:

ProGet::Record-Dependencies
(
    Project: MyProject.csproj,
    Resource: LocalProGet,
    Feed: Libraries,
    ConsumerVersion: $ReleaseNumber
);

Use a local dotnet tool action to run pgscan on Windows and Linux build agents.

1. Create a ProGet API key
   1. Once the API Key is created in ProGet, you will need to add it as a Secret on your GitHub project
   2. Navigate to your project in GitHub
   3. Click "Settings"
   4. Navigate to "Secrets -> Actions" on the right
   5. Click "New repository secret"
   6. Enter a name (ex: PROGETAPIKEY) and your API key as the secret value
2. Commit a dotnet tool manifest
   1. At the root of your repository, run dotnet new tool-manifest (see Microsoft's local tool documentation for more information)
   2. Commit this to your git repository
3. Setup .NET 6.0 in your workflow
   • If you are already using dotnet 6 in your workflow, go to the next step.
   • Add the following to your workflow:

       - name: Setup .NET
         uses: actions/setup-dotnet@v2
         with:
           dotnet-version: 6.0.x

   • This can be added anywhere before the pgscan steps, but is typically added at the beginning
4. Add the pgscan steps after build/publish steps of your code

    - name: Install pgscan
      run: dotnet tool install pgscan
    - name: Run pgscan
      working-directory: ProfiteCalcNet.Console
      run: dotnet tool run pgscan identify --type=nuget --input=MyProject.csproj --project-name=MyProject --version=1.0.0 --project-type=application --proget-url=https://proget.local --api-key=${{ secrets.PROGETAPIKEY }}

Use a local dotnet tool action to run pgscan on Windows and Linux build agents.

1. Create a ProGet API key
   1. Once the API Key is created in ProGet, you will need to add it as a secrete Variable on your pipeline.
   2. Navigate to your pipeline in Azure DevOps
   3. Click Edit
   4. Click Variables and then the plus icon
   5. Enter a name (ex: PROGETAPIKEY) and your API key as the value
   6. Check "Keep this value Secret"
   7. Click OK
2. Commit a dotnet tool manifest
   1. At the root of your repository, run dotnet new tool-manifest (see Microsoft's local tool documentation for more information)
   2. Commit this to your git repository
3. Add .NET 6.0 in your pipeline
   • If you are already using dotnet 6 in your pipeline, go to the next step.
   • Add the following to your workflow:

   - task: UseDotNet@2
     inputs:
       packageType: 'sdk'
       version: '6.0.x'

   • This can be added anywhere before the pgscan steps, but is typically added at the beginning
4. Add the pgscan steps after build/publish steps of your code

   - script: dotnet tool install pgscan
   - script: dotnet tool run pgscan identify --type=nuget --input=MyProject.csproj --project-name=MyProject --version=1.0.0 --project-type=application --proget-url=https://proget.local --api-key=$(PROGETAPIKEY)