Skip to content

build: declare CPM in Directory.Build.props for Scorecard detection #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Reefact merged 1 commit into from
Jul 11, 2026
+15 −0
Merged

build: declare CPM in Directory.Build.props for Scorecard detection #96

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions Directory.Build.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,4 +56,19 @@
<RoslynFloorVersion>4.8.0</RoslynFloorVersion>
</PropertyGroup>

<!--
Central Package Management is configured in Directory.Packages.props (ManagePackageVersionsCentrally plus
the <PackageVersion> list). The property is repeated here for a TOOLING reason, not an MSBuild one:
OpenSSF Scorecard's Pinned-Dependencies check inspects every Directory.*.props file and keeps only the
LAST one it reads when deciding whether CPM is enabled (it overwrites its config per file). This file is
read after Directory.Packages.props and carries no <PackageVersion>, so without the property here Scorecard
concludes "CPM disabled" and reports the solution's `dotnet restore` as an unpinned nugetCommand — capping
the check at 7. Declaring it here makes the winning file report CPM enabled; its empty version set trivially
satisfies Scorecard's "all versions are fixed" rule, so the restore counts as pinned. Redundant for MSBuild
(same value as Directory.Packages.props); FloorCheck still overrides it to false in its own project file.
-->
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>

</Project>