Enable transitive pinning and add daily driver dependency health workflow

[cheenamalhotra]

Description

Enable NuGet transitive pinning and add a daily, manually dispatchable driver-dependency-health agentic workflow.

• Enable CentralPackageTransitivePinningEnabled and replace the contradictory comment. Existing package versions are unchanged.
• Check the driver and related shipping libraries for central-version/dependency-graph mismatches and known vulnerabilities across supported frameworks.
• Propose the smallest policy-compliant stable fixes in draft PRs, without routine latest-version updates or automatic merging.
• Avoid duplicate update PRs, leave healthy runs unchanged, and report incomplete restores/audits rather than claiming success.

Only Directory.Packages.props, the workflow Markdown, and its compiled lock YAML are included. No scratch files, caches, logs, or unrelated generated changes.

Transitive pinning can promote dependencies into published NuGet dependency groups and raise consumer minimum versions. This is an intentional packaging-policy change requiring review before release.

Issues

No linked public issue.

Testing

• Compiled with gh-aw v0.88.2 twice; generated output was byte-identical.
• Workflow preparation/configuration checks and five PR-prefetch scenarios passed.
• Shipping-project restores passed with transitive pinning enabled.
• Explicit vulnerability audit was inconclusive locally due to TLS/NU1900/NU1905 errors; treated as failure, not a healthy result.
• Hosted execution has not yet been verified.

Guidelines

• Workflow source and generated lock file added together.
• Public API changes documented: none.
• Tests added or updated: no persistent test files; workflow checks executed locally.
• Verified against customer repro: not applicable.
• Ensure no breaking changes introduced: generated package dependency changes require review.

Operational requirements

Requires COPILOT_GITHUB_TOKEN and permission for GitHub Actions to create PRs. Maintainers must ensure required CI runs for workflow-created PRs. The daily schedule becomes active after merging to the default branch.

[Copilot]

🟡 Changes recommended

Transitive pins violate the repository’s TFM version policy, and incomplete daily runs can create unwanted issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Enables transitive dependency pinning and adds daily dependency-health automation.

Changes:

• Enables central transitive pinning.
• Adds dependency graph and vulnerability auditing.
• Generates draft dependency-fix PRs with validation and deduplication.

File summaries

File	Description
Directory.Packages.props	Enables transitive pinning.
.github/workflows/driver-dependency-health.md	Defines the scheduled audit workflow.
.github/workflows/driver-dependency-health.lock.yml	Contains the compiled executable workflow.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 2
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Incomplete audits can create unwanted issues, and Package-mode validation may not consume the locally packed siblings.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

.github/workflows/driver-dependency-health.md:113

• report-failure-as-issue: false does not suppress the auto-enabled report_incomplete handler. The compiled workflow confirms GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true", so the restore/audit failures routed to report_incomplete below will create daily issues despite this comment. Configure report-incomplete.create-issue: false as well, then recompile the lock file.

  report-incomplete:

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

[Copilot]

🔵 Needs a closer look

Transitive pinning changes published dependency floors, and the new workflow has not yet been validated in hosted execution.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

[Copilot]

🔵 Needs a closer look

Transitive pinning changes published dependency floors, and the extensive agentic workflow has not yet been validated in hosted execution.

Review details

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.18%. Comparing base (8387aeb) to head (6b0ae12).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4712      +/-   ##
==========================================
- Coverage   66.21%   64.18%   -2.03%     
==========================================
  Files         290      285       -5     
  Lines       45063    68081   +23018     
==========================================
+ Hits        29838    43699   +13861     
- Misses      15225    24382    +9157     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	64.18% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.