feat: reproducible builds — central package versions and lock files #15

Merged

ochenstarik-ui merged 1 commit from antigravity/reproducible-builds into main

2026-08-09 12:08:08 +00:00

ochenstarik-ui commented

2026-08-07 10:32:08 +00:00

(Migrated from github.com)

Summary

Centralized package version management using Central Package Management (CPM) via Directory.Packages.props and enabled package lockfiles (packages.lock.json) across all projects for reproducible builds.

Key Changes

Central Package Management: Created Directory.Packages.props to pin all NuGet package versions centrally.
Package Lockfiles: Generated and committed packages.lock.json with multi-target RIDs (net10.0, net10.0/linux-arm64, net10.0/linux-x64, net10.0/win-x64) across all projects.
Locked Mode Enforcement: Updated all 5 workflow files and Build-Installer.ps1 to enforce locked mode during restore (-p:RestoreLockedMode=true for publish steps).
Analyzer & Formatting Separation: Re-enabled <EnableNETAnalyzers>true</EnableNETAnalyzers> and <AnalysisLevel>latest-recommended</AnalysisLevel> in Directory.Build.props. Split CI formatting verification into dotnet format whitespace --verify-no-changes and dotnet format style --verify-no-changes so formatting stays strictly checked while analyzer diagnostics act as build warnings.
ILLink Dependency Configuration: Added <PackageReference Include="Microsoft.NET.ILLink.Tasks" VersionOverride="10.0.10" PrivateAssets="all" /> in Directory.Build.props to harmonize trimmer dependencies across restore and publish evaluations.

Verification

Red Demonstration Run (Lock Guarantee): https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31308628267 (Failed with NU1004 upon lockfile mismatch).
Green Workflow Runs:
- Linux control and agent: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269541
- Linux platform matrix: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269539
- Windows build: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269537

## Summary Centralized package version management using Central Package Management (CPM) via `Directory.Packages.props` and enabled package lockfiles (`packages.lock.json`) across all projects for reproducible builds. ## Key Changes - **Central Package Management**: Created `Directory.Packages.props` to pin all NuGet package versions centrally. - **Package Lockfiles**: Generated and committed `packages.lock.json` with multi-target RIDs (`net10.0`, `net10.0/linux-arm64`, `net10.0/linux-x64`, `net10.0/win-x64`) across all projects. - **Locked Mode Enforcement**: Updated all 5 workflow files and `Build-Installer.ps1` to enforce locked mode during restore (`-p:RestoreLockedMode=true` for publish steps). - **Analyzer & Formatting Separation**: Re-enabled `<EnableNETAnalyzers>true</EnableNETAnalyzers>` and `<AnalysisLevel>latest-recommended</AnalysisLevel>` in `Directory.Build.props`. Split CI formatting verification into `dotnet format whitespace --verify-no-changes` and `dotnet format style --verify-no-changes` so formatting stays strictly checked while analyzer diagnostics act as build warnings. - **ILLink Dependency Configuration**: Added `<PackageReference Include="Microsoft.NET.ILLink.Tasks" VersionOverride="10.0.10" PrivateAssets="all" />` in `Directory.Build.props` to harmonize trimmer dependencies across restore and publish evaluations. ## Verification - **Red Demonstration Run (Lock Guarantee)**: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31308628267 (Failed with NU1004 upon lockfile mismatch). - **Green Workflow Runs**: - Linux control and agent: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269541 - Linux platform matrix: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269539 - Windows build: https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/31310269537