From d5414cb2cf74b672681b4f6b9af7a00d8a4992ce Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 08:44:49 -0400 Subject: [PATCH 01/23] Create build-webgoat.yml --- .github/workflows/build-webgoat.yml | 51 +++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/workflows/build-webgoat.yml diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml new file mode 100644 index 000000000..b94e45335 --- /dev/null +++ b/.github/workflows/build-webgoat.yml @@ -0,0 +1,51 @@ +name: Manual WebGoat.NET Build + +# This configures the pipeline to be triggered manually from the Actions tab +on: + workflow_dispatch: + inputs: + build_configuration: + description: 'Build Configuration' + required: true + default: 'Release' + type: choice + options: + - Release + - Debug + +jobs: + build: + name: Build WebGoat.NET + runs-on: windows-latest + + steps: + # Step 1: Check out the repository code + - name: Checkout Code + uses: actions/checkout@v4 + + # Step 2: Setup MSBuild (required for legacy .NET Framework apps) + - name: Setup MSBuild + uses: microsoft/setup-msbuild@v2 + + # Step 3: Setup NuGet to restore dependencies + - name: Setup NuGet + uses: NuGet/setup-nuget@v2 + + # Step 4: Restore NuGet packages for the solution + - name: Restore NuGet Packages + run: nuget restore WebGoat.NET.sln + + # Step 5: Build the solution using MSBuild + - name: Build Solution + run: | + msbuild WebGoat.NET.sln /p:Configuration=${{ github.event.inputs.build_configuration }} /p:Platform="Any CPU" + + # Step 6: (Optional) Upload the build artifacts so you can download them + - name: Upload Build Artifacts + uses: actions/upload-artifact@v4 + with: + name: WebGoat-NET-Build-${{ github.event.inputs.build_configuration }} + path: | + **/bin/ + **/obj/ + From e3a287aa69d3aaf9f40c8d7727e3aa6dc2c584b3 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 08:51:26 -0400 Subject: [PATCH 02/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index b94e45335..56e190cd0 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -21,7 +21,7 @@ jobs: steps: # Step 1: Check out the repository code - name: Checkout Code - uses: actions/checkout@v4 + uses: actions/checkout@v4.2.2 # Step 2: Setup MSBuild (required for legacy .NET Framework apps) - name: Setup MSBuild From 7f3e8afcfa523b7f68dfcd63c270c41035d090ac Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:18:44 -0400 Subject: [PATCH 03/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 71 ++++++++++++++++------------- 1 file changed, 39 insertions(+), 32 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 56e190cd0..7fb19f853 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -1,51 +1,58 @@ -name: Manual WebGoat.NET Build +name: Build and Test Pipeline -# This configures the pipeline to be triggered manually from the Actions tab on: + push: + branches: [ main ] workflow_dispatch: - inputs: - build_configuration: - description: 'Build Configuration' - required: true - default: 'Release' - type: choice - options: - - Release - - Debug + +env: + SOLUTION: '**/*.sln' + BUILD_PLATFORM: 'Any CPU' + BUILD_CONFIGURATION: 'Release' + # Mapping Azure's $(build.artifactStagingDirectory) to a GitHub Actions workspace directory + ARTIFACT_STAGING_DIR: '${{ github.workspace }}\artifacts' jobs: build: - name: Build WebGoat.NET + name: Run Build and Test Steps runs-on: windows-latest steps: - # Step 1: Check out the repository code - name: Checkout Code - uses: actions/checkout@v4.2.2 + uses: actions/checkout@v4 - # Step 2: Setup MSBuild (required for legacy .NET Framework apps) - - name: Setup MSBuild + # Required for VSBuild/MSBuild and VSTest to be available in the command line + - name: Setup MSBuild and VS Test Tools uses: microsoft/setup-msbuild@v2 - # Step 3: Setup NuGet to restore dependencies - name: Setup NuGet uses: NuGet/setup-nuget@v2 - # Step 4: Restore NuGet packages for the solution - - name: Restore NuGet Packages - run: nuget restore WebGoat.NET.sln + - name: Restore Solution + run: nuget restore ${{ env.SOLUTION }} - # Step 5: Build the solution using MSBuild - - name: Build Solution - run: | - msbuild WebGoat.NET.sln /p:Configuration=${{ github.event.inputs.build_configuration }} /p:Platform="Any CPU" + - name: Custom NuGet Restore + run: nuget restore WebGoat/packages.config -PackagesDirectory packages -Verbosity Detailed - # Step 6: (Optional) Upload the build artifacts so you can download them - - name: Upload Build Artifacts - uses: actions/upload-artifact@v4 + - name: List packages directory + run: dir packages + shell: cmd + + - name: Set up Java 17 + uses: actions/setup-java@v4 with: - name: WebGoat-NET-Build-${{ github.event.inputs.build_configuration }} - path: | - **/bin/ - **/obj/ - + distribution: 'temurin' + java-version: '17' + architecture: x64 + + # Equivalent to: VSBuild@1 + - name: Build Solution (VSBuild equivalent) + run: | + mkdir "${{ env.ARTIFACT_STAGING_DIR }}" + msbuild ${{ env.SOLUTION }} /p:Configuration="${{ env.BUILD_CONFIGURATION }}" /p:Platform="${{ env.BUILD_PLATFORM }}" /p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="${{ env.ARTIFACT_STAGING_DIR }}" + + # Equivalent to: VSTest@2 + - name: Run VS Tests (VSTest equivalent) + run: | + vstest.console.exe "**\bin\${{ env.BUILD_CONFIGURATION }}\*test*.dll" /Platform:${{ env.BUILD_PLATFORM }} /Configuration:${{ env.BUILD_CONFIGURATION }} + From 95ad98e0b2900aadcb290fc909448677a8a8a3ad Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:22:47 -0400 Subject: [PATCH 04/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 7fb19f853..1f1a9d2c2 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -6,7 +6,7 @@ on: workflow_dispatch: env: - SOLUTION: '**/*.sln' + SOLUTION: 'WebGoat.NET.sln' BUILD_PLATFORM: 'Any CPU' BUILD_CONFIGURATION: 'Release' # Mapping Azure's $(build.artifactStagingDirectory) to a GitHub Actions workspace directory From ab39d8a8e81463c2b8023af5c8d36af49429cc78 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:27:06 -0400 Subject: [PATCH 05/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 1f1a9d2c2..87792540f 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -31,6 +31,11 @@ jobs: - name: Restore Solution run: nuget restore ${{ env.SOLUTION }} + # Add this right before the Custom NuGet Restore step to debug + - name: Find packages.config location + run: dir /s packages.config + shell: cmd + - name: Custom NuGet Restore run: nuget restore WebGoat/packages.config -PackagesDirectory packages -Verbosity Detailed From f75a72420916870e7c8c727d08d930f91028d4be Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:29:03 -0400 Subject: [PATCH 06/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 87792540f..b1894fd98 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -31,9 +31,8 @@ jobs: - name: Restore Solution run: nuget restore ${{ env.SOLUTION }} - # Add this right before the Custom NuGet Restore step to debug - - name: Find packages.config location - run: dir /s packages.config + - name: List Root Directory Files + run: dir shell: cmd - name: Custom NuGet Restore From 18cb0e53f6aa54784f5cbe71843beec880a8db29 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:32:03 -0400 Subject: [PATCH 07/23] Create packages.config --- WebGoat/packages.config | 55 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 WebGoat/packages.config diff --git a/WebGoat/packages.config b/WebGoat/packages.config new file mode 100644 index 000000000..f6b7100a7 --- /dev/null +++ b/WebGoat/packages.config @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From d54fa0f5221b96ba58ac7a0fabb3222b996423b1 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:38:35 -0400 Subject: [PATCH 08/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index b1894fd98..cb3a0aff0 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -49,6 +49,26 @@ jobs: java-version: '17' architecture: x64 + # Perform an evaluation + - name: Run evaluate action + id: evaluate + uses: sonatype/actions/evaluate@v1 + with: + iq-server-url: ${{ vars.SONATYPE_IQ_URL }} + username: ${{ secrets.SONATYPE_IQ_USERNAME }} + password: ${{ secrets.SONATYPE_IQ_PASSWORD }} + application-id: gha-webgoat.net + scan-targets: target/*.war + stage : build + sarif-file: 'result.sarif' + upload-sarif-file: 'true' + debug: false + # Print out the results + - name: Log evaluate action output + run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" + - name: Dump evaluate outputs + run: echo "${{ steps.evaluate.outputs }}" + # Equivalent to: VSBuild@1 - name: Build Solution (VSBuild equivalent) run: | @@ -56,7 +76,7 @@ jobs: msbuild ${{ env.SOLUTION }} /p:Configuration="${{ env.BUILD_CONFIGURATION }}" /p:Platform="${{ env.BUILD_PLATFORM }}" /p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="${{ env.ARTIFACT_STAGING_DIR }}" # Equivalent to: VSTest@2 - - name: Run VS Tests (VSTest equivalent) - run: | - vstest.console.exe "**\bin\${{ env.BUILD_CONFIGURATION }}\*test*.dll" /Platform:${{ env.BUILD_PLATFORM }} /Configuration:${{ env.BUILD_CONFIGURATION }} + #- name: Run VS Tests (VSTest equivalent) + # run: | + # vstest.console.exe "**\bin\${{ env.BUILD_CONFIGURATION }}\*test*.dll" /Platform:${{ env.BUILD_PLATFORM }} /Configuration:${{ env.BUILD_CONFIGURATION }} From 09d5c84ffac97a95a993279a4889dcc844fb24f0 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 09:57:28 -0400 Subject: [PATCH 09/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index cb3a0aff0..67dc0b7b9 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -58,7 +58,7 @@ jobs: username: ${{ secrets.SONATYPE_IQ_USERNAME }} password: ${{ secrets.SONATYPE_IQ_PASSWORD }} application-id: gha-webgoat.net - scan-targets: target/*.war + scan-targets: **/*.nupkg stage : build sarif-file: 'result.sarif' upload-sarif-file: 'true' From 60eddd2242bc6d13564b70c4cc511d8d35d234d3 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:00:07 -0400 Subject: [PATCH 10/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 67dc0b7b9..f9f341011 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -58,7 +58,7 @@ jobs: username: ${{ secrets.SONATYPE_IQ_USERNAME }} password: ${{ secrets.SONATYPE_IQ_PASSWORD }} application-id: gha-webgoat.net - scan-targets: **/*.nupkg + scan-targets: '**/*.nupkg' stage : build sarif-file: 'result.sarif' upload-sarif-file: 'true' From 76fdada17083495b81b43bac7ffd5dd0689437d3 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:06:58 -0400 Subject: [PATCH 11/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index f9f341011..4589b3676 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -51,7 +51,7 @@ jobs: # Perform an evaluation - name: Run evaluate action - id: evaluate + id: evaluate1 uses: sonatype/actions/evaluate@v1 with: iq-server-url: ${{ vars.SONATYPE_IQ_URL }} @@ -75,6 +75,26 @@ jobs: mkdir "${{ env.ARTIFACT_STAGING_DIR }}" msbuild ${{ env.SOLUTION }} /p:Configuration="${{ env.BUILD_CONFIGURATION }}" /p:Platform="${{ env.BUILD_PLATFORM }}" /p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="${{ env.ARTIFACT_STAGING_DIR }}" + # Perform an evaluation + - name: Run evaluate action + id: evaluate2 + uses: sonatype/actions/evaluate@v1 + with: + iq-server-url: ${{ vars.SONATYPE_IQ_URL }} + username: ${{ secrets.SONATYPE_IQ_USERNAME }} + password: ${{ secrets.SONATYPE_IQ_PASSWORD }} + application-id: gha-webgoat.net + scan-targets: '**/*.js, **/*.dll' + stage : stage-release + sarif-file: 'result.sarif' + upload-sarif-file: 'true' + debug: false + # Print out the results + - name: Log evaluate action output + run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" + - name: Dump evaluate outputs + run: echo "${{ steps.evaluate.outputs }}" + # Equivalent to: VSTest@2 #- name: Run VS Tests (VSTest equivalent) # run: | From be8b25de9d438870077dc44f97455a10bff6923c Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:21:13 -0400 Subject: [PATCH 12/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 4589b3676..7eb904b43 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -29,7 +29,9 @@ jobs: uses: NuGet/setup-nuget@v2 - name: Restore Solution - run: nuget restore ${{ env.SOLUTION }} + run: | + nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/npm-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + nuget restore ${{ env.SOLUTION }} - name: List Root Directory Files run: dir From 9f29ea22552c1669a9f7da2365e40611d9e3629f Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:23:29 -0400 Subject: [PATCH 13/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 7eb904b43..0dec7179d 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -30,7 +30,7 @@ jobs: - name: Restore Solution run: | - nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/npm-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget.org-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" nuget restore ${{ env.SOLUTION }} - name: List Root Directory Files From 767ef34e4332bbf932e56e80abe63dbd9ffd3a7b Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:25:03 -0400 Subject: [PATCH 14/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 36 ++++++++++++++--------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 0dec7179d..cff0a40c1 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -52,24 +52,24 @@ jobs: architecture: x64 # Perform an evaluation - - name: Run evaluate action - id: evaluate1 - uses: sonatype/actions/evaluate@v1 - with: - iq-server-url: ${{ vars.SONATYPE_IQ_URL }} - username: ${{ secrets.SONATYPE_IQ_USERNAME }} - password: ${{ secrets.SONATYPE_IQ_PASSWORD }} - application-id: gha-webgoat.net - scan-targets: '**/*.nupkg' - stage : build - sarif-file: 'result.sarif' - upload-sarif-file: 'true' - debug: false - # Print out the results - - name: Log evaluate action output - run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" - - name: Dump evaluate outputs - run: echo "${{ steps.evaluate.outputs }}" + #- name: Run evaluate action + # id: evaluate1 + # uses: sonatype/actions/evaluate@v1 + # with: + # iq-server-url: ${{ vars.SONATYPE_IQ_URL }} + # username: ${{ secrets.SONATYPE_IQ_USERNAME }} + # password: ${{ secrets.SONATYPE_IQ_PASSWORD }} + # application-id: gha-webgoat.net + # scan-targets: '**/*.nupkg' + # stage : build + # sarif-file: 'result.sarif' + # upload-sarif-file: 'true' + # debug: false + # # Print out the results + #- name: Log evaluate action output + # run: echo "${{ steps.evaluate.outputs.scan-id }} ${{ steps.evaluate.outputs.report-url }}" + #- name: Dump evaluate outputs + # run: echo "${{ steps.evaluate.outputs }}" # Equivalent to: VSBuild@1 - name: Build Solution (VSBuild equivalent) From 40c3584c299745afb758b5752d9b4e0525ab3605 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:29:12 -0400 Subject: [PATCH 15/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index cff0a40c1..92efbe670 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -30,7 +30,7 @@ jobs: - name: Restore Solution run: | - nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget.org-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" nuget restore ${{ env.SOLUTION }} - name: List Root Directory Files From ee6db5753c7e74495b584f6d73de22245720c581 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:36:40 -0400 Subject: [PATCH 16/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 92efbe670..6140366e9 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -37,9 +37,6 @@ jobs: run: dir shell: cmd - - name: Custom NuGet Restore - run: nuget restore WebGoat/packages.config -PackagesDirectory packages -Verbosity Detailed - - name: List packages directory run: dir packages shell: cmd From 162c8d615e963f92c0f3ba33f927925d0b6c8a5f Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:39:34 -0400 Subject: [PATCH 17/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 6140366e9..b0458a28a 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -28,9 +28,15 @@ jobs: - name: Setup NuGet uses: NuGet/setup-nuget@v2 - - name: Restore Solution + - name: Restore Solution via Nexus Proxy Only run: | + # 1. Wipe out all default machine-level feeds (like nuget.org) + nuget sources Clear + + # 2. Add your Nexus proxy as the exclusive source nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + + # 3. Run the restore nuget restore ${{ env.SOLUTION }} - name: List Root Directory Files From 8fd3621e5907abfe5d9946d603684bfac8500e2a Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:42:34 -0400 Subject: [PATCH 18/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index b0458a28a..4b3c1c0f6 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -28,16 +28,19 @@ jobs: - name: Setup NuGet uses: NuGet/setup-nuget@v2 + - name: Setup NuGet + uses: NuGet/setup-nuget@v2 + - name: Restore Solution via Nexus Proxy Only run: | - # 1. Wipe out all default machine-level feeds (like nuget.org) + # 1. Clear any machine-level fallback caches or sources nuget sources Clear - # 2. Add your Nexus proxy as the exclusive source + # 2. Register your authenticated Nexus instance nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" - # 3. Run the restore - nuget restore ${{ env.SOLUTION }} + # 3. CRITICAL: Explicitly pass the single allowed source to the restore engine + nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" - name: List Root Directory Files run: dir From 8c36e33cd49f18e7470d35b75eea4c6c541628f8 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:48:37 -0400 Subject: [PATCH 19/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 4b3c1c0f6..34f57a201 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -37,7 +37,7 @@ jobs: nuget sources Clear # 2. Register your authenticated Nexus instance - nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" + nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy-j4/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" # 3. CRITICAL: Explicitly pass the single allowed source to the restore engine nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" From 0327c99368863fe27a4d905935c9db2f0716abac Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:54:43 -0400 Subject: [PATCH 20/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 34f57a201..e6f1f305c 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -33,14 +33,11 @@ jobs: - name: Restore Solution via Nexus Proxy Only run: | - # 1. Clear any machine-level fallback caches or sources nuget sources Clear - - # 2. Register your authenticated Nexus instance nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy-j4/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" - # 3. CRITICAL: Explicitly pass the single allowed source to the restore engine - nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" + # Adding the Audit override flag here + nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" /p:NuGetAudit=false - name: List Root Directory Files run: dir From a0751b23c898aea0bc39b0502990a278a6595ab1 Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:56:53 -0400 Subject: [PATCH 21/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index e6f1f305c..d97979a44 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -36,8 +36,8 @@ jobs: nuget sources Clear nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy-j4/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" - # Adding the Audit override flag here - nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" /p:NuGetAudit=false + # FIX: Pass NuGetAudit=false using the proper -Property flag + nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" -Property NuGetAudit=false - name: List Root Directory Files run: dir From 26fc613bcd70b0238bd35580a002980415a47d8f Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:59:41 -0400 Subject: [PATCH 22/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index d97979a44..2b76ce5da 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -32,12 +32,14 @@ jobs: uses: NuGet/setup-nuget@v2 - name: Restore Solution via Nexus Proxy Only + env: + NuGetAudit: 'false' # Forces the audit engine off via the system environment run: | nuget sources Clear nuget sources Add -Name "NexusProxy" -Source "https://repo.bwhyte.ngrok.io/repository/nuget-proxy-j4/index.json" -UserName "${{ secrets.SONATYPE_IQ_USERNAME }}" -Password "${{ secrets.SONATYPE_NXRM_PASSWORD }}" - # FIX: Pass NuGetAudit=false using the proper -Property flag - nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" -Property NuGetAudit=false + # Kept clean without any extra flags to break the CLI parser + nuget restore ${{ env.SOLUTION }} -Source "NexusProxy" - name: List Root Directory Files run: dir From 35d1bd63df48b636c91d69593e93a32a2eb450de Mon Sep 17 00:00:00 2001 From: Bryan Whyte <3875675+bryanwhyte@users.noreply.github.com> Date: Thu, 2 Jul 2026 11:01:52 -0400 Subject: [PATCH 23/23] Update build-webgoat.yml --- .github/workflows/build-webgoat.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-webgoat.yml b/.github/workflows/build-webgoat.yml index 2b76ce5da..8339b3128 100644 --- a/.github/workflows/build-webgoat.yml +++ b/.github/workflows/build-webgoat.yml @@ -30,7 +30,7 @@ jobs: - name: Setup NuGet uses: NuGet/setup-nuget@v2 - + - name: Restore Solution via Nexus Proxy Only env: NuGetAudit: 'false' # Forces the audit engine off via the system environment