Enable Central Package Management and NuGetAudit (#325)

* Enable Central Package Management and NuGetAudit Contributes to https://github.com/dotnet/arcade/issues/15019 * Delete eng/SourceBuildPrebuiltBaseline.xml * Don't hardcode package relative path
2024-08-27 16:59:51 +02:00 · 2024-08-27 16:59:51 +02:00 · 4291030be2
--- a/NuGet.config
+++ b/NuGet.config
@ -6,6 +6,10 @@
    <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
    <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
  </packageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
  <disabledPackageSources>
    <clear />
  </disabledPackageSources>
--- a/eng/DotNetBuild.props
+++ b/eng/DotNetBuild.props
@ -5,4 +5,5 @@
    <GitHubRepositoryName>symreader</GitHubRepositoryName>
    <SourceBuildManagedOnly>true</SourceBuildManagedOnly>
  </PropertyGroup>
+
 </Project>
--- a/eng/SourceBuildPrebuiltBaseline.xml
+++ b/eng/SourceBuildPrebuiltBaseline.xml
@ -1,7 +0,0 @@
-<!-- Whenever altering this or other Source Build files, please include @dotnet/source-build-internal as a reviewer. -->
-<!-- See aka.ms/dotnet/prebuilts for guidance on what pre-builts are and how to eliminate them. -->
-
-<UsageData>
-  <IgnorePatterns>
-  </IgnorePatterns>
-</UsageData>
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@ -13,10 +13,6 @@
      <Uri>https://github.com/dotnet/arcade</Uri>
      <Sha>e3bdd9a0f2a65fe037ba1adb2261eea48a840fa4</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DotNet.XliffTasks" Version="9.0.0-beta.24426.3">
-      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>e3bdd9a0f2a65fe037ba1adb2261eea48a840fa4</Sha>
-    </Dependency>
    <!-- Intermediate is necessary for source build. -->
    <Dependency Name="Microsoft.SourceBuild.Intermediate.arcade" Version="9.0.0-beta.24426.3">
      <Uri>https://github.com/dotnet/arcade</Uri>
--- a/eng/Versions.props
+++ b/eng/Versions.props
@ -7,8 +7,5 @@
    <UsingToolPdbConverter>false</UsingToolPdbConverter>
    <UsingToolNuGetRepack>true</UsingToolNuGetRepack>
    <FlagNetStandard1XDependencies>true</FlagNetStandard1XDependencies>
-    <!-- Pinned -->
-    <MicrosoftDiaSymReaderNativeVersion>17.0.0-beta1.21524.1</MicrosoftDiaSymReaderNativeVersion>
-    <SystemCollectionsImmutableVersion>7.0.0</SystemCollectionsImmutableVersion>
  </PropertyGroup>
 </Project>
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@ -9,6 +9,9 @@

    <!-- Any code that allows overflows intentionally should be explicitly in an unchecked region. -->
    <CheckForOverflowUnderflow Condition="'$(Configuration)' == 'Debug'">true</CheckForOverflowUnderflow>
+
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
  </PropertyGroup>

 </Project>
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@ -0,0 +1,24 @@
+<Project>
+
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+    <!-- Using multiple feeds isn't supported by Maestro: https://github.com/dotnet/arcade/issues/14155. -->
+    <NoWarn>$(NoWarn);NU1507</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Runtime dependencies -->
+    <PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
+
+    <!-- DiaSymReader dependency -->
+    <PackageVersion Include="Microsoft.DiaSymReader.Native" Version="17.0.0-beta1.21524.1" />
+  </ItemGroup>
+
+  <!-- External dependencies -->
+  <ItemGroup>
+    <PackageVersion Include="xunit.assert" Version="$(XUnitVersion)" Condition="'$(IsTestUtilityProject)' == 'true'" />
+    <PackageVersion Include="xunit.extensibility.core" Version="$(XUnitVersion)" />
+  </ItemGroup>
+
+</Project>
--- a/src/Microsoft.DiaSymReader.Native.Tests/Microsoft.DiaSymReader.Native.UnitTests.csproj
+++ b/src/Microsoft.DiaSymReader.Native.Tests/Microsoft.DiaSymReader.Native.UnitTests.csproj
@ -1,4 +1,5 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
  <PropertyGroup>
    <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@ -7,26 +8,29 @@
      Testing 64bit only on Desktop suffixiently covers our interop code paths.  
    -->
    <TestArchitectures Condition="$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)')) == '.NETFramework'">x64;x86</TestArchitectures>
-
  </PropertyGroup>
+
  <ItemGroup>
-    <PackageReference Include="Microsoft.DiaSymReader.Native" Version="$(MicrosoftDiaSymReaderNativeVersion)" />
+    <PackageReference Include="Microsoft.DiaSymReader.Native" GeneratePathProperty="true" />
  </ItemGroup>
+
  <ItemGroup Condition="'$(OS)' == 'Windows_NT'">
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <Visible>false</Visible>
      <Link>Microsoft.DiaSymReader.Native.x86.dll</Link>
    </Content>
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <Visible>false</Visible>
      <Link>Microsoft.DiaSymReader.Native.amd64.dll</Link>
    </Content>
  </ItemGroup>
+
  <ItemGroup>
    <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
    <ProjectReference Include="..\PdbTestResources\PdbTestResources.csproj" />
    <ProjectReference Include="..\TestUtilities\TestUtilities.csproj" />
  </ItemGroup>
+
 </Project>
--- a/src/Microsoft.DiaSymReader.Tests/Microsoft.DiaSymReader.UnitTests.csproj
+++ b/src/Microsoft.DiaSymReader.Tests/Microsoft.DiaSymReader.UnitTests.csproj
@ -1,4 +1,5 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
  <PropertyGroup>
    <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@ -7,28 +8,30 @@
      Testing 64bit only on Desktop sufficiently covers our interop code paths.  
    -->
    <TestArchitectures Condition="$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)')) == '.NETFramework'">x64;x86</TestArchitectures>
-
-    <NoWarn>1701;1702;1705;1591;436</NoWarn>
  </PropertyGroup>
+
  <ItemGroup>
-    <PackageReference Include="Microsoft.DiaSymReader.Native" Version="$(MicrosoftDiaSymReaderNativeVersion)" />
+    <PackageReference Include="Microsoft.DiaSymReader.Native" GeneratePathProperty="true" />
  </ItemGroup>
+
  <ItemGroup Condition="'$(OS)' == 'Windows_NT'">
    <!-- Copy DSRN to a subdirectory of the output directory, so that we can test alternative load path -->
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.x86.dll">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <Visible>false</Visible>
      <Link>DSRN\Microsoft.DiaSymReader.Native.x86.dll</Link>
    </Content>
-    <Content Include="$(NuGetPackageRoot)\Microsoft.DiaSymReader.Native\$(MicrosoftDiaSymReaderNativeVersion)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
+    <Content Include="$(PkgMicrosoft_DiaSymReader_Native)\runtimes\win\native\Microsoft.DiaSymReader.Native.amd64.dll">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <Visible>false</Visible>
      <Link>DSRN\Microsoft.DiaSymReader.Native.amd64.dll</Link>
    </Content>
  </ItemGroup>
+
  <ItemGroup>
    <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
    <ProjectReference Include="..\PdbTestResources\PdbTestResources.csproj" />
    <ProjectReference Include="..\TestUtilities\TestUtilities.csproj" />
  </ItemGroup>
+
 </Project>
--- a/src/TestUtilities/TestUtilities.csproj
+++ b/src/TestUtilities/TestUtilities.csproj
@ -1,17 +1,22 @@
 <Project Sdk="Microsoft.NET.Sdk">
+
  <PropertyGroup>
    <TargetFrameworks>$(NetCurrent);$(NetFrameworkMinimum)</TargetFrameworks>
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
    <IsTestUtilityProject>true</IsTestUtilityProject>
  </PropertyGroup>
+
  <ItemGroup>
-    <PackageReference Include="xunit.assert" Version="$(XunitVersion)" />
-    <PackageReference Include="xunit.extensibility.core" Version="$(XunitVersion)" />
+    <PackageReference Include="xunit.assert" />
+    <PackageReference Include="xunit.extensibility.core" />
  </ItemGroup>
+
  <ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
-    <PackageReference Include="System.Collections.Immutable" Version="$(SystemCollectionsImmutableVersion)" />
+    <PackageReference Include="System.Collections.Immutable" />
  </ItemGroup>
+
  <ItemGroup>
    <ProjectReference Include="..\Microsoft.DiaSymReader\Microsoft.DiaSymReader.csproj" />
  </ItemGroup>
+
 </Project>