fix(ci): block nuget publish on missing dependencies#2009
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a dependency-availability gate to the nuget.org publishing path so releases fail fast when required package versions are not yet available on nuget.org (including template packages.json and depth-1 transitive checks).
Changes:
- Introduce
build/Verify-NuGetDependenciesOnNuGetOrg.ps1to extract exact dependencies from packed artifacts and verify availability on nuget.org with retries/timeouts and GitHub step summary output. - Wire the verification script into the
.github/actions/ci/nuget-org-publishcomposite action beforedotnet nuget push. - Ignore a new
.local-test/folder in.gitignore.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| build/Verify-NuGetDependenciesOnNuGetOrg.ps1 | New verification script that inspects nupkg contents and blocks nuget.org publish if dependencies aren’t available. |
| .github/actions/ci/nuget-org-publish/action.yml | Adds the dependency verification step ahead of the NuGet push step. |
| .gitignore | Ignores .local-test/ directory. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
8516b04 to
a541d29
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add a pre-publish dependency verification step for NuGet.org packages and keep retries/timeouts configurable. Improve package catalog handling by processing all versionOverride target frameworks dynamically instead of hardcoding net10.0. Expand transitive dependency checks with retried nuspec retrieval that fails closed on exhaustion, and aggregate all dependency sources for clearer missing-dependency diagnostics.
a541d29 to
dd206e6
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This change adds a pre-publish dependency gate to the nuget.org release path so package publishing fails fast when required dependency versions are not yet available on nuget.org.
It is needed to prevent shipping templates/SDK that reference unresolved package versions (the internal-feed-only version failure pattern) and to provide clear diagnostics through logs and GitHub step summary.
The implementation verifies exact dependencies from packed artifacts (
.nuspec+ packagedpackages.json) and expands transitive checks (depth 1) with retries and HTTP timeout control beforedotnet nuget push.All
versionOverridetarget framework keys inpackages.jsonare also validated, so future additions likenet11.0are automatically covered without script changes.Note: No related issue (Internal maintenance / Approved by Team member: @agneszitte).