Enable Central Package Management and NuGetAudit (#325)

* Enable Central Package Management and NuGetAudit Contributes to dotnet/arcade#15019 * Delete eng/SourceBuildPrebuiltBaseline.xml * Don't hardcode package relative path
dotnet · Aug 27, 2024 · 4291030 · 4291030
1 parent d578f29
commit 4291030
Show file tree

Hide file tree

Showing 10 changed files with 56 additions and 26 deletions.
diff --git a/NuGet.config b/NuGet.config
@@ -6,6 +6,10 @@
     <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
     <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
   </packageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
   <disabledPackageSources>
     <clear />
   </disabledPackageSources>

diff --git a/eng/SourceBuild.props → eng/DotNetBuild.props b/eng/SourceBuild.props → eng/DotNetBuild.props
@@ -5,4 +5,5 @@
     <GitHubRepositoryName>symreader</GitHubRepositoryName>
     <SourceBuildManagedOnly>true</SourceBuildManagedOnly>
   </PropertyGroup>
+
 </Project>
diff --git a/eng/SourceBuildPrebuiltBaseline.xml b/eng/SourceBuildPrebuiltBaseline.xml
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
@@ -13,10 +13,6 @@
       <Uri>https://github.com/dotnet/arcade</Uri>
       <Sha>e3bdd9a0f2a65fe037ba1adb2261eea48a840fa4</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.XliffTasks" Version="9.0.0-beta.24426.3">
-      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>e3bdd9a0f2a65fe037ba1adb2261eea48a840fa4</Sha>
-    </Dependency>
     <!-- Intermediate is necessary for source build. -->
     <Dependency Name="Microsoft.SourceBuild.Intermediate.arcade" Version="9.0.0-beta.24426.3">
       <Uri>https://github.com/dotnet/arcade</Uri>

diff --git a/eng/Versions.props b/eng/Versions.props
@@ -7,8 +7,5 @@
     <UsingToolPdbConverter>false</UsingToolPdbConverter>
     <UsingToolNuGetRepack>true</UsingToolNuGetRepack>
     <FlagNetStandard1XDependencies>true</FlagNetStandard1XDependencies>
-    <!-- Pinned -->
-    <MicrosoftDiaSymReaderNativeVersion>17.0.0-beta1.21524.1</MicrosoftDiaSymReaderNativeVersion>
-    <SystemCollectionsImmutableVersion>7.0.0</SystemCollectionsImmutableVersion>
   </PropertyGroup>
 </Project>
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
@@ -9,6 +9,9 @@
 
     <!-- Any code that allows overflows intentionally should be explicitly in an unchecked region. -->
     <CheckForOverflowUnderflow Condition="'$(Configuration)' == 'Debug'">true</CheckForOverflowUnderflow>
+
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 
 </Project>
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
@@ -0,0 +1,24 @@
+<Project>
+
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+    <!-- Using multiple feeds isn't supported by Maestro: https://github.com/dotnet/arcade/issues/14155. -->
+    <NoWarn>$(NoWarn);NU1507</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Runtime dependencies -->
+    <PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
+
+    <!-- DiaSymReader dependency -->
+    <PackageVersion Include="Microsoft.DiaSymReader.Native" Version="17.0.0-beta1.21524.1" />
+  </ItemGroup>
+
+  <!-- External dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="xunit.assert" Version="$(XUnitVersion)" Condition="'$(IsTestUtilityProject)' == 'true'" />
+    <PackageVersion Include="xunit.extensibility.core" Version="$(XUnitVersion)" />
+  </ItemGroup>
+
+</Project>
diff --git a/src/Microsoft.DiaSymReader.Native.Tests/Microsoft.DiaSymReader.Native.UnitTests.csproj b/src/Microsoft.DiaSymReader.Native.Tests/Microsoft.DiaSymReader.Native.UnitTests.csproj
@@ -1,4 +1,5 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
   <PropertyGroup>
     <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@@ -7,26 +8,29 @@
       Testing 64bit only on Desktop suffixiently covers our interop code paths.  
     -->
     <TestArchitectures Condition="$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)')) == '.NETFramework'">x64;x86</TestArchitectures>
-
   </PropertyGroup>
+
   <ItemGroup>
-    <PackageReference Include="Microsoft.DiaSymReader.Native" Version="$(MicrosoftDiaSymReaderNativeVersion)" />
+    <PackageReference Include="Microsoft.DiaSymReader.Native" GeneratePathProperty="true" />
   </ItemGroup>
+
   <ItemGroup Condition="'$(OS)' == 'Windows_NT'">
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
       <Visible>false</Visible>
       <Link>Microsoft.DiaSymReader.Native.x86.dll</Link>
     </Content>
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
       <Visible>false</Visible>
       <Link>Microsoft.DiaSymReader.Native.amd64.dll</Link>
     </Content>
   </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
     <ProjectReference Include="..\PdbTestResources\PdbTestResources.csproj" />
     <ProjectReference Include="..\TestUtilities\TestUtilities.csproj" />
   </ItemGroup>
+
 </Project>
diff --git a/src/Microsoft.DiaSymReader.Tests/Microsoft.DiaSymReader.UnitTests.csproj b/src/Microsoft.DiaSymReader.Tests/Microsoft.DiaSymReader.UnitTests.csproj
@@ -1,4 +1,5 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
   <PropertyGroup>
     <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@@ -7,28 +8,30 @@
       Testing 64bit only on Desktop sufficiently covers our interop code paths.  
     -->
     <TestArchitectures Condition="$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)')) == '.NETFramework'">x64;x86</TestArchitectures>
-
-    <NoWarn>1701;1702;1705;1591;436</NoWarn>
   </PropertyGroup>
+
   <ItemGroup>
-    <PackageReference Include="Microsoft.DiaSymReader.Native" Version="$(MicrosoftDiaSymReaderNativeVersion)" />
+    <PackageReference Include="Microsoft.DiaSymReader.Native" GeneratePathProperty="true" />
   </ItemGroup>
+
   <ItemGroup Condition="'$(OS)' == 'Windows_NT'">
     <!-- Copy DSRN to a subdirectory of the output directory, so that we can test alternative load path -->
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
       <Visible>false</Visible>
       <Link>DSRN\Microsoft.DiaSymReader.Native.x86.dll</Link>
     </Content>
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
       <Visible>false</Visible>
       <Link>DSRN\Microsoft.DiaSymReader.Native.amd64.dll</Link>
     </Content>
   </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
     <ProjectReference Include="..\PdbTestResources\PdbTestResources.csproj" />
     <ProjectReference Include="..\TestUtilities\TestUtilities.csproj" />
   </ItemGroup>
+
 </Project>
diff --git a/src/TestUtilities/TestUtilities.csproj b/src/TestUtilities/TestUtilities.csproj
@@ -1,17 +1,22 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
   <PropertyGroup>
     <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <IsTestUtilityProject>true</IsTestUtilityProject>
   </PropertyGroup>
+
   <ItemGroup>
-    <PackageReference Include="xunit.assert" Version="$(XunitVersion)" />
-    <PackageReference Include="xunit.extensibility.core" Version="$(XunitVersion)" />
+    <PackageReference Include="xunit.assert" />
+    <PackageReference Include="xunit.extensibility.core" />
   </ItemGroup>
+
   <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
-    <PackageReference Include="System.Collections.Immutable" Version="$(SystemCollectionsImmutableVersion)" />
+    <PackageReference Include="System.Collections.Immutable" />
   </ItemGroup>
+
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
   </ItemGroup>
+
 </Project>