Add Skill: Convert to Central Package Management (convert-to-cpm)

[jeffhandley]

Introduce the convert-to-cpm skill, which guides the migration of .NET projects to NuGet Central Package Management (CPM). It provides detailed workflow steps, auditing guidance, validation procedures, error handling, and test scenarios for various conversion complexities.

Skill Evaluation: convert-to-cpm

SKILL.md Validation

Check	Result
Frontmatter name	✅ convert-to-cpm (14 chars, lowercase+hyphens)
Frontmatter description	✅ 294 chars (within 1-1024 limit)
Line count	✅ 97 lines (within 500 limit)
Directory name matches name	✅ skills/convert-to-cpm/
References	✅ 5 reference docs, all linked from SKILL.md
Test scenarios	✅ 6 scenarios across 3 difficulty levels

Test Solution Builds

Scenario	Build
simple-single-project	✅ Pass
simple-solution	✅ Pass
simple-packages-config	✅ Pass
moderate-version-conflicts	✅ Pass
moderate-msbuild-properties	✅ Pass
advanced-multi-complexity	✅ Pass

Scenario Evaluation: With-Skill vs Without-Skill

simple-single-project ✅

With-skill adds baseline build capture (-bl:baseline.binlog, baseline-packages.json), CPM existence check, structured audit presentation, user interaction about placement, dotnet new packagesprops, post-conversion comparison table, and binlog references. Without skill, the agent just creates the file and says "Done!" — no audit, no comparison, no validation rigor.

simple-solution ✅

With-skill runs dotnet sln list, establishes baseline, presents a 6-package audit table, preserves PrivateAssets="all", produces comparison tables. Without-skill skips baseline capture, doesn't present audit results, and gives a terse summary.

simple-packages-config ✅

With-skill correctly detects packages.config, refuses to proceed, and recommends Visual Studio migration. Without-skill incorrectly creates Directory.Packages.props despite the project using packages.config — the skill prevents a harmful action.

moderate-version-conflicts ✅

With-skill detects both version conflicts (System.Text.Json 10.0.1 vs 8.0.4, Azure.Identity 1.13.2 vs 1.10.0), flags CVE-2024-43485 on 8.0.4, and asks the user for each conflict before proceeding. Uses VersionOverride when requested. Without-skill silently picks highest version without asking and doesn't mention the security advisory.

moderate-msbuild-properties ✅

With-skill traces $(OTelVersion) and $(DIVersion) to Directory.Build.props, presents a table showing property vs. literal sources, asks about inline vs. keep for each property, preserves unrelated $(OutputPath), verifies no remaining references. Without-skill silently inlines everything without asking.

advanced-multi-complexity ✅

With-skill audits all 6 complexities (3-way version conflict, Azure.Storage.Blobs mismatch, 2 MSBuild properties, conditional PackageReference, shared props file, non-version properties), asks about each decision point separately, uses conditional PackageVersion for Mvc.NewtonsoftJson, keeps $(HostingVersion) as property, moves Microsoft.Extensions.Logging from Common.props, preserves $(LangVersion) and $(ImplicitUsings). Without-skill silently bumps everything to latest without asking about any decisions.

Key Differentiators

Behavior	Without Skill	With Skill
Baseline build capture	❌ Skipped	✅ binlog + packages.json
Package audit presentation	❌ No audit	✅ Structured table
Version conflict handling	❌ Silently picks highest	✅ Asks user, offers options
Security advisory awareness	❌ Not mentioned	✅ Flags CVE-2024-43485
MSBuild property tracing	❌ Silently inlines	✅ Traces + asks inline/keep
packages.config guard	❌ Creates files anyway	✅ Refuses, suggests migration
Post-conversion comparison	❌ Just "Build succeeded"	✅ Changes + Unchanged tables
Non-version property safety	❌ Not addressed	✅ Explicitly preserves
VersionOverride usage	❌ Not used	✅ With user confirmation
Binlog artifacts mention	❌ Not mentioned	✅ Links to MSBuild viewer

Behavior Traceability

All key behaviors in the with-skill.md files are traceable to the SKILL.md or its reference docs:

Behavior	Source
Baseline capture commands	Step 2 → baseline-comparison.md
Post-conversion capture commands	Step 8 → baseline-comparison.md
MSBuild property cleanup + grep verify	Step 7 → msbuild-property-handling.md
Binlog/MSBuild Log Viewer mention	Step 9 → baseline-comparison.md
Comparison table format (Changes/Unchanged)	Step 9 → baseline-comparison.md
packages.config guard	"When Not to Use" section
Version conflict + CVE flagging	Step 4 → audit-complexities.md
VersionOverride with user confirmation	Step 6
Conditional PackageVersion	Step 5 → directory-packages-props.md
Preserve non-version properties	Step 7 → msbuild-property-handling.md

[Copilot]

Pull request overview

This PR introduces the convert-to-cpm skill to guide developers through migrating .NET projects to NuGet Central Package Management (CPM). The skill provides a structured workflow for centralizing package versions into a Directory.Packages.props file, handling version conflicts, MSBuild property decisions, and validation procedures.

Changes:

• Added convert-to-cpm skill with comprehensive SKILL.md (96 lines) and 5 reference documentation files covering validation, MSBuild properties, Directory.Packages.props creation, baseline comparison, and audit complexities
• Created 6 test scenarios across 3 difficulty levels (simple, moderate, advanced) demonstrating skill effectiveness with and without the skill loaded
• Included .gitignore configuration for generated test solutions

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
skills/convert-to-cpm/SKILL.md	Main skill definition with frontmatter, workflow steps, and validation checklist (96 lines, under 500 limit)
skills/convert-to-cpm/references/validation-and-errors.md	NuGet error codes and validation procedures for CPM conversion
skills/convert-to-cpm/references/msbuild-property-handling.md	Guidance for handling MSBuild properties during conversion
skills/convert-to-cpm/references/directory-packages-props.md	Instructions for creating and structuring Directory.Packages.props
skills/convert-to-cpm/references/baseline-comparison.md	Procedures for capturing and comparing package versions before/after conversion
skills/convert-to-cpm/references/audit-complexities.md	Checklist of complexities to identify during package reference auditing
tests/convert-to-cpm/README.md	Overview of test scenarios and evaluation instructions
tests/convert-to-cpm/.gitignore	Excludes generated test solutions from version control
tests/convert-to-cpm/simple-single-project/*	Test scenario for single-project conversion with example outputs
tests/convert-to-cpm/simple-solution/*	Test scenario for multi-project solution conversion
tests/convert-to-cpm/simple-packages-config/*	Test scenario demonstrating skill's refusal to convert packages.config projects
tests/convert-to-cpm/moderate-version-conflicts/*	Test scenario for handling version conflicts across projects
tests/convert-to-cpm/moderate-msbuild-properties/*	Test scenario for MSBuild property handling decisions
tests/convert-to-cpm/advanced-multi-complexity/*	Complex test scenario combining multiple conversion challenges

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jeffhandley]

I used Copilot to find a good community repository where CPM migration could be particularly valuable, and it identified the Blazam-App/BLAZAM repository.

• It's actively maintained, PRs are welcomed and tend to be accepted
• There's nothing in the repo that signals the maintainer might be opposed to adopting CPM
• It has a lot of projects and a lot of packages shared across them
• There is a history of PRs that bump package versions
• There is a mixture of Microsoft and community packages, including some that are updated regularly
• The repository has activity from the community, but it's not a widely recognized project

I committed 0d60430 to incorporate the feedback the exercise produced.