Cache NuGet packages, enable lock files and package validation - #373
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #373 +/- ##
=======================================
Coverage 98.01% 98.01%
=======================================
Files 39 39
Lines 52799 52799
Branches 1103 1103
=======================================
Hits 51751 51751
Misses 795 795
Partials 253 253 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
📊 Benchmark Results
PR branch
PR base
|
twcclegg
marked this pull request as ready for review
August 5, 2026 17:44
This was referenced Aug 14, 2026
Closed
Closed
This was referenced Aug 23, 2026
Closed
Closed
This was referenced Aug 27, 2026
Closed
Closed
This was referenced Sep 4, 2026
Closed
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three build/CI changes. No shipped code is affected.
build: cache nuget packages in ci and enable restore lock files~/.nuget/packagesis cached in the four workflows that run on every PR. Central Package Managementputs every version in one file, so the key is a hash of
Directory.Packages.propsplus the projectfiles.
Deliberately not added to
publish_nuget.yml: the release path should resolve from nuget.orgrather than a mutable, branch-writable cache. A few seconds aren't worth putting a cache into the
supply chain of a published artifact.
build: enable package validation on the packable projectsPack now fails on a breaking public API change, which turns "no breaking changes" from a policy into
a build gate. That matters most because releases are cut automatically by
create_new_release_on_new_metadata_update.ymlwith nobody reviewing the API surface.PackageValidationBaselineVersionis intentionally unset. 9.0.36 ships alib/net9.0/asset thispackage no longer produces, so baselining against it would flag the dropped target framework and
require a permanent suppression. Setting it to the first release without net9.0 avoids that
entirely. Until then validation still runs its within-package check, verifying every target
framework exposes a consistent public surface — which is how a net8-only public member would
otherwise slip in.
build: commit restore lock files and check them in cipackages.lock.jsonfor six projects, pinning the full transitive graph with content hashes, anddotnet restore --locked-modein CI so a restore can never quietly resolve a different transitiveversion than the lock file records.
PhoneNumbers.TestandPhoneNumbers.Extensions.Testare opted out. Their TFM lists areOS-conditional (
netframework4.8only on Windows), so a lock file generated on Linux omits aframework a Windows contributor would restore — rewriting the file in normal mode and failing under
locked mode. A lock file whose contents depend on who restored it is worse than none, so those two
keep dynamic restore.
The files were generated by CI rather than locally: a temporary artifact-upload step ran on this
branch, and the step was removed once they were committed. That flow means refreshing them never
requires a local dotnet install.
Worth watching: the first Dependabot PR after this. If Dependabot doesn't update
packages.lock.jsonalongsideDirectory.Packages.props, its restore will fail under locked mode —visibly, not silently. That's the point to add a dispatchable regeneration workflow, rather than
building one speculatively now.