I'm trying to set up an ADO pipeline that does the following:

• Attempts a dotnet restore using only our approved and verified package feed
• If that fails, attempts a dotnet restore using public feeds

The reasoning here is that we want to allow using packages we haven't approved yet except on official release builds, but want developers to know that they need to request approval.

I've set up two DotNetCoreCLI@2 tasks which I think should work:

  - task: DotNetCoreCLI@2
    displayName: "Restore using official sources"
    continueOnError: true
    inputs:
      command: 'restore'
      feedsToUse: 'config'
      nugetConfigPath: '$(Agent.BuildDirectory)/templates/nuget.official.config'
      noCache: true

  - task: DotNetCoreCLI@2
    displayName: "Restore using development sources"
    inputs:
      command: 'restore'
      feedsToUse: 'config'
      nugetConfigPath: '$(Agent.BuildDirectory)/templates/nuget.dev.config'

However, I'm finding this doesn't work in the oddest way - the second task uses the exact same config as the first. It seems the DotNetCoreCLI task decides it doesn't need to rewrite the config file.

Is there something I'm missing, or some other way to achieve what I'm trying to achieve?

I'm trying to set up an ADO pipeline that does the following:

• Attempts a dotnet restore using only our approved and verified package feed
• If that fails, attempts a dotnet restore using public feeds

The reasoning here is that we want to allow using packages we haven't approved yet except on official release builds, but want developers to know that they need to request approval.

I've set up two DotNetCoreCLI@2 tasks which I think should work:

  - task: DotNetCoreCLI@2
    displayName: "Restore using official sources"
    continueOnError: true
    inputs:
      command: 'restore'
      feedsToUse: 'config'
      nugetConfigPath: '$(Agent.BuildDirectory)/templates/nuget.official.config'
      noCache: true

  - task: DotNetCoreCLI@2
    displayName: "Restore using development sources"
    inputs:
      command: 'restore'
      feedsToUse: 'config'
      nugetConfigPath: '$(Agent.BuildDirectory)/templates/nuget.dev.config'

However, I'm finding this doesn't work in the oddest way - the second task uses the exact same config as the first. It seems the DotNetCoreCLI task decides it doesn't need to rewrite the config file.

Is there something I'm missing, or some other way to achieve what I'm trying to achieve?

• -core
• azure-pipelines
• dotnetcorecli

2 Answers 2

It appears that the restore command in the DotNetCoreCli@2 task, uses a utility class to generate a temporary configuration file. The task is designed to delete the temporary config file after the task completes, but it looks like the utility class won't overwrite the config file if it already exists.

The name of the configuration file is deterministic:

private getTempNuGetConfigPath(): string {
  const tempNuGetConfigBaseDir = NuGetConfigHelper2.getTempNuGetConfigBasePath();
  const tempNuGetConfigFileName = "tempNuGet_" + tl.getVariable("build.buildId") + ".config";
  return path.join(tempNuGetConfigBaseDir, "Nuget", tempNuGetConfigFileName);
}

public static getTempNuGetConfigBasePath() {
  return tl.getVariable("Agent.BuildDirectory")
         || tl.getVariable("Agent.TempDirectory");
}

The file deletion process in nodejs varies by OS and could be subject to other factors. For example, a self-hosted build agent might have antivirus that prevents the file from being properly deleted. If using a self-hosted agent, try reproducing the build in a cloud-provided agent. If using ubuntu, try Windows.

You could in theory also try to delete the file between nuget restore operations.

variables:
  tempNugetBasePath: $[ coalesce( variables['Agent.BuildDirectory'], variables['Agent.TempDirectory']) ]
  tempNugetPath: $(tempNugetBasePath)/Nuget/tempNuget_$(Build.BuildId).config

steps:
- ... # nuget restore 1

- pwsh: |
   if (Test-Path($env:tempNuget)) {
     Write-Host ("Temporary nuget file path was not deleted: {0}" -f $env:tempNuget)
     Remove-Item -Path $env:tempNuget -Force -ErrorAction SilentlyContinue
   }
  displayName: Delete nuget config
  env:
    tempNuget: $(tempNugetPath)

- ... # nuget restore 2

It looks like you are misled by the command:

"C:\Program Files\dotnet\dotnet.exe" restore --configfile C:\azagent\A1\_work\4\Nuget\tempNuGet_7608.config --no-cache --verbosity Normal

This appears in the logs for both DotNetCoreCLI@2 tasks running dotnet restore. While the temporary NuGet config files share the same naming pattern (tempNuGet_$(Build.BuildId).config), each restore step actually references its own temporary NuGet config file.

If you enable system diagnostics you should see debug logs showing that the temporary NuGet config file is removed at the end of each dotnet restore step:

##[debug]rm -rf C:\azagent\A1\_work\4\Nuget\tempNuGet_7608.config
##[debug]removing file C:\azagent\A1\_work\4\Nuget\tempNuGet_7608.config

You may use the dotnet nuget list source command in your pipeline to inspect the actual package sources in those nuget.config files and use dotnet nuget remove source or dotnet nuget disable source if necessary.

pool: Default
  # vmImage: windows-latest

variables:
  Name: ${{ split(variables['System.CollectionUri'], 'https://dev.azure/')[1] }} # extract Name from $(System.CollectionUri) - https://dev.azure/Name
  feedName: OrgScopeFeed-NuGet # Azure Artifacts feed containing the verified packages 
  Configuration: Release
  pathTo: $(System.DefaultWorkingDirectory)\NuGetConfigTemplates

steps:
- powershell: |
    $nugetConfigPath = "$(System.DefaultWorkingDirectory)\nuget.config"
    # Check if the file exists
    if (Test-Path $nugetConfigPath) {
        # If it exists, delete the file
        Remove-Item $nugetConfigPath -Force
        Write-Host "================ nuget.config file has been deleted.================"
    } else {
        Write-Host "================ nuget.config file does not exist. ================"
    }
    dotnet nuget list source
- task: NuGetAuthenticate@1
  inputs:
    feedUrl: 'https://pkgs.dev.azure/$(Name)/_packaging/$(feedName)/nuget/v3/index.json'
    nuGetServiceConnections: 'AzureArtifacts-OrgScopeFeed-NuGet'
- powershell: |
    dotnet nuget list source --configfile $(pathTo)/nuget.official.config
- task: DotNetCoreCLI@2
  displayName: "Restore using official sources"
  continueOnError: true
  inputs:
    command: 'restore'
    feedsToUse: 'config'
    nugetConfigPath: '$(pathTo)/nuget.official.config'
    noCache: true
- powershell: |
    dotnet nuget list source --configfile $(pathTo)/nuget.dev.config
- task: DotNetCoreCLI@2
  displayName: "Restore using development sources"
  inputs:
    command: 'restore'
    feedsToUse: 'config'
    nugetConfigPath: '$(pathTo)/nuget.dev.config'
- task: DotNetCoreCLI@2
  inputs:
    command: 'build'
    projects: '**\*.sln'
    arguments: '-c $(Configuration) --no-restore'

In case you noticed the implicit restore step during a build publish or test command restoring packages from the unexpected feed, consider adding --no-restore argument to your dotnet command as suggested here.