ci: use NuGet lock file for deterministic dotnet restore in typespec-vs#10849
Draft
timotheeguerin wants to merge 1 commit into
Draft
ci: use NuGet lock file for deterministic dotnet restore in typespec-vs#10849timotheeguerin wants to merge 1 commit into
timotheeguerin wants to merge 1 commit into
Conversation
Contributor
|
❌ There is undocummented changes. Run The following packages have changes but are not documented.
Show changes |
timotheeguerin
force-pushed
the
fix/dotnet-restore-no-cache
branch
from
c59e1d2 to
f495a0b
Compare
timotheeguerin
changed the title
microsoft-github-policy-service
Bot
added
the
ide
commit: |
timotheeguerin
force-pushed
the
fix/dotnet-restore-no-cache
branch
from
f495a0b to
3687486
Compare
|
You can try these changes here
|
Add packages.lock.json and use --locked-mode in CI to ensure deterministic NuGet package resolution that matches what developers see locally, preventing cache-induced discrepancies between CI and publish agents. Also fix NU1603 warnings from Microsoft.VisualStudio.Workspace transitive dependencies by adding NoWarn on the affected packages. The declared minimum versions (17.10.39, 17.10.40224) were never published to nuget.org — this is a known VS SDK packaging issue. Changes: - Add RestorePackagesWithLockFile to csproj - Add NoWarn=NU1603 to Workspace package references - Commit packages.lock.json - Use dotnet restore --locked-mode in CI and publish pipelines - Add .gitignore exception for the lock file
timotheeguerin
force-pushed
the
fix/dotnet-restore-no-cache
branch
from
3687486 to
65b728e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
PR #10824 introduced a regression in the publish pipeline where
dotnet restorefails with NU1603 errors. CI didn't catch this because NuGet's global packages cache on GitHub Actions runners resolved transitive dependencies from previously cached packages.Root Cause
Microsoft.VisualStudio.Workspace 17.12.19declares dependencies on versions that were never published to nuget.org:Microsoft.VisualStudio.Composition >= 17.10.39(doesn't exist; 17.10.37 → 17.11.13)Microsoft.VisualStudio.Shell.15.0 >= 17.10.40224(doesn't exist; jumps to 17.11.40262)This is a known VS SDK packaging issue. NuGet resolves to higher versions but emits NU1603, which errors out due to
TreatWarningsAsErrors.Fix
Lock file for deterministic CI restores: Add
RestorePackagesWithLockFile+ commitpackages.lock.json+ use--locked-modein CI/publish pipelines. This ensures resolution is validated at dev time (when updating the lock file) and CI uses exact pinned versions.Suppress NU1603 on affected packages: Add
NoWarn="NU1603"to theWorkspaceandWorkspace.VSIntegrationPackageReferences — targeted suppression for this known VS SDK issue.Changes
packages/typespec-vs/src/Microsoft.TypeSpec.VS.csproj: AddRestorePackagesWithLockFile, addNoWarn="NU1603"to Workspace refspackages/typespec-vs/src/packages.lock.json: New lock file (committed).github/workflows/core-ci.yml: Usedotnet restore --locked-modeeng/tsp-core/pipelines/templates/install.yml: Usedotnet restore --locked-mode.gitignore: Exception for the NuGet lock file