Skip to content

Enable NuGet audit on public feed without private feed access #1128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BenjaminMichaelis merged 3 commits into from
May 18, 2026
+9 −5
Merged

Enable NuGet audit on public feed without private feed access #1128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
32f158e
Enable NuGet audit on public feed without private feed access
BenjaminMichaelis May 18, 2026
409c2da
Fix NuGetAuditSources to use nuget.org service index
BenjaminMichaelis May 18, 2026
ef04e36
Limit NuGet audit sources to nuget.org
BenjaminMichaelis May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
<ToolingPackagesVersion>1.1.1.19071</ToolingPackagesVersion>
<AccessToNugetFeed Condition="'$(AccessToNugetFeed)' == ''">false</AccessToNugetFeed>
<!-- Disable NuGet vulnerability audit when the private feed is unavailable (e.g. CI without credentials).
NuGet audit queries all sources in nuget.config regardless of RestoreSources, causing NU1900 which is
escalated to an error by TreatWarningsAsErrors. -->
<NuGetAudit Condition="'$(AccessToNugetFeed)' != 'true'">false</NuGetAudit>
<!-- Enable NuGet vulnerability audit on public nuget.org feed. Restrict to nuget.org's service index
to avoid NU1900 errors when the private Azure DevOps feed is unavailable (e.g. CI without credentials). -->
<NuGetAudit>true</NuGetAudit>
<NuGetAuditSources Condition="'$(AccessToNugetFeed)' != 'true'">https://api.nuget.org/v3/index.json</NuGetAuditSources>
</PropertyGroup>
<ItemGroup Condition="$(AccessToNugetFeed)">
<PackageVersion Include="ContentFeedNuget" Version="$(ToolingPackagesVersion)" />
Expand Down
2 changes: 1 addition & 1 deletion docs/getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ This guide will help you set up your local development environment for working o
For basic browsing and UI development, no secrets are needed. The database connection and HCaptcha test keys are already configured in `appsettings.Development.json`.

1. Clone the repository.
2. If you have access to the private NuGet feed, set `<AccessToNugetFeed>true</AccessToNugetFeed>` in [Directory.Packages.props](../Directory.Packages.props).
2. (Optional) If you have access to the private NuGet feed, set `<AccessToNugetFeed>true</AccessToNugetFeed>` in [Directory.Packages.props](../Directory.Packages.props) to include internal packages. Without this, the app runs with placeholder content but security audits still function.
3. Run the project.

> **Tip:** Use the [dotnet secret manager](https://learn.microsoft.com/en-us/aspnet/core/security/app-secrets#set-a-secret) for any secrets below:
Expand Down
4 changes: 4 additions & 0 deletions nuget.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@
<add key="nuget" value="https://api.nuget.org/v3/index.json" />
<add key="EssentialCSharp" value="https://pkgs.dev.azure.com/intelliTect/_packaging/EssentialCSharp/nuget/v3/index.json" />
</packageSources>
<auditSources>
<clear />
<add key="nuget" value="https://api.nuget.org/v3/index.json" />
</auditSources>
<packageSourceMapping>
<packageSource key="nuget">
<package pattern="*" />
Expand Down
Loading