Skip to content

C#: Exclude private registries from NuGet CLI restores - #135

Closed
michaelnebel wants to merge 1 commit into
mainfrom
michaelnebel-nuget-public-feeds
Closed

michaelnebel wants to merge 1 commit into
mainfrom
michaelnebel-nuget-public-feeds

Conversation

@michaelnebel

Copy link
Copy Markdown
Owner

Summary

Inspired by github#22911, keep using the NuGet CLI for packages.config restores instead of disabling it when private registries are configured.

  • Retain applicable non-private feeds while excluding organization-configured private registries, including base-feed replacements, from NuGet CLI sources.
  • Pass an explicit empty source when no eligible feeds remain, preventing implicit fallback to private sources.
  • Leave private registry support in dotnet restore unchanged.
  • Add regression coverage and a C# analysis change note.

Validation

dotnet test csharp/extractor/Semmle.Extraction.Tests/Semmle.Extraction.Tests.csproj --filter FullyQualifiedName~FeedManagerTests --verbosity quiet

All 23 feed manager tests passed, including responsiveness checks enabled/disabled, private base-feed replacements, private-only feeds, and existing default-feed behavior.

Keep applicable non-private feeds available for packages.config restores while leaving dotnet restore unchanged.

Co-authored-by: Copilot App <[email protected]>
@michaelnebel
michaelnebel marked this pull request as draft October 30, 2026 07:15
@michaelnebel

Copy link
Copy Markdown
Owner Author

Replaced by draft PR github#22948 targeting upstream main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant