From 8b1aa1015e4efff705f96dd0009147fa18c3ecf8 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 11 Jul 2026 07:41:51 +0000 Subject: [PATCH] build: adopt NuGet Central Package Management Move every PackageReference version into a single Directory.Packages.props (ManagePackageVersionsCentrally=true). This makes the `dotnet restore` steps in the CI and release workflows reproducible, which is what OpenSSF Scorecard's Pinned-Dependencies check credits: the two previously unpinned nugetCommand dependencies (the ci.yml and release.yml restores) now count as pinned, lifting that check from 7 toward 10. Two deliberate exceptions preserve existing behaviour: - FirstClassErrors.Analyzers keeps its Roslyn load-contract floor via VersionOverride="$(RoslynFloorVersion)", independent of the newer central Microsoft.CodeAnalysis.CSharp version the analyzer tests use. - tools/floor-check/FloorCheck.csproj opts out of CPM: it consumes the FirstClassErrors package at a dynamic $(FloorCheckVersion), built in isolation outside the solution. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_014W1zrcBNy3jEs8ngAQKwZg --- Directory.Packages.props | 38 +++++++++++++++++++ ...irstClassErrors.Analyzers.UnitTests.csproj | 12 +++--- .../FirstClassErrors.Analyzers.csproj | 8 ++-- .../FirstClassErrors.Cli.UnitTests.csproj | 12 +++--- .../FirstClassErrors.Cli.csproj | 2 +- .../FirstClassErrors.GenDoc.UnitTests.csproj | 14 +++---- .../FirstClassErrors.PropertyTests.csproj | 12 +++--- .../FirstClassErrors.Testing.csproj | 2 +- .../FirstClassErrors.UnitTests.csproj | 14 +++---- FirstClassErrors/FirstClassErrors.csproj | 2 +- tools/floor-check/FloorCheck.csproj | 4 ++ 11 files changed, 82 insertions(+), 38 deletions(-) create mode 100644 Directory.Packages.props diff --git a/Directory.Packages.props b/Directory.Packages.props new file mode 100644 index 0000000..ff2be35 --- /dev/null +++ b/Directory.Packages.props @@ -0,0 +1,38 @@ + + + + + true + + + + + + + + + + + + + + + + + + + diff --git a/FirstClassErrors.Analyzers.UnitTests/FirstClassErrors.Analyzers.UnitTests.csproj b/FirstClassErrors.Analyzers.UnitTests/FirstClassErrors.Analyzers.UnitTests.csproj index 710c84f..cf3ef08 100644 --- a/FirstClassErrors.Analyzers.UnitTests/FirstClassErrors.Analyzers.UnitTests.csproj +++ b/FirstClassErrors.Analyzers.UnitTests/FirstClassErrors.Analyzers.UnitTests.csproj @@ -8,18 +8,18 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/FirstClassErrors.Analyzers/FirstClassErrors.Analyzers.csproj b/FirstClassErrors.Analyzers/FirstClassErrors.Analyzers.csproj index ad1433b..e092dc2 100644 --- a/FirstClassErrors.Analyzers/FirstClassErrors.Analyzers.csproj +++ b/FirstClassErrors.Analyzers/FirstClassErrors.Analyzers.csproj @@ -21,9 +21,11 @@ and loaded by each consumer's compiler, so a higher version makes it silently fail to load (CS8032) on older SDKs/IDEs. The floor lives once in Directory.Build.props and is enforced by RoslynFloorTests. Microsoft.CodeAnalysis.Analyzers is only a build-time authoring analyzer (PrivateAssets=all), not part - of the load contract, so it is free to move. --> - - + of the load contract, so it is free to move. Under Central Package Management (Directory.Packages.props) + the floor is expressed as a VersionOverride so it stays property-driven and independent of the newer + central Microsoft.CodeAnalysis.CSharp version the analyzer tests consume. --> + + runtime; build; native; contentfiles; analyzers; buildtransitive diff --git a/FirstClassErrors.Cli.UnitTests/FirstClassErrors.Cli.UnitTests.csproj b/FirstClassErrors.Cli.UnitTests/FirstClassErrors.Cli.UnitTests.csproj index a442664..3307e50 100644 --- a/FirstClassErrors.Cli.UnitTests/FirstClassErrors.Cli.UnitTests.csproj +++ b/FirstClassErrors.Cli.UnitTests/FirstClassErrors.Cli.UnitTests.csproj @@ -8,18 +8,18 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/FirstClassErrors.Cli/FirstClassErrors.Cli.csproj b/FirstClassErrors.Cli/FirstClassErrors.Cli.csproj index e61c78a..34af61c 100644 --- a/FirstClassErrors.Cli/FirstClassErrors.Cli.csproj +++ b/FirstClassErrors.Cli/FirstClassErrors.Cli.csproj @@ -10,7 +10,7 @@ - + diff --git a/FirstClassErrors.GenDoc.UnitTests/FirstClassErrors.GenDoc.UnitTests.csproj b/FirstClassErrors.GenDoc.UnitTests/FirstClassErrors.GenDoc.UnitTests.csproj index d959a7a..0aeccb3 100644 --- a/FirstClassErrors.GenDoc.UnitTests/FirstClassErrors.GenDoc.UnitTests.csproj +++ b/FirstClassErrors.GenDoc.UnitTests/FirstClassErrors.GenDoc.UnitTests.csproj @@ -8,19 +8,19 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - + + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/FirstClassErrors.PropertyTests/FirstClassErrors.PropertyTests.csproj b/FirstClassErrors.PropertyTests/FirstClassErrors.PropertyTests.csproj index 43ae738..9c41763 100644 --- a/FirstClassErrors.PropertyTests/FirstClassErrors.PropertyTests.csproj +++ b/FirstClassErrors.PropertyTests/FirstClassErrors.PropertyTests.csproj @@ -8,20 +8,20 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/FirstClassErrors.Testing/FirstClassErrors.Testing.csproj b/FirstClassErrors.Testing/FirstClassErrors.Testing.csproj index 170698e..5d130f4 100644 --- a/FirstClassErrors.Testing/FirstClassErrors.Testing.csproj +++ b/FirstClassErrors.Testing/FirstClassErrors.Testing.csproj @@ -58,7 +58,7 @@ (_manifest/spdx_2.2/manifest.spdx.json), so the inventory of files and dependencies travels with the artifact and is covered by the release's provenance attestation. Build-time only (PrivateAssets=all): consumers never see this as a dependency. --> - + diff --git a/FirstClassErrors.UnitTests/FirstClassErrors.UnitTests.csproj b/FirstClassErrors.UnitTests/FirstClassErrors.UnitTests.csproj index e917431..2f8010a 100644 --- a/FirstClassErrors.UnitTests/FirstClassErrors.UnitTests.csproj +++ b/FirstClassErrors.UnitTests/FirstClassErrors.UnitTests.csproj @@ -8,19 +8,19 @@ - + all runtime; build; native; contentfiles; analyzers; buildtransitive - - - - - + + + + + all runtime; build; native; contentfiles; analyzers; buildtransitive - + diff --git a/FirstClassErrors/FirstClassErrors.csproj b/FirstClassErrors/FirstClassErrors.csproj index 73022e6..2a400a7 100644 --- a/FirstClassErrors/FirstClassErrors.csproj +++ b/FirstClassErrors/FirstClassErrors.csproj @@ -64,7 +64,7 @@ (_manifest/spdx_2.2/manifest.spdx.json), so the inventory of files and dependencies travels with the artifact and is covered by the release's provenance attestation. Build-time only (PrivateAssets=all): consumers never see this as a dependency. --> - + false false + + false