Skip to content

Verify project template dependencies #57560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 6 commits into from
Closed

Verify project template dependencies #57560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a65eede
Fix Npm.Workspace.nodeproj for local builds
halter73 Aug 27, 2024
bc13930
Fix MAX_PATH issue in PrepareForTest.targets
halter73 Aug 27, 2024
3d00ed5
Make csproj.in files visible in solution explorer
halter73 Aug 27, 2024
0419ab2
Test project templates for vulnerable transitive dependencies
halter73 Aug 23, 2024
6add38f
Update project templates to reference transitive dependencies
halter73 Aug 27, 2024
42dcc76
Add back AzureIdentityVersion
halter73 Aug 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion eng/Npm.Workspace.nodeproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@

<Message Text="Building NPM packages..." Importance="high" />

<Exec Condition="'$(ContinuousIntegrationBuild)' == 'true'"
<Exec
Command="node $(MSBuildThisFileDirectory)scripts/npm/pack-workspace.mjs --update-versions $(RepoRoot)package.json $(PackageVersion) $(PackageOutputPath) $(IntermediateOutputPath)"
EnvironmentVariables="$(_NpmAdditionalEnvironmentVariables)" />

Expand Down
4 changes: 2 additions & 2 deletions eng/Versions.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,7 @@
<MicrosoftAspNetCoreAzureAppServicesSiteExtension80x64Version>$(MicrosoftAspNetCoreAzureAppServicesSiteExtension80Version)</MicrosoftAspNetCoreAzureAppServicesSiteExtension80x64Version>
<MicrosoftAspNetCoreAzureAppServicesSiteExtension80x86Version>$(MicrosoftAspNetCoreAzureAppServicesSiteExtension80Version)</MicrosoftAspNetCoreAzureAppServicesSiteExtension80x86Version>
<!-- 3rd party dependencies -->
<AzureIdentityVersion>1.11.3</AzureIdentityVersion>
<AzureIdentityVersion>1.11.4</AzureIdentityVersion>
<AngleSharpVersion>0.9.9</AngleSharpVersion>
<BenchmarkDotNetVersion>0.13.0</BenchmarkDotNetVersion>
<CastleCoreVersion>4.2.1</CastleCoreVersion>
Expand Down Expand Up @@ -328,7 +328,7 @@
<XunitExtensibilityCoreVersion>$(XunitVersion)</XunitExtensibilityCoreVersion>
<XunitExtensibilityExecutionVersion>$(XunitVersion)</XunitExtensibilityExecutionVersion>
<XUnitRunnerVisualStudioVersion>2.4.3</XUnitRunnerVisualStudioVersion>
<MicrosoftDataSqlClientVersion>4.0.5</MicrosoftDataSqlClientVersion>
<MicrosoftDataSqlClientVersion>5.2.2</MicrosoftDataSqlClientVersion>
<MicrosoftOpenApiVersion>1.6.17</MicrosoftOpenApiVersion>
<MicrosoftOpenApiReadersVersion>1.6.17</MicrosoftOpenApiReadersVersion>
<!-- dotnet tool versions (see also auto-updated DotnetEfVersion property). -->
Expand Down
14 changes: 10 additions & 4 deletions eng/scripts/npm/update-dependency-versions.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,25 @@ export function applyVersions(defaultPackageVersion, workspacePath) {
return [packagesToPack, renames];
}

function applyPackageVersion(packagesToPack, defaultPackageVersion) {
function applyPackageVersion(packagesToPack, packageVersion) {
const currentDir = process.cwd();
const renames = [];
for (const [packagePath, packageJson] of packagesToPack) {
const packageName = packageJson.name;
const packageVersion = defaultPackageVersion;
const packageDir = path.dirname(packagePath);
// Run npm version packageVersion --no-git-tag-version
// This will update the package.json version to the specified version without creating a git tag
// Make a backup of the package.json
fs.copyFileSync(packagePath, `${packagePath}.bak`);
renames.push([`${packagePath}.bak`, packagePath]);

// "npm version ..." fails if it wouldn't change the version which is common for local builds.
// Rather than fail the build, we'll produce packages versions with the "-dev" suffix.
if (packageJson.version === packageVersion) {
continue;
}

const packageName = packageJson.name;
const packageDir = path.dirname(packagePath);

process.chdir(packageDir);
execSync(`npm version ${packageVersion} --no-git-tag-version`, { stdio: 'inherit' });
process.chdir(currentDir);
Expand Down
14 changes: 14 additions & 0 deletions src/ProjectTemplates/Shared/Project.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,20 @@ internal async Task RunDotNetNewAsync(
CaptureBinLogOnFailure(restoreExecution);

Assert.True(0 == restoreResult.ExitCode, ErrorMessages.GetFailedProcessMessage("restore", this, restoreResult));

// We must specify nuget.org as a source because the Azure DevOps feeds do not support the --vulnerable flag.
// If we restored packages from nuget.org, we could remove the following check since the restore itself would produce
// NuGet vulnerability warnings, but we avoid using nuget.org as a source for the restore to avoid supply chain attacks.
// https://learn.microsoft.com/nuget/reference/errors-and-warnings/nu1901-nu1904
argString = "list package --vulnerable --include-transitive --source https://api.nuget.org/v3/index.json";
using var listVulnerableExecution = ProcessEx.Run(Output, TemplateOutputDir, DotNetMuxer.MuxerPathOrDefault(), argString, environmentVariables);
await listVulnerableExecution.Exited;

if (listVulnerableExecution.ExitCode != 0 || !listVulnerableExecution.Output.Contains("has no vulnerable packages"))
{
// We consider this part of the build step, since the build would normally warn about vulnerable packages if not for --no-restore.
Assert.Fail(ErrorMessages.GetFailedProcessMessage("restore", this, new ProcessResult(listVulnerableExecution)));
}
}
}

Expand Down
7 changes: 4 additions & 3 deletions src/ProjectTemplates/TestInfrastructure/PrepareForTest.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,10 @@
<_FilesToCopy Include="$(LocalDotNetRoot)sdk\**\*" DestinationRelativeFolder="sdk\" />
<_FilesToCopy Include="$(SharedFrameworkLayoutRoot)\**\*" />

<_DestinationFiles Include="@(_FilesToCopy->'$(TemplateTestDotNetRoot)%(DestinationRelativeFolder)%(RecursiveDir)%(Filename)%(Extension)')" />
<_PrelimDestinationFiles Include="@(_FilesToCopy->'$(TemplateTestDotNetRoot)%(DestinationRelativeFolder)%(RecursiveDir)%(Filename)%(Extension)')" />
<_DestinationFiles Include="@(_PrelimDestinationFiles)" Condition="!$([MSBuild]::IsOSPlatform(`Windows`))" />
<!-- Prefix absolute destination paths with "\\?\" on Windows to avoid MSBuild MAX_PATH issues in VS. https://github.com/dotnet/msbuild/issues/53 -->
<_DestinationFiles Include="@(_PrelimDestinationFiles->'\\?\%(Identity)')" Condition="$([MSBuild]::IsOSPlatform(`Windows`))" />
</ItemGroup>

<Copy SourceFiles="@(_FilesToCopy)"
Expand All @@ -97,8 +100,6 @@

<Message Importance="high" Text="Removed directory %(_CleanedUpDirectories.Identity)" />

<Message Importance="high" Text="Created directory %(_CreatedDirectories.Identity)" />

<GenerateFileFromTemplate
TemplateFile="$(MSBuildThisFileDirectory)..\TestInfrastructure\Directory.Build.targets.in"
Properties="Configuration=$(Configuration);
Expand Down
3 changes: 3 additions & 0 deletions src/ProjectTemplates/Web.ProjectTemplates/BlazorWeb-CSharp.csproj.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,12 @@
<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="${MicrosoftAspNetCoreComponentsWebAssemblyServerVersion}" Condition="'$(UseWebAssembly)' == 'True'" />
<PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="${MicrosoftAspNetCoreDiagnosticsEntityFrameworkCoreVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="${MicrosoftAspNetCoreIdentityEntityFrameworkCoreVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="Microsoft.Data.SqlClient" Version="${MicrosoftDataSqlClientVersion}" Condition="'$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="${MicrosoftEntityFrameworkCoreSqliteVersion}" Condition="'$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' != 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="${MicrosoftEntityFrameworkCoreSqlServerVersion}" Condition="'$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="${MicrosoftEntityFrameworkCoreToolsVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="System.Drawing.Common" Version="${SystemDrawingCommonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="System.Text.Json" Version="${SystemTextJsonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
</ItemGroup>

<!--#endif -->
Expand Down
12 changes: 11 additions & 1 deletion src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@
<Description>ASP.NET Core Web Template Pack for Microsoft Template Engine</Description>
<ComponentsWebAssemblyProjectsRoot>$(RepoRoot)src\Components\WebAssembly\</ComponentsWebAssemblyProjectsRoot>
<UsingToolTemplateLocalizer>true</UsingToolTemplateLocalizer>
<!-- Unfortunately, UpToDateCheckInput and UpToDateCheckBuilt don't seem to have any effect on VS builds of this project. -->
<!-- https://github.com/dotnet/project-system/blob/d0a44e00b723283d8520cfbe3b6d7876bd7e128c/docs/up-to-date-check.md -->
<DisableFastUpToDateCheck>true</DisableFastUpToDateCheck>
</PropertyGroup>

<PropertyGroup>
Expand All @@ -14,6 +17,7 @@
DefaultNetCoreTargetFramework=$(DefaultNetCoreTargetFramework);
GrpcAspNetCoreVersion=$(GrpcAspNetCoreVersion);
MicrosoftAspNetCoreMvcRazorRuntimeCompilationVersion=$(MicrosoftAspNetCoreMvcRazorRuntimeCompilationVersion);
MicrosoftDataSqlClientVersion=$(MicrosoftDataSqlClientVersion);
MicrosoftEntityFrameworkCoreSqliteVersion=$(MicrosoftEntityFrameworkCoreSqliteVersion);
MicrosoftEntityFrameworkCoreSqlServerVersion=$(MicrosoftEntityFrameworkCoreSqlServerVersion);
MicrosoftEntityFrameworkCoreToolsVersion=$(MicrosoftEntityFrameworkCoreToolsVersion);
Expand All @@ -24,8 +28,9 @@
MicrosoftIdentityWebUIVersion=$(MicrosoftIdentityWebUIVersion);
MicrosoftIdentityWebDownstreamApiVersion=$(MicrosoftIdentityWebDownstreamApiVersion);
MicrosoftNETCoreAppRuntimeVersion=$(MicrosoftNETCoreAppRuntimeVersion);
SystemNetHttpJsonVersion=$(SystemNetHttpJsonVersion);
MicrosoftGraphVersion=$(MicrosoftGraphVersion);
SystemDrawingCommonVersion=$(SystemDrawingCommonVersion);
SystemTextJsonVersion=$(SystemTextJsonVersion);
</GeneratedContentProperties>
</PropertyGroup>

Expand Down Expand Up @@ -64,6 +69,11 @@
<GeneratedContent Include="BlazorWeb-CSharp.csproj.in" OutputPath="content/BlazorWeb-CSharp/BlazorWeb-CSharp/BlazorWeb-CSharp.csproj" />
<GeneratedContent Include="BlazorWeb-CSharp.Client.csproj.in" OutputPath="content/BlazorWeb-CSharp/BlazorWeb-CSharp.Client/BlazorWeb-CSharp.Client.csproj" />
<GeneratedContent Include="ComponentsWebAssembly-CSharp.csproj.in" OutputPath="content/ComponentsWebAssembly-CSharp/ComponentsWebAssembly-CSharp.csproj" />
<!-- This appears to use the right UpToDateCheckBuilt parameters, but DisableFastUpToDateCheck is still necessary for VS to pick up incremental updates. -->
<!-- Maybe this is related to the OutputPath being inside of the projects content directory rather than bin or obj. -->
<!--<UpToDateCheckBuilt Include="@(GeneratedContent->'%(OutputPath)')" Original="@(GeneratedContent)" />-->
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@javiercn Do you have an idea why this doesn't work when running tests in VS?

I saw that the GenerateContent target has basically the same inputs and outputs as this, so this is probably redundant anyway. I just wanted to confirm that configurating DisableFastUpToDateCheck is really the only way to get VS to automatically rebuild this project when running a test after changing a .csproj.in file.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's the safest way.

We could take a look together if you want and figure out the details. I recently had to implement this for other reasons, so I'm relatively familiar with how it works.

<!-- Use "None Include" to make csproj.in files visible in VS Solution Explorer. -->
<None Include="@(GeneratedContent)" />
</ItemGroup>

</Project>
3 changes: 3 additions & 0 deletions src/ProjectTemplates/Web.ProjectTemplates/RazorPagesWeb-CSharp.csproj.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
<PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="${MicrosoftAspNetCoreDiagnosticsEntityFrameworkCoreVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="${MicrosoftAspNetCoreIdentityEntityFrameworkCoreVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="${MicrosoftAspNetCoreIdentityUIVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.Data.SqlClient" Version="${MicrosoftDataSqlClientVersion}" Condition="'$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="${MicrosoftEntityFrameworkCoreSqliteVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' != 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="${MicrosoftEntityFrameworkCoreSqlServerVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="${MicrosoftEntityFrameworkCoreToolsVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
Expand All @@ -30,6 +31,8 @@
<PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="${MicrosoftIdentityWebGraphServiceClientVersion}" Condition=" '$(GenerateGraph)' == 'True' " />
<PackageReference Include="Microsoft.Identity.Web.UI" Version="${MicrosoftIdentityWebUIVersion}" Condition=" '$(IndividualB2CAuth)' == 'True' OR '$(OrganizationalAuth)' == 'True'" />
<PackageReference Include="Microsoft.Identity.Web.DownstreamApi" Version="${MicrosoftIdentityWebDownstreamApiVersion}" Condition=" '$(IndividualB2CAuth)' == 'True' OR '$(OrganizationalAuth)' == 'True'" />
<PackageReference Include="System.Drawing.Common" Version="${SystemDrawingCommonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="System.Text.Json" Version="${SystemTextJsonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
</ItemGroup>

<!--#endif -->
Expand Down
3 changes: 3 additions & 0 deletions src/ProjectTemplates/Web.ProjectTemplates/StarterWeb-CSharp.csproj.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
<PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="${MicrosoftAspNetCoreDiagnosticsEntityFrameworkCoreVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="${MicrosoftAspNetCoreIdentityEntityFrameworkCoreVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="${MicrosoftAspNetCoreIdentityUIVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
<PackageReference Include="Microsoft.Data.SqlClient" Version="${MicrosoftDataSqlClientVersion}" Condition="'$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="${MicrosoftEntityFrameworkCoreSqlServerVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' == 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="${MicrosoftEntityFrameworkCoreSqliteVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' AND '$(UseLocalDB)' != 'True'" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="${MicrosoftEntityFrameworkCoreToolsVersion}" Condition=" '$(IndividualLocalAuth)' == 'True' " />
Expand All @@ -30,6 +31,8 @@
<PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="${MicrosoftIdentityWebGraphServiceClientVersion}" Condition=" '$(GenerateGraph)' == 'True' " />
<PackageReference Include="Microsoft.Identity.Web.UI" Version="${MicrosoftIdentityWebUIVersion}" Condition=" '$(IndividualB2CAuth)' == 'True' OR '$(OrganizationalAuth)' == 'True'" />
<PackageReference Include="Microsoft.Identity.Web.DownstreamApi" Version="${MicrosoftIdentityWebDownstreamApiVersion}" Condition=" '$(IndividualB2CAuth)' == 'True' OR '$(OrganizationalAuth)' == 'True'" />
<PackageReference Include="System.Drawing.Common" Version="${SystemDrawingCommonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
<PackageReference Include="System.Text.Json" Version="${SystemTextJsonVersion}" Condition="'$(IndividualLocalAuth)' == 'True'" />
</ItemGroup>

<!--#endif -->
Expand Down
Loading