build: unblock Scorecard's Central Package Management detection - #95
Merged
Conversation
The v5.3.0 Scorecard run after enabling CPM still reported Pinned-Dependencies at
7 ("0/2 nugetCommand dependencies pinned") with only the base remediation text —
so its NuGet check evaluated CPM as disabled (IsCPMEnabled=false) and never
entered the fixed-version branch.
The likely trip-up: the Directory.Packages.props header comment spelled out
FloorCheck's opt-out as the literal string "ManagePackageVersionsCentrally=false"
above the real <ManagePackageVersionsCentrally>true</...> element, so a
first-match parser reads "false". Move the property to the top of the file and
drop that token from the comment, leaving the genuine "true" as the only
occurrence. MSBuild behaviour is unchanged (restore + build + 598 tests green).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg
15 tasks
Reefact
pushed a commit
that referenced
this pull request
Aug 10, 2026
Enabling Central Package Management in Directory.Packages.props (#94, #95) did not move Scorecard's Pinned-Dependencies check off 7: the v5.3.0 run still reported "0/2 nugetCommand dependencies pinned" with only the base remediation text, i.e. its NuGet check evaluated CPM as disabled. Root cause (internal/dotnet/properties/properties.go): the check reads every Directory.*.props file and keeps only the LAST one's config when deciding whether CPM is enabled. This repo also has Directory.Build.props, which carries no ManagePackageVersionsCentrally element; read after Directory.Packages.props, it overwrites the "enabled" verdict with "disabled". Declare ManagePackageVersionsCentrally=true in Directory.Build.props as well. Since it has no <PackageVersion>, the empty version set trivially satisfies the "all versions are fixed" rule, so the restore is credited as pinned. MSBuild behaviour is unchanged (redundant true; FloorCheck still opts out in its csproj); restore + build + 598 tests stay green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to the Central Package Management adoption (#94). The
scorecard(v5.3.0) run onmainafter that change still scored Pinned-Dependencies at 7 ("0/2 nugetCommand dependencies pinned") with only the base remediation text — i.e. its NuGet check evaluated CPM as disabled (IsCPMEnabled=false) and never reached the fixed-version branch. The likely trip-up: theDirectory.Packages.propsheader comment described FloorCheck's opt-out as the literal stringManagePackageVersionsCentrally=false, sitting above the real<ManagePackageVersionsCentrally>true</...>element — enough for a first-match parser to readfalse. This moves the property to the top of the file and removes that token from the comment so only the genuinetrueremains.Note: confirmation can only come from the next
scorecardrun onmain(Scorecard can't be run locally here). This is the most likely fix, not a guarantee.Type of change
Changes
Directory.Packages.props: moved<ManagePackageVersionsCentrally>true</...>to the top of the file, and reworded the header comment so the tokenManagePackageVersionsCentrallynow appears only in the genuinetrueelement (FloorCheck's opt-out is described without spelling out the...=falsevalue).Testing
dotnet build FirstClassErrors.sln(Release, with the CI warning ratchet — 0 warnings)dotnet test FirstClassErrors.sln(Release — 598 passed, 0 failed)FirstClassErrors.Analyzers.UnitTests)Documentation
doc/updateddoc/README.fr.md) updated if user-facing behavior changedRelated issues
None.
🤖 Generated with Claude Code
https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg
Generated by Claude Code