Skip to content

C#: Improve BMN feed checking & handling. #21684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
michaelnebel wants to merge 27 commits into
base: main
Choose a base branch
from
Open

C#: Improve BMN feed checking & handling. #21684

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
02332ca
Refactor `GetReachableNuGetFeeds` out of `GetReachableFallbackNugetFe…
mbg Feb 27, 2026
4f34fd6
Use `GetReachableNuGetFeeds` in `CheckSpecifiedFeeds`
mbg Feb 27, 2026
bf8ce4f
Inline `CheckFeeds`
mbg Feb 27, 2026
059a83c
Use `explicitFeeds` directly
mbg Feb 27, 2026
21a91df
Divide up `CheckSpecifiedFeeds`
mbg Feb 27, 2026
11a6888
Check reachability of inherited feeds
mbg Feb 27, 2026
db6bb11
Only use reachable feeds when private registries are configured
mbg Feb 27, 2026
72aca9d
C#: Turn checkNugetFeedResponsiveness into a field and remove some ex…
michaelnebel Apr 9, 2026
4b561aa
C#: Add private registries to the set of explicit feeds. Always use s…
michaelnebel Apr 9, 2026
aa8bd30
C#: Make sure that the feeds that excluded for the feed check (based …
michaelnebel Apr 9, 2026
925ad0b
C#: Remove redundant out parameter from CheckSpecifiedFeeds.
michaelnebel Apr 9, 2026
9ed4129
C#: Address review comments.
michaelnebel Apr 9, 2026
f2e746c
C#: Re-add the compilation information on reachable fallback NuGet fe…
michaelnebel Apr 9, 2026
93fcfe9
C#: For specific listed nuget feeds in a project, still allow their u…
michaelnebel Apr 10, 2026
6e1ef6f
C#: Simplify and improve the reachability check and improve the logging.
michaelnebel Apr 10, 2026
1713908
C#: Rename ExtraArgs to NugetSources.
michaelnebel Apr 10, 2026
83f9d8c
C#: Handle special case when no feeds are reachable.
michaelnebel Apr 10, 2026
5134bc4
C#: Only use the default package source when using nuget.exe if it is…
michaelnebel Apr 10, 2026
935b5a7
C#: Only include feeds that we can connect to.
michaelnebel Apr 10, 2026
10bcf2e
C#: Change the All NuGet feed reachable telemetry.
michaelnebel Apr 13, 2026
779cdc0
C#: Update integration test expected output.
michaelnebel Apr 13, 2026
1bb761a
C#: Add change-note.
michaelnebel Apr 10, 2026
dc6bbb0
C#: Address Copilots review comments.
michaelnebel Apr 13, 2026
81df3fc
C#: Address review comment.
michaelnebel Apr 22, 2026
b5ce4a8
C#: Also apply feed exclusions to inherited feeds.
michaelnebel Apr 22, 2026
3814c0a
C#: Add NuGet package missing failures to the compilation info.
michaelnebel Apr 22, 2026
f6f1f1a
C#: Update integration test expected output.
michaelnebel Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,9 +95,9 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
args += " /p:EnableWindowsTargeting=true";
}

if (restoreSettings.ExtraArgs is not null)
if (restoreSettings.NugetSources is not null)
{
args += $" {restoreSettings.ExtraArgs}";
args += $" {restoreSettings.NugetSources}";
}

return args;
Expand Down
5 changes: 4 additions & 1 deletion csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ public interface IDotNet
IList<string> GetNugetFeedsFromFolder(string folderPath);
}

public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? ExtraArgs = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? NugetSources = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);

public partial record class RestoreResult(bool Success, IList<string> Output)
{
Expand All @@ -33,6 +33,9 @@ public partial record class RestoreResult(bool Success, IList<string> Output)
private readonly Lazy<bool> hasNugetNoStablePackageVersionError = new(() => Output.Any(s => s.Contains("NU1103")));
public bool HasNugetNoStablePackageVersionError => hasNugetNoStablePackageVersionError.Value;

private readonly Lazy<bool> hasNugetPackageMissingError = new(() => Output.Any(s => s.Contains("NU1101")));
public bool HasNugetPackageMissingError => hasNugetPackageMissingError.Value;

private static IEnumerable<string> GetFirstGroupOnMatch(Regex regex, IEnumerable<string> lines) =>
lines
.Select(line => regex.Match(line))
Expand Down
4 changes: 2 additions & 2 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ internal class NugetExeWrapper : IDisposable
/// <summary>
/// Create the package manager for a specified source tree.
/// </summary>
public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger)
public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func<bool> useDefaultFeed)
{
this.fileProvider = fileProvider;
this.packageDirectory = packageDirectory;
Expand All @@ -43,7 +43,7 @@ public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDir
{
logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
nugetExe = ResolveNugetExe();
if (HasNoPackageSource())
if (HasNoPackageSource() && useDefaultFeed())
{
// We only modify or add a top level nuget.config file
nugetConfigPath = Path.Combine(fileProvider.SourceDir.FullName, "nuget.config");
Expand Down
331 changes: 212 additions & 119 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
6 changes: 4 additions & 2 deletions ...tegration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with package source error | 1.0 |
| All NuGet feeds reachable | 0.0 |
| Failed project restore with missing package error | 1.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Fallback nuget restore | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
4 changes: 4 additions & 0 deletions csharp/ql/lib/change-notes/2026-04-10-nuget-feed-usage-in-bmn.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: majorAnalysis
---
* When resolving dependencies in `build-mode: none`, `dotnet restore` now explicitly receives reachable NuGet feeds configured in `nuget.config` when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.
Loading