Update package lock, enforce locked restore in CI #31
Conversation
WalkthroughThe changes introduce caching for NuGet package restores in the GitHub Actions workflow, centralize package version management, and enforce the use of lock files and stable SDKs in the .NET build process. A lock file is added for a specific analyzer project, and build properties are updated to align with continuous integration best practices. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant .NET SDK Setup
participant MSBuild
participant NuGet
GitHub Actions->>.NET SDK Setup: Read SDK version from global.json
.NET SDK Setup->>.NET SDK Setup: Enable cache (based on packages.lock.json)
GitHub Actions->>MSBuild: Start build with CI properties
MSBuild->>NuGet: Restore packages (locked mode if CI)
NuGet-->>MSBuild: Use packages.lock.json for dependency resolution
MSBuild-->>GitHub Actions: Build completes with locked dependencies
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Assessment against linked issues
Assessment against linked issues: Out-of-scope changesNo out-of-scope changes found. Poem
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
global.json (1)
4-5: Confirm rollForward strategy to avoid unintended SDK jumpsWith allowPrerelease now false, consider narrowing rollForward to avoid silently moving to a future major SDK on dev machines.
Apply this diff if you prefer staying within 9.x feature bands:
- "rollForward": "latestMajor", + "rollForward": "latestFeature",.github/workflows/build.yml (1)
32-34: Broaden cache key inputs to reflect central package/version changesInclude central mgmt and config files so the NuGet cache invalidates when inputs change (e.g., Directory.Packages.props, NuGet.config, global.json).
Apply this diff:
with: global-json-file: global.json cache: 'true' - cache-dependency-path: '**/packages.lock.json' + cache-dependency-path: | + **/packages.lock.json + **/Directory.Packages.props + **/nuget.config + global.jsonAdditionally, consider making restore explicitly locked (the MSBuild property should already do it via CI=true, but this is belt-and-suspenders):
- run: dotnet restore + run: dotnet restore --locked-modeDirectory.Build.props (1)
3-6: CI-locked restore looks good; optionally add static graph for faster restoresLocked mode + lock files in CI is correct. For larger solutions, enabling static graph can speed restores.
<PropertyGroup> <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode> <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile> + <RestoreUseStaticGraphEvaluation>true</RestoreUseStaticGraphEvaluation> </PropertyGroup>
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/build.yml(1 hunks)Directory.Build.props(1 hunks)global.json(1 hunks)src/Escendit.Tools.CodeAnalysis.NetAnalyzers/packages.lock.json(1 hunks)
🔇 Additional comments (3)
src/Escendit.Tools.CodeAnalysis.NetAnalyzers/packages.lock.json (1)
1-35: All lock files and central package versions verified
- Directory.Packages.props exists and includes
<PackageVersion Include="Escendit.Tools.Branding" Version="1.2.0"/>.- Every .csproj has a corresponding packages.lock.json in its project directory.
RestoreLockedMode will succeed in CI.
Directory.Build.props (2)
11-12: CI metadata property is appropriateSetting ContinuousIntegrationBuild in CI is a good practice; it helps with deterministic/source-linked builds.
13-16: Central package management verified
- Directory.Packages.props exists at the repo root and contains a
<PackageVersion Include="Escendit.Tools.Branding" Version="1.2.0" />.- No missing central version was found for Escendit.Tools.Branding.
Everything referenced in your projects is centrally versioned. To further lock down transitive dependencies, you can enable transitive pinning:
<PropertyGroup> <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally> <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled> </PropertyGroup>
Closes #30
Summary by CodeRabbit