Repository navigation
C#: Don't use the NuGet CLI for restoring packages.config in case private registries are configured. - #22911
C#: Don't use the NuGet CLI for restoring packages.config in case private registries are configured.#22911michaelnebel wants to merge 2 commits into
packages.config in case private registries are configured.#22911Conversation
There was a problem hiding this comment.
🟡 Changes recommended
On Mono-enabled runners with private feeds, the fallback can omit valid multiline packages.config entries and discard pinned versions, leaving dependencies missing or resolving incompatible versions.
2 open issues
What changed in this PR
This PR changes C# extractor dependency restoration to avoid the NuGet CLI when private registries are configured, relying instead on the existing dotnet fallback.
Changes:
- Disable NuGet CLI restoration when private feeds are present.
- Update logging to include private feeds as a reason for skipping NuGet CLI restoration.
- Add a change note describing the fallback behavior.
| File | Description |
|---|---|
csharp/ql/lib/change-notes/2026-10-28-nugetcli-proxy-config.md |
Documents the restore behavior for private registries. |
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs |
Adds the private-feed guard and updates skip logging. |
Review effort: Max
| public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) | ||
| { | ||
| if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) | ||
| if ((SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) && !feedManager.HasPrivateRegistryFeeds) |
There was a problem hiding this comment.
When private registries are configured, we assume that these registries will contain the access to the bulk of the dependencies, which means that any attempt to restore a package using the NuGet CLI will most likely fail with an unauthorized error.
It would be a good improvement, if we also made the dotnet restore logic version aware, but it is out of scope for this PR.
| public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager) | ||
| { | ||
| if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) | ||
| if ((SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled()) && !feedManager.HasPrivateRegistryFeeds) |
There was a problem hiding this comment.
That is a good point (co-incidentally I was looking into converting the FileContent parser to XML as well), but that is a general improvement as well and out of scope for this PR.
No description provided.