Configure repo for Central Package Management

[richlander]

I wanted to learn CPM better and used this repo as a real-world target for that. If you want to merge this PR, cool. If not, that's also fine.

I used the Aspire repo as a model:

• https://github.com/dotnet/aspire/blob/main/Directory.Packages.props
• https://github.com/dotnet/aspire/blob/main/NuGet.config

I just tested restore. It succeeds with these changes.

Thanks to @jkoritzinsky @JonDouglas for the help.

Microsoft Reviewers: Open in CodeFlow

[elachlan]

Unsure why its failing but:

src\System.Windows.Forms\tests\InteropTests\NativeTests\NativeTests.proj(0,0): error NU1603: (NETCORE_ENGINEERING_TELEMETRY=Restore) NativeTests depends on Microsoft.CodeAnalysis.NetAnalyzers (>= 8.0.0-preview.23327.3) but Microsoft.CodeAnalysis.NetAnalyzers 8.0.0-preview.23327.3 was not found. Microsoft.CodeAnalysis.NetAnalyzers 8.0.0-preview.23364.2 was resolved instead.

src\System.Windows.Forms\tests\InteropTests\NativeTests\NativeTests.proj(0,0): error NU1102: (NETCORE_ENGINEERING_TELEMETRY=Restore) Unable to find package Microsoft.Private.Intellisense with version (= 9.0.0-preview-20240830.1)

[richlander]

The remaining problems are to do with package source mapping. I have to figure that out.

[richlander]

This seems to be the remaining problem:

  Determining projects to restore...
D:\a\_work\1\s\.packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj : error NU1100: Unable to resolve 'sn (>= 1.0.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
##[error].packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj(0,0): error NU1100: (NETCORE_ENGINEERING_TELEMETRY=Restore) Unable to resolve 'sn (>= 1.0.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
D:\a\_work\1\s\.packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj : error NU1100: Unable to resolve 'MicroBuild.Core (>= 0.2.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
##[error].packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj(0,0): error NU1100: (NETCORE_ENGINEERING_TELEMETRY=Restore) Unable to resolve 'MicroBuild.Core (>= 0.2.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
D:\a\_work\1\s\.packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj : error NU1100: Unable to resolve 'MicroBuild.Core.Sentinel (>= 1.0.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
##[error].packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj(0,0): error NU1100: (NETCORE_ENGINEERING_TELEMETRY=Restore) Unable to resolve 'MicroBuild.Core.Sentinel (>= 1.0.0)' for '.NETFramework,Version=v4.7.2'. PackageSourceMapping is enabled, the following source(s) were not considered: dotnet-eng, dotnet-public, dotnet-tools, dotnet10, dotnet10-transport, dotnet8, dotnet8-transport, dotnet9-transport, richnav, winsdk.
  Failed to restore D:\a\_work\1\s\.packages\microsoft.dotnet.arcade.sdk\10.0.0-beta.24473.2\tools\Tools.proj (in 3.35 sec).

Build FAILED.

I'm not sure how to map the package sources that are (presumably) injected by a proj file from a package.

[lonitra]

Thank you for taking a look into enabling CPM in WinForms! Just have some questions, but we would really want to take this.

[richlander]

The current problem is that some xunit.assert references are implicit and others are explicit. We need the explicit references or else the code will not compile, which also requires a D.P.p entry. The implicit ones seem to be allergic to CPM. That's an impedance mismatch. That's what we need to solve. The NuGet team is offering me guidance on how to solve this.

[codecov]

Codecov Report

Attention: Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 75.43488%. Comparing base (facab3e) to head (e8b23c4).
Report is 45 commits behind head on main.

Additional details and impacted files

@@                 Coverage Diff                 @@
##                main      #12175         +/-   ##
===================================================
+ Coverage   75.35733%   75.43488%   +0.07755%     
===================================================
  Files           3097        3103          +6     
  Lines         634294      634314         +20     
  Branches       46876       46876                 
===================================================
+ Hits          477987      478494        +507     
+ Misses        152899      152402        -497     
- Partials        3408        3418         +10     

Flag	Coverage Δ
Debug	75.43488% <50.00000%> (+0.07755%)	⬆️
integration	17.98508% <0.00000%> (-0.03529%)	⬇️
production	48.82049% <50.00000%> (+0.09868%)	⬆️
test	97.02496% <ø> (-0.00207%)	⬇️
unit	45.82612% <50.00000%> (+0.09506%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[richlander]

The key challenge to overcome was implicit references. We used the following syntax (the Condition) to address that. I'm raising it to the issue thread so that it is easy to discover for others.

<PackageVersion Include="xunit.assert" Version="$(XUnitAssertVersion)" Condition="'$(IsTestProject)' != 'true'" />

[richlander]

After this PR merges, feel free to remove the Asn1 references from projects @lonitra.

[richlander]

Recording some more notes...

I had to do two things for CodeCoverage.proj references:

• I had to delete all of the PSMs to get the CodeCoverage.proj references to restore.
• dotnet restore didn't work. I had to use dotnet msbuild -restore eng/CodeCoverage.proj /p:Configuration=Debug to actually restore the packages so that packagesourcemapper would see them . That's the syntax CI uses.
• After that, I brought all sources back (that I deleted) and then added the additional packages to the correct source (per packagesourcemapper).

What I'd really like is the following to be easier, ideally w/o touching any files:

• Restore to a private GPF.
• Automatically clean the GPF each time it is needed.
• Override the package sources so that unmapped packages actually restore and can be seen by packagesourcemapper.
• Indicate feeds that can be removed.

[lonitra]

@richlander could you clarify what PSM and GPF is in your previous comment?

[lonitra]

Awesome 🥳

[richlander]

• GPF == Global Package Folder
• PSM == Package Source Mapping

Both are covered at https://learn.microsoft.com/nuget/consume-packages/package-source-mapping

[RussKie]

Where did this list come from? E.g., Argon isn't used in this repo (at least explicitly).

[richlander]

It is coming from

winforms/src/System.Windows.Forms.Analyzers.CSharp/tests/UnitTests/System.Windows.Forms.Analyzers.CSharp.Tests.csproj

Line 18 in c9a58e9

<PackageReference Include="Verify.Xunit" Version="$(VerifyXunitVersion)" />

[richlander]

The list is generated per https://learn.microsoft.com/nuget/consume-packages/package-source-mapping#automated-onboarding-using-tool

[richlander]

The is change is noisy: 3ae1ec6. I updated to a newer/stable version of Microsoft.CodeAnalysis.NetAnalyzers that was year+ newer in time and enabled removing an old feed. The new version had new rules that needed to be addressed.

This change makes it so that Asn1 doesn't need to be added to individual projects: b03c264. It wasn't compatible with some of the references in the repo, which likely suggests that they are wrong. I expect other references are wrong/stale. CPM/PSM are much more strict than the old model.

It seems like we need a way to discover stale dependencies.

[richlander]

I made a bunch more changes to address feedback. How does this look @lonitra @RussKie?

I also addressed most of the change at #12249 per @mmitche. I couldn't address all of that due to #12219 (comment). That seems like something good to resolve later.

[RussKie]

LGTM

[lonitra]

Thank you!