Skip to content

Conversation

@sbroenne
Copy link
Owner

  • Initial plan

  • Fix GitHub workflow configuration issues - .NET version and package naming

Co-authored-by: sbroenne 3026464+sbroenne@users.noreply.github.com

  • Add GitHub workflows configuration management guidelines to prevent sync issues

Co-authored-by: sbroenne 3026464+sbroenne@users.noreply.github.com


Co-authored-by: copilot-swe-agent[bot] 198982749+Copilot@users.noreply.github.com
Co-authored-by: sbroenne 3026464+sbroenne@users.noreply.github.com

Stefan Broenner and others added 8 commits October 19, 2025 10:48
… and automation

- Implemented ExcelDiagnostics class for comprehensive error reporting, including detailed context for Excel operations.
- Added ExcelHelper class to manage Excel COM automation with improved resource management and security checks.
- Created project file for ExcelMcp.CLI with necessary dependencies and metadata.
- Developed main program logic for command-line interface, including argument validation and command handling for various Excel operations.
- Included detailed help and usage instructions for users, along with examples and requirements.
- Implemented integration tests for ScriptCommands and SheetCommands to validate VBA script operations and worksheet manipulations.
- Created unit tests for argument validation and Excel file checks in the ExcelMcp CLI.
- Added project files for test projects with necessary dependencies.
- Developed integration tests for ExcelMcp Server tools to ensure proper functionality of resource-based commands.
- Included cleanup logic in tests to manage temporary files and directories.
…ble name, and implement .NET best practices (#1)

* Initial plan

* Apply Sbroenne prefix to all project namespaces and solution file

- Rename ExcelMcp.sln to Sbroenne.ExcelMcp.sln
- Update all CLI namespaces from ExcelMcp.* to Sbroenne.ExcelMcp.CLI.*
- Add AssemblyName and RootNamespace properties to all projects
- Fix using statements in CLI to reference correct namespaces
- Update Program.cs to use CLI Commands instead of Core Commands

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Fix old repository and product naming references

- Update Directory.Build.props: Product name from ExcelCLI to Sbroenne.ExcelMcp
- Update Directory.Build.props: Repository URLs from ExcelCLI to mcp-server-excel
- Update Program.cs: Repository links and branding from ExcelCLI to ExcelMcp.CLI
- Update documentation: Replace ExcelCLI with Sbroenne.ExcelMcp/ExcelMcp.CLI
- Update workflows: Fix executable name and help text validation
- Update CONTRIBUTING, SECURITY, CLI, AUTHOR, COPILOT docs

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Complete project cleanup and NuGet best practices

- Remove legacy ExcelMcp.Tests folder (not in solution)
- Update TEST_GUIDE.md with correct test structure
- Add PackageReadmeFile to CLI project (includes CLI.md)
- Fix .NET version reference from 8.0 to 10.0 in Program.cs
- Fix release workflow paths: net8.0 → net10.0
- Fix release workflow DLL names with Sbroenne prefix
- Ensure all NuGet metadata follows best practices

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Add comprehensive naming review summary documentation

- Document all naming convention changes
- Provide migration notes for developers
- List all best practices compliance items
- Include before/after examples
- Summary statistics of changes made

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Simplify CLI executable name to 'excelcli.exe'

- Change AssemblyName from Sbroenne.ExcelMcp.CLI to excelcli
- Update build-cli.yml workflow for new executable name
- Update release-cli.yml with excelcli.exe references
- Update all documentation (INSTALLATION, CLI, DEVELOPMENT, etc.)
- Update Program.cs usage examples to use 'excelcli' command
- Update NAMING_REVIEW_SUMMARY.md with new executable name

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Apply .NET best practices improvements

- Add XML documentation generation to Core library
- Add version information to Core library (2.0.0)
- Enable deterministic builds for reproducible binaries
- Enable package validation for NuGet packages (CLI and MCP Server)
- Create comprehensive DOTNET_BEST_PRACTICES_REVIEW.md document

All changes maintain backward compatibility and enhance professional quality.

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Update all documentation for simplified CLI executable name

- Update CLI.md: Change zip file name and path references to excelcli
- Update COMMANDS.md: All 80+ command examples now use 'excelcli' command
- Update excel-powerquery-vba-copilot-instructions.md: All command examples updated
- Update .github/copilot-instructions.md: All command examples and workflows updated

All documentation now consistently references 'excelcli' as the executable name (156 command references updated).

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Refocus excel-powerquery-vba-copilot-instructions.md on MCP server

- Changed from CLI command examples to MCP server conversational workflows
- Updated title and introduction to focus on AI-assisted development
- Replaced CLI commands with 6 resource-based MCP tools (excel_file, excel_powerquery, excel_worksheet, excel_parameter, excel_cell, excel_vba)
- Added conversational workflow examples (Power Query refactoring, VBA enhancement, etc.)
- Updated use cases to emphasize AI development vs scripted automation
- Added MCP server installation and configuration instructions
- Added example prompts for GitHub Copilot integration
- Clarified distinction between MCP server (development) and CLI (automation)

The file now properly guides users on using the MCP server for AI-powered Excel development workflows.

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Remove intermediary documentation files

- Remove NAMING_REVIEW_SUMMARY.md (documented changes during PR, no longer needed)
- Remove DOTNET_BEST_PRACTICES_REVIEW.md (review completed, current state documented elsewhere)
- Remove .github/BRANCH_PROTECTION.md (setup guide, not needed for current state)
- Remove .github/CODEQL_SETUP_FIX.md (troubleshooting doc, issue resolved)
- Remove .github/SECURITY_SETUP.md (setup guide, security already configured)

All removed files documented the transition process but aren't needed to document the current project state. Essential documentation remains:
- README.md (project overview and quick start)
- SECURITY.md (security policy)
- docs/CONTRIBUTING.md (contribution guidelines)
- docs/CLI.md, docs/COMMANDS.md (usage documentation)
- .github/copilot-instructions.md (AI assistant integration)

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>
…lines (#2)

* Initial plan

* Fix GitHub workflow configuration issues - .NET version and package naming

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

* Add GitHub workflows configuration management guidelines to prevent sync issues

Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sbroenne <3026464+sbroenne@users.noreply.github.com>
@github-actions
Copy link

github-actions bot commented Oct 19, 2025

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 4 package(s) with unknown licenses.
See the Details below.

License Issues

tests/ExcelMcp.CLI.Tests/ExcelMcp.CLI.Tests.csproj

PackageVersionLicenseIssue Type
xunit>= 0NullUnknown License
xunit.runner.visualstudio>= 0NullUnknown License

tests/ExcelMcp.McpServer.Tests/ExcelMcp.McpServer.Tests.csproj

PackageVersionLicenseIssue Type
xunit>= 0NullUnknown License
xunit.runner.visualstudio>= 0NullUnknown License
Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/checkout 4.*.* 🟢 6.7
Details
CheckScoreReason
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/setup-dotnet 4.*.* 🟢 5.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
actions/actions/upload-artifact 4.*.* 🟢 4.8
Details
CheckScoreReason
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities⚠️ 19 existing vulnerabilities detected
actions/actions/checkout 4.*.* 🟢 6.7
Details
CheckScoreReason
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/setup-dotnet 4.*.* 🟢 5.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
actions/actions/upload-artifact 4.*.* 🟢 4.8
Details
CheckScoreReason
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool detected but not run on all commits
Vulnerabilities⚠️ 19 existing vulnerabilities detected
actions/actions/checkout 4.*.* 🟢 6.7
Details
CheckScoreReason
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/setup-dotnet 4.*.* 🟢 5.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
actions/actions/checkout 4.*.* 🟢 6.7
Details
CheckScoreReason
Maintained🟢 56 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ -1internal error: error during GetBranch(releases/v2): error during branchesHandler.query: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/setup-dotnet 4.*.* 🟢 5.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities🟢 73 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
nuget/Microsoft.CodeAnalysis.NetAnalyzers >= 0 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/Spectre.Console >= 0 UnknownUnknown
nuget/Microsoft.CodeAnalysis.NetAnalyzers >= 0 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/Microsoft.NET.Test.Sdk >= 0 🟢 5.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/xunit >= 0 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/30 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/xunit.runner.visualstudio >= 0 UnknownUnknown
nuget/Microsoft.CodeAnalysis.NetAnalyzers >= 0 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/Microsoft.NET.Test.Sdk >= 0 🟢 5.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/xunit >= 0 🟢 4.9
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/30 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/xunit.runner.visualstudio >= 0 UnknownUnknown

Scanned Files

  • .github/workflows/build-cli.yml
  • .github/workflows/build-mcp-server.yml
  • .github/workflows/build.yml
  • .github/workflows/release-cli.yml
  • .github/workflows/release-mcp-server.yml
  • .github/workflows/release.yml
  • src/ExcelMcp.CLI/ExcelMcp.CLI.csproj
  • src/ExcelMcp.McpServer/ExcelMcp.McpServer.csproj
  • src/ExcelMcp/ExcelMcp.csproj
  • tests/ExcelMcp.CLI.Tests/ExcelMcp.CLI.Tests.csproj
  • tests/ExcelMcp.McpServer.Tests/ExcelMcp.McpServer.Tests.csproj
  • tests/ExcelMcp.Tests/ExcelMcp.Tests.csproj

@sbroenne sbroenne self-assigned this Oct 19, 2025
Stefan Broenner added 2 commits October 19, 2025 13:47
…ove test output messages, and adjust dependency review settings
@sbroenne sbroenne merged commit a1d7adf into main Oct 19, 2025
5 checks passed
@sbroenne sbroenne deleted the cleanup branch October 19, 2025 12:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants