Manage dependencies with Central Package Management

[xiang17]

Why

Fixes #1974: Centralize dependency package versions.

What

Use Central Package Management
https://devblogs.microsoft.com/nuget/introducing-central-package-management/

Note1: the top comment in the article above says it's already supported by GitHub’s Dependabot, but I haven't been able to verify that or found any article in any other source.

Note2: I left a TODO comment on whether it's better to consolidate all packages in one ItemGroup and sort them alphabetically. I'd appreciate the community's feedback!

Tests

CI

Checklist

- [ ] CHANGELOG.md is updated.
- [ ] Documentation is updated.
- [ ] New features are covered by tests.

[pjanotti]

Hi @xiang17 - I had just a few minutes to look at it, I will finish it later today. Meanwhile, a few questions.

[Kielek]

I think that it will be good idea to reference here src\Directory.Packages.props
but without the section related to CommonExcludedAssets.props.
(Mainly to have OpenTelemetry* defined only in one place),

[xiang17]

I thought about that as well, but there are only four dependencies that are common:

# cat src/Directory.Packages.props test/Directory.Packages.props | sort | uniq -d | grep Version
    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.4.0-rc.2" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.0.0-rc9.11" />
    <PackageVersion Include="OpenTelemetry.Instrumentation.Wcf" Version="1.0.0-rc.8" />
    <PackageVersion Include="OpenTelemetry" Version="1.4.0-rc.2" />

I've put them into Directory.Packages.props file in the root folder.

[RassK]

this comment is wrong after uniting itemgroups.

[RassK]

Overall seems great!

[pellared]

After seeing PRs like this #2054 I think that too much has been moved to Central Package Management.

I think that the instrumented library version should be declared only in csproj.

[xiang17]

After seeing PRs like this #2054 I think that too much has been moved to Central Package Management.

I think that the instrumented library version should be declared only in csproj.

The purpose of the PR was to make it easier for upgrading versions, especially for shared dependencies used in multiple places. The opentelemetry-dotnet repo centralizes almost all versions because most of them are shared. However, the same might not apply to this repo seeing recent PRs.

I took a look at the recent dependabot PRs. Most of them are either in CommonExcludedAssets.props (9) or in tests/Directory.Packages.props (5).

The packages in tests/Directory.Packages.props file aren't shared much (the csproj files are in test/test-applications/integrations/). I can put them back.

Regarding CommonExcludedAssets.props, these seems like to be excluding packages of old versions not expected to be upgraded as new versions come by. I didn't manage to figure out how they got skipped by dependabot before. Shall I put the versions back to CommonExcludedAssets.props file as well?

[pellared]

@xiang17 I created #2068