diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dce8d3af4..bb1671fd6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -12,6 +12,7 @@ If you are contributing significant changes, or if the issue is already assigned - [Table of Contents](#table-of-contents) - [Getting Started](#getting-started) - [Prerequisites](#prerequisites) + - [Central NuGet Feed](#central-nuget-feed) - [Project Structure](#project-structure) - [Development Workflow](#development-workflow) - [Development Process](#development-process) @@ -69,6 +70,34 @@ If you are contributing significant changes, or if the issue is already assigned 3. **Node.js**: Install [Node.js](https://nodejs.org/en/download) 20 or later (ensure `node` and `npm` are in your PATH) 4. **PowerShell**: Install [PowerShell](https://learn.microsoft.com/powershell/scripting/install/installing-powershell) 7.0 or later (required for build and test scripts) +### Central NuGet Feed + +This repository uses a single Azure DevOps package feed for all NuGet packages instead of nuget.org directly. The feed is configured in `nuget.config`. + +The feed has an **upstream** configured to nuget.org. When an authenticated user restores a package that is not yet cached in the feed, it is automatically ingested from nuget.org. Unauthenticated users can only consume package versions that have already been ingested into the feed. + +You can browse the feed directly at: + +#### Installing the Azure Artifacts Credential Provider + +To authenticate with the feed you need the **Azure Artifacts Credential Provider**: + +1. Install it from (you can also find this link by clicking **Connect to Feed** from the feed page above). +2. Once installed, the first `dotnet restore` (or any command with an implicit restore) will trigger an authentication prompt. +3. Valid Users of the Azure DevOps project will be authenticated as a **Collaborator** on the feed, which allows you to: + - Pull any package already in the feed. + - Trigger the feed to query nuget.org and ingest new packages or versions that are not yet present. + +The feed is **public**, so anyone can read packages that are already cached. The credential provider is only needed to cause new packages to be ingested from the upstream. + +#### External Contributors + +External contributors will not be able to authenticate to the feed as **Collaborator**, but our Pull Request pipeline can. External contributors should temporarily add nuget.org as an additional source in `nuget.config` to build locally with new packages, then revert that `nuget.config` change before submitting their pull request. Our pipeline will authenticate to the feed, ingest the new package, and build normally. + +If you need local-only NuGet configuration for development, use a user-level `NuGet.Config` and a temporary `--configfile` rather than editing this repository's tracked `nuget.config`. Do not commit local feed changes to the repo. + +Do not assume the Pull Request pipeline will always ingest a missing package automatically. Upstream ingestion can fail or be delayed. If your PR depends on a package/version that is not yet visible in the feed, ask a maintainer or Microsoft contributor to pre-ingest it by restoring against the feed first, then retry once the package appears in . + ### Project Structure - `core\` diff --git a/nuget.config b/nuget.config index 78ea51a55..c545d2127 100644 --- a/nuget.config +++ b/nuget.config @@ -3,6 +3,7 @@ +