C#: Use feed management in the remaining restore flows. by michaelnebel · Pull Request #22041 · github/codeql

michaelnebel · 2026-06-24T08:57:01Z

The primary purpose of this PR is to use the newly introduced feed manager in more of the package restore flows.

To achieve this we are

Re-factoring a bit more functionality into the feed manager to avoid arguments being passed around in the NuGet package restorer.
Use the feed manager in DowloadMissingPackages. This also somewhat simplifies the restore logic as we no longer create a dedicated nuget.config file in fallback scenarios, but instead we supply feeds directly via the command line. Furthermore, if NuGet feed responsiveness checking is disabled we use all feeds when attempting to download missing packages (this will include private registries as well).
Use the feed manager in the TryRestore method, which can be used to restore individual packages. The logic has been changed slightly here compared to earlier as we will attempt to use the feeds detected in the source directory (instead of those in the temporary directory).

With the changes in this PR, all restore like flows specify the feeds directly via the command line (unless NuGet feed checking is disabled and no private registries are configured). That is, as a follow up we can attempt the remove the timeout fallback and instead just always use reachable feeds.

Testing

DCA looks good.
A QA run was made and can be seen here. Note, that this is only available internally, but making the link available for the review'er. The QA run appears to be uneventful.

…apsulate as immutable hash sets.

…mmutable hash sets).

…lays the calculation of the reachable feeds until it is needed/used.

…mSpecificFeeds as it is always called with this argument.

…instead of a specific nuget.config file, and supply a list of nuget sources when using the TryRestore.

Copilot

Pull request overview

Centralizes NuGet feed selection in FeedManager across remaining C# dependency restore flows.

Changes:

Adds lazy feed discovery and reachability management.
Passes feeds directly to restore commands.
Removes fallback nuget.config generation.

Show a summary per file

File	Description
`2026-07-17-nuget-package-restore.md`	Documents restore changes.
`Semmle.Extraction.Tests/DotNet.cs`	Updates restore argument tests.
`PackagesConfigRestorer.cs`	Uses managed feed selection.
`NugetPackageRestorer.cs`	Migrates remaining restore flows.
`IDotNet.cs`	Removes config-path setting.
`FeedManager.cs`	Centralizes feed state and reachability.
`DotNet.cs`	Removes `--configfile` handling.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs:324

The newly introduced unchecked-feed fallback is not exercised by the existing fallback integration tests; they all leave responsiveness checking enabled. Please add coverage that disables feed checking and verifies a missing package is restored through AllFeeds, including the intended configured/private-feed behavior.

            else
            {
                feeds = feedManager.AllFeeds;
            }

Files reviewed: 7/7 changed files
Comments generated: 3
Review effort level: Balanced

hvitved

LGTM, some minor comments.

hvitved · 2026-08-19T08:52:11Z

+        /// <summary>
+        /// Gets the list of inherited NuGet feeds that are configured in the environment.
+        /// </summary>
+        public ImmutableHashSet<string> InheritedFeeds => AllFeeds.Except(ExplicitFeeds).ToImmutableHashSet();


Would it make the code cleaner if the logic populated this hash set and AllFeed was then defined as the union of ExplicitFields and InheritedFields?

I don't think there is an easy way to calculate InheritedFeeds in another way than AllFeeds\ExplicitFeeds

hvitved · 2026-08-19T08:53:40Z

+        /// <summary>
+        /// Gets whether there was a timeout when checking the reachability of the explicitly configured NuGet feeds.
+        /// </summary>
+        public bool ExplicitFeedTimeout => lazyReachableExplicitFeeds.Value.Item1;


Could this instead be ReachableExplicitFeeds.Count() == ExplicitFields.Count() and then we can avoid the tuple construction?

Unfortunately not. The set of ReachableExplicitFeeds are the feeds where we have confirmed that we can connect. That is, ReachableExplicitFeeds doesn't contain feeds where we e.g. get 401/403 errors (or other errors). The timeout boolean only refers to a timeout. This means that we could have ReachableExplicitFeeds.Count() != ExplicitFields.Count() and timeout = false.

There is also a follow up PR for getting rid of the ExplicitFeedTimeout altogether: #22094

hvitved · 2026-08-19T08:58:53Z

+---
+category: majorAnalysis
+---
+* Simplified and streamlined the use of NuGet sources when downloading dependencies. In fallback scenarios and specialized package downloads, NuGet sources are now passed directly to `dotnet restore` via `-s`. Furthermore, no `nuget.config` files are created for fallback scenarios, and private registries are used when attempting to download missing packages that were not restored as part of the normal `dotnet restore` process.


The dotnet restore -s change seems like an internal implementation detail that customers should not care about?

We can remove the mention of -s, but I think we need to mention that feeds are provided directly to the restore command (If this change for some reason break something)

michaelnebel · 2026-08-19T12:06:59Z

@hvitved : Made a small update to the change note. Could you re-approve? 😄

$@github-actions$ github-actions Bot added the C# label Jun 24, 2026

$github-advanced-security[bot]$

github-advanced-security Bot found potential problems Jun 24, 2026

View reviewed changes

Comment thread csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs Fixed

Comment thread csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs Fixed

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch from 25ade27 to afe8f07 Compare June 24, 2026 10:58

$github-advanced-security[bot]$

github-advanced-security Bot found potential problems Jun 24, 2026

View reviewed changes

Comment thread csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs Fixed

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch 5 times, most recently from 29a859a to 036f75c Compare June 24, 2026 13:47

$@github-actions$ github-actions Bot added the documentation label Jun 24, 2026

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch from 036f75c to 86fc08e Compare June 25, 2026 11:06

$github-advanced-security[bot]$

github-advanced-security Bot found potential problems Jun 25, 2026

View reviewed changes

Comment thread csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs Fixed

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch 3 times, most recently from 4690d92 to 6ee50ce Compare June 30, 2026 13:05

$@github-actions$ github-actions Bot removed the documentation label Jun 30, 2026

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch from 43aaec6 to fde527a Compare June 30, 2026 14:21

$@michaelnebel$ michaelnebel changed the title ~~C#: Improve package download logic.~~ C#: Use feed management in the remaining restore flows. Jul 1, 2026

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch 2 times, most recently from bbc01c9 to b0eaf49 Compare July 17, 2026 13:19

$@github-actions$ github-actions Bot added the documentation label Jul 17, 2026

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch from b0eaf49 to a66f82e Compare August 11, 2026 11:56

michaelnebel added 8 commits August 12, 2026 14:15

$@michaelnebel$

C#: Re-factor GetAllFeeds into properties in the Feed Manager and enc…

2129dc8

…apsulate as immutable hash sets.

$@michaelnebel$

C#: Re-factor more feed sets into the feed manager (and further use i…

23fa751

…mmutable hash sets).

$@michaelnebel$

C#: Do not pass around the set of reachable feeds. This implicitly de…

13c2c8d

…lays the calculation of the reachable feeds until it is needed/used.

$@michaelnebel$

C#: Use feed management for more package download flows.

179f29b

$@michaelnebel$

C#: Remove the dotnet restore config file option.

0874377

$@michaelnebel$

C#: Add some more documentation in the FeedManager.

2d1edd4

$@michaelnebel$

C#: Remove the explicitfeeds argument from DownloadMissingPackagesFro…

3411459

…mSpecificFeeds as it is always called with this argument.

$@michaelnebel$

C#: Push the feed fetching logic into DownloadPackages, use allfeeds …

25b640b

…instead of a specific nuget.config file, and supply a list of nuget sources when using the TryRestore.

$@michaelnebel$

C#: Add change note.

b34fe44

$@michaelnebel$

michaelnebel force-pushed the csharp/morefeedmanageruses branch from a66f82e to b34fe44 Compare August 12, 2026 12:31

$@michaelnebel$

michaelnebel requested a balanced review from Copilot August 12, 2026 12:46

Copilot started reviewing on behalf of michaelnebel August 12, 2026 12:49 View session

Copilot AI reviewed Aug 12, 2026

View reviewed changes

$@michaelnebel$

C#: Address review comments.

41b257d

$@michaelnebel$

michaelnebel requested a review from hvitved August 13, 2026 07:55

$@michaelnebel$

michaelnebel marked this pull request as ready for review August 13, 2026 07:55

$@michaelnebel$

michaelnebel requested a review from a team as a code owner August 13, 2026 07:55

$hvitved$

hvitved reviewed Aug 19, 2026

View reviewed changes

$hvitved$

hvitved previously approved these changes Aug 19, 2026

View reviewed changes

$@michaelnebel$

C#: Address review comments.

5475078

$@michaelnebel$

michaelnebel dismissed hvitved’s stale review via 5475078 August 19, 2026 12:01

$hvitved$

hvitved approved these changes Aug 19, 2026

View reviewed changes

$@michaelnebel$

michaelnebel merged commit 01755ec into github:main Aug 19, 2026
20 checks passed

$@michaelnebel$

michaelnebel deleted the csharp/morefeedmanageruses branch August 19, 2026 12:59

Navigation Menu

Uh oh!

C#: Use feed management in the remaining restore flows. - #22041

C#: Use feed management in the remaining restore flows.#22041
michaelnebel merged 11 commits into
github:mainfrom
michaelnebel:csharp/morefeedmanageruses

$@michaelnebel$ michaelnebel commented Jun 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

$@hvitved$ hvitved left a comment

Uh oh!

$@hvitved$ hvitved Aug 19, 2026

Uh oh!

$@michaelnebel$ michaelnebel Aug 19, 2026

Uh oh!

$@hvitved$ hvitved Aug 19, 2026

Uh oh!

$@michaelnebel$ michaelnebel Aug 19, 2026

Uh oh!

$@hvitved$ hvitved Aug 19, 2026

Uh oh!

$@michaelnebel$ michaelnebel Aug 19, 2026

Uh oh!

michaelnebel commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

michaelnebel commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

hvitved Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelnebel Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelnebel Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelnebel Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelnebel commented Aug 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

$@michaelnebel$ michaelnebel commented Jun 24, 2026 •

edited

Loading

$@hvitved$ hvitved left a comment

$@hvitved$ hvitved Aug 19, 2026

$@michaelnebel$ michaelnebel Aug 19, 2026

$@hvitved$ hvitved Aug 19, 2026

$@michaelnebel$ michaelnebel Aug 19, 2026

$@hvitved$ hvitved Aug 19, 2026

$@michaelnebel$ michaelnebel Aug 19, 2026