cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build(dotnet): lock SDK and packages

Browse Source 
Pin the SDK feature band and commit transitive NuGet content hashes so CI fails on unreviewed dependency drift.
This commit is contained in:
cesnimda
2026-08-30 11:17:32 +02:00
parent 19c5251612
commit 16ef3b9463
10 changed files with 1246 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-deploy.yml
+6 -6
View File
@@ -26,7 +26,7 @@ jobs:
validate_sdk() {
[ -x "$DOTNET_ROOT/dotnet" ] \
&& "$DOTNET_ROOT/dotnet" --list-sdks | grep -q '^9\.' \
&& "$DOTNET_ROOT/dotnet" --list-sdks | grep -q '^9\.0\.317 ' \
&& "$DOTNET_ROOT/dotnet" --info >/dev/null
}
@@ -41,7 +41,7 @@ jobs:
fi
curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
rm -rf "$DOTNET_ROOT"
bash /tmp/dotnet-install.sh --channel 9.0 --install-dir "$DOTNET_ROOT" "${feed_args[@]}"
bash /tmp/dotnet-install.sh --version 9.0.317 --install-dir "$DOTNET_ROOT" "${feed_args[@]}"
validate_sdk
}
install || ( echo "dotnet install failed ($?) — retrying from alternate Microsoft CDN..." \
@@ -76,11 +76,11 @@ jobs:
# The runner/proxy has occasionally supplied checksum-invalid NuGet cache entries (NU3008).
# Retry from clean HTTP/global caches; signature verification remains enabled.
run: |
restore() { dotnet restore JobTrackerApi/JobTrackerApi.csproj; }
restore() { dotnet restore JobTrackerApi/JobTrackerApi.csproj --locked-mode; }
restore || ( echo "Backend restore failed ($?) — clearing runner NuGet caches and retrying once..." \
&& dotnet nuget locals http-cache --clear \
&& dotnet nuget locals global-packages --clear \
&& dotnet restore JobTrackerApi/JobTrackerApi.csproj --no-cache )
&& dotnet restore JobTrackerApi/JobTrackerApi.csproj --no-cache --locked-mode )
- name: Build backend
# Roslyn has intermittently exited 139 on this resource-constrained runner. Retry once
@@ -99,11 +99,11 @@ jobs:
# npm ci pattern below. The suite itself is never weakened or filtered.
- name: Restore backend tests
run: |
restore() { dotnet restore JobTrackerApi.Tests/JobTrackerApi.Tests.csproj; }
restore() { dotnet restore JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --locked-mode; }
restore || ( echo "NuGet restore failed ($?) — clearing runner caches and retrying once..." \
&& dotnet nuget locals http-cache --clear \
&& dotnet nuget locals global-packages --clear \
&& dotnet restore JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-cache )
&& dotnet restore JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-cache --locked-mode )
- name: Build backend tests
run: |