Skip to content

C#: Improve BMN feed checking & handling. #21684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
michaelnebel wants to merge 31 commits into
base: main
Choose a base branch
from
Draft

C#: Improve BMN feed checking & handling. #21684

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
d22381a
Refactor `GetReachableNuGetFeeds` out of `GetReachableFallbackNugetFe…
mbg Feb 27, 2026
439e37a
Use `GetReachableNuGetFeeds` in `CheckSpecifiedFeeds`
mbg Feb 27, 2026
8215737
Inline `CheckFeeds`
mbg Feb 27, 2026
fdbaba8
Use `explicitFeeds` directly
mbg Feb 27, 2026
9898e21
Divide up `CheckSpecifiedFeeds`
mbg Feb 27, 2026
17c45fc
Check reachability of inherited feeds
mbg Feb 27, 2026
cce5f06
Only use reachable feeds when private registries are configured
mbg Feb 27, 2026
132dc1f
C#: Turn checkNugetFeedResponsiveness into a field and remove some ex…
michaelnebel Apr 9, 2026
365b419
C#: Add private registries to the set of explicit feeds. Always use s…
michaelnebel Apr 9, 2026
4dad62c
C#: Make sure that the feeds that excluded for the feed check (based …
michaelnebel Apr 9, 2026
c53b2f5
C#: Remove redundant out parameter from CheckSpecifiedFeeds.
michaelnebel Apr 9, 2026
b95a8aa
C#: Address review comments.
michaelnebel Apr 9, 2026
21fb44d
C#: Re-add the compilation information on reachable fallback NuGet fe…
michaelnebel Apr 9, 2026
1dfe30d
C#: For specific listed nuget feeds in a project, still allow their u…
michaelnebel Apr 10, 2026
8369c92
C#: Simplify and improve the reachability check and improve the logging.
michaelnebel Apr 10, 2026
1ee6d63
C#: Rename ExtraArgs to NugetSources.
michaelnebel Apr 10, 2026
e6df1d8
C#: Handle special case when no feeds are reachable.
michaelnebel Apr 10, 2026
c0a1dd0
C#: Only use the default package source when using nuget.exe if it is…
michaelnebel Apr 10, 2026
8372a37
C#: Only include feeds that we can connect to.
michaelnebel Apr 10, 2026
6f888f1
C#: Change the All NuGet feed reachable telemetry.
michaelnebel Apr 13, 2026
597f3fa
C#: Update integration test expected output.
michaelnebel Apr 13, 2026
b7e3e6c
C#: Add change-note.
michaelnebel Apr 10, 2026
ca0c274
C#: Address Copilots review comments.
michaelnebel Apr 13, 2026
5ff4b43
C#: Address review comment.
michaelnebel Apr 22, 2026
9bd4f65
C#: Also apply feed exclusions to inherited feeds.
michaelnebel Apr 22, 2026
831b4d6
C#: Add NuGet package missing failures to the compilation info.
michaelnebel Apr 22, 2026
a6d1cca
C#: Update integration test expected output.
michaelnebel Apr 22, 2026
ed857ad
C#: Make the restore sources project/solution specific.
michaelnebel Apr 24, 2026
ae81f3a
C#: Inherited feeds may not get properly computed if a nuget.config f…
michaelnebel Apr 24, 2026
615ae41
C#: Address review comments.
michaelnebel Apr 27, 2026
67aa342
C#: Update test expected output for integration tests.
michaelnebel Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,9 +95,9 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
args += " /p:EnableWindowsTargeting=true";
}

if (restoreSettings.ExtraArgs is not null)
if (restoreSettings.NugetSources is not null)
{
args += $" {restoreSettings.ExtraArgs}";
args += $" {restoreSettings.NugetSources}";
}

return args;
Expand Down
5 changes: 4 additions & 1 deletion csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ public interface IDotNet
IList<string> GetNugetFeedsFromFolder(string folderPath);
}

public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? ExtraArgs = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? NugetSources = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);

public partial record class RestoreResult(bool Success, IList<string> Output)
{
Expand All @@ -33,6 +33,9 @@ public partial record class RestoreResult(bool Success, IList<string> Output)
private readonly Lazy<bool> hasNugetNoStablePackageVersionError = new(() => Output.Any(s => s.Contains("NU1103")));
public bool HasNugetNoStablePackageVersionError => hasNugetNoStablePackageVersionError.Value;

private readonly Lazy<bool> hasNugetPackageMissingError = new(() => Output.Any(s => s.Contains("NU1101")));
public bool HasNugetPackageMissingError => hasNugetPackageMissingError.Value;

private static IEnumerable<string> GetFirstGroupOnMatch(Regex regex, IEnumerable<string> lines) =>
lines
.Select(line => regex.Match(line))
Expand Down
4 changes: 2 additions & 2 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ internal class NugetExeWrapper : IDisposable
/// <summary>
/// Create the package manager for a specified source tree.
/// </summary>
public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger)
public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, Func<bool> useDefaultFeed)
{
this.fileProvider = fileProvider;
this.packageDirectory = packageDirectory;
Expand All @@ -43,7 +43,7 @@ public NugetExeWrapper(FileProvider fileProvider, DependencyDirectory packageDir
{
logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
nugetExe = ResolveNugetExe();
if (HasNoPackageSource())
if (HasNoPackageSource() && useDefaultFeed())
{
// We only modify or add a top level nuget.config file
nugetConfigPath = Path.Combine(fileProvider.SourceDir.FullName, "nuget.config");
Expand Down
388 changes: 255 additions & 133 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_resx/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_slnx/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
2 changes: 2 additions & 0 deletions csharp/ql/integration-tests/all-platforms/standalone_winforms/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with missing package error | 0.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
Expand Down
7 changes: 5 additions & 2 deletions ...tegration-tests/posix/standalone_dependencies_nuget_config_error/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
| All NuGet feeds reachable | 1.0 |
| Failed project restore with package source error | 1.0 |
| All NuGet feeds reachable | 0.0 |
| Failed project restore with missing package error | 1.0 |
| Failed project restore with package source error | 0.0 |
| Failed solution restore with missing package error | 0.0 |
| Failed solution restore with package source error | 0.0 |
| Fallback nuget restore | 1.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
| Project files on filesystem | 1.0 |
| Reachable fallback NuGet feed count | 1.0 |
Expand Down
1 change: 1 addition & 0 deletions ...ration-tests/posix/standalone_dependencies_nuget_config_fallback/CompilationInfo.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| All NuGet feeds reachable | 0.0 |
| Fallback nuget restore | 1.0 |
| Inherited NuGet feed count | 1.0 |
| NuGet feed responsiveness checked | 1.0 |
| Project files on filesystem | 1.0 |
| Reachable fallback NuGet feed count | 2.0 |
Expand Down
4 changes: 4 additions & 0 deletions csharp/ql/lib/change-notes/2026-04-10-nuget-feed-usage-in-bmn.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: majorAnalysis
---
* When resolving dependencies in `build-mode: none`, `dotnet restore` now explicitly receives reachable NuGet feeds configured in `nuget.config` when feed responsiveness checking is enabled (the default), and any private registries directly, improving reliability when default feeds are unavailable or restricted.
Loading