diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml new file mode 100644 index 000000000..8339b3128 --- /dev/null +++ b/.github/workflows/build-webgoat.yml @@ -0,0 +1,109 @@ +name: Build and Test Pipeline + +on: + push: + branches: [ main ] + workflow_dispatch: + +env: + SOLUTION: 'WebGoat.NET.sln' + BUILD_PLATFORM: 'Any CPU' + BUILD_CONFIGURATION: 'Release' + # Mapping Azure's $(build.artifactStagingDirectory) to a GitHub Actions workspace directory + ARTIFACT_STAGING_DIR: '${{ github.workspace }}\artifacts' + +jobs: + build: + name: Run Build and Test Steps + runs-on: windows-latest + + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + # Required for VSBuild/MSBuild and VSTest to be available in the command line + - name: Setup MSBuild and VS Test Tools + uses: microsoft/setup-msbuild@v2 + + - name: Setup NuGet + uses: NuGet/setup-nuget@v2 + + - name: Setup NuGet + uses: NuGet/setup-nuget@v2 + + - name: Restore Solution via Nexus Proxy Only + env: + NuGetAudit: 'false' # Forces the audit engine off via the system environment + run: | + nuget sources Clear + nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy-j4/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + + # Kept clean without any extra flags to break the CLI parser + nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" + + - name: List Root Directory Files + run: dir + shell: cmd + + - name: List packages directory + run: dir packages + shell: cmd + + - name: Set up Java 17 + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '17' + architecture: x64 + + # Perform an evaluation + #- name: Run evaluate action + # id: evaluate1 + # uses: sonatype/actions/evaluate@v1 + # with: + # iq-server-url: ${{ vars.SONATYPE_IQ_URL }} + # username: ${{ secrets.SONATYPE_IQ_USERNAME }} + # password: ${{ secrets.SONATYPE_IQ_PASSWORD }} + # application-id: gha-webgoat.net + # scan-targets: '**/*.nupkg' + # stage : build + # sarif-file: 'result.sarif' + # upload-sarif-file: 'true' + # debug: false + # # Print out the results + #- name: Log evaluate action output + # run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" + #- name: Dump evaluate outputs + # run: echo "${{ steps.evaluate.outputs }}" + + # Equivalent to: VSBuild@1 + - name: Build Solution (VSBuild equivalent) + run: | + mkdir "${{ env.ARTIFACT_STAGING_DIR }}" + msbuild ${{ env.SOLUTION }} /p:Configuration="${{ env.BUILD_CONFIGURATION }}" /p:Platform="${{ env.BUILD_PLATFORM }}" /p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="${{ env.ARTIFACT_STAGING_DIR }}" + + # Perform an evaluation + - name: Run evaluate action + id: evaluate2 + uses: sonatype/actions/evaluate@v1 + with: + iq-server-url: ${{ vars.SONATYPE_IQ_URL }} + username: ${{ secrets.SONATYPE_IQ_USERNAME }} + password: ${{ secrets.SONATYPE_IQ_PASSWORD }} + application-id: gha-webgoat.net + scan-targets: '**/*.js, **/*.dll' + stage : stage-release + sarif-file: 'result.sarif' + upload-sarif-file: 'true' + debug: false + # Print out the results + - name: Log evaluate action output + run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" + - name: Dump evaluate outputs + run: echo "${{ steps.evaluate.outputs }}" + + # Equivalent to: VSTest@2 + #- name: Run VS Tests (VSTest equivalent) + # run: | + # vstest.console.exe "**\bin\${{ env.BUILD_CONFIGURATION }}\*test*.dll" /Platform:${{ env.BUILD_PLATFORM }} /Configuration:${{ env.BUILD_CONFIGURATION }} + diff --git a/WebGoat/packages.config b/WebGoat/packages.config new file mode 100644 index 000000000..f6b7100a7 --- /dev/null +++ b/WebGoat/packages.config @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +