[CPM] dotnet add package with --no-restore causes NU1008

[sbazant]

NuGet Product Used

dotnet.exe

Product Version

8.0.100-preview.3.23178.7

Worked before?

No response

Impact

I'm unable to use this version

Repro Steps & Context

1. Create empty project with dotnet new console
2. Add Directory.Packages.props file with

<Project>
  <PropertyGroup>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
</Project>

3. Add package with --no-restore option i.e. dotnet add package Newtonsoft.Json --no-restore
4. Run restore dotnet restore

Verbose Logs

C:\repos\test>dotnet add package --no-restore Newtonsoft.Json
info : X.509 certificate chain validation will use the default trust store selected by .NET.
info : X.509 certificate chain validation will use the default trust store selected by .NET.
info : Adding PackageReference for package 'Newtonsoft.Json' into project 'C:\repos\test\test.csproj'.
warn : --no-restore|-n flag was used. No compatibility check will be done and the added package reference will be unconditional.
info : PackageReference for package 'Newtonsoft.Json' version '*' added to file 'C:\repos\test\test.csproj'.

C:\repos\test>dotnet restore
  Determining projects to restore...
C:\repos\test\test.csproj : error NU1008: Projects that use central package version management should not define the version on the PackageReference items but on the PackageVersion items: Newtonsof
t.Json.
  Failed to restore C:\repos\test\test.csproj (in 129 ms).

[sbazant]

My project is under CI/CD where coverlet is being injected as one of the steps, and this injection step breaks the build

[zivkan]

Note to whoever works on this: The way dotnet add package is designed is to add the package with the floating version *, restore, check what version was actually restored, then change the * to the actually-installed version. I can't remember if it does a second restore to make the assets file up to date.

The implementation could just use NuGet.Protocol.SourceRepository to query the sources to see what versions are available, and skip the first restore.

[jeffkl]

Team Triage: CPM specifically does not support wildcards so at the very least we can block dotnet add package --no-restore with no version. At the moment, it appears that if you do specify a version, it does not update Directory.Packages.props.