dotnet-inspect-private-feeds

name	dotnet-inspect-private-feeds
version	0.1.0
description	Inspect packages from private and custom NuGet feeds safely — select and map sources, use credential providers or explicit configuration, diagnose authentication failures, and reason about source-bound caches and offline operation.

dotnet-inspect: private NuGet feeds

Use this skill when package evidence lives outside NuGet.org. Start with a credential-free source configuration and a NuGet credential provider; keep tokens out of repositories and command lines.

dnx dotnet-inspect -y -- <command>

Select the feed

--nugetconfig uses exactly the named configuration. --source replaces the configured source set and can repeat; --add-source augments it for one run. Use a source-only config when a credential provider supplies authentication:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="private" value="https://example.com/nuget/v3/index.json" />
  </packageSources>
</configuration>

dnx dotnet-inspect -y -- package MyCompany.Widget --nugetconfig ./NuGet.Config
dnx dotnet-inspect -y -- package search Widget --nugetconfig ./NuGet.Config
dnx dotnet-inspect -y -- package MyCompany.Widget --versions-with-feed \
  --nugetconfig ./NuGet.Config

Version discovery combines all eligible sources and chooses the highest semantic version; source order is not precedence. Pin Package@Version when the exact coordinate matters.

Restrict package ids to feeds

dotnet-inspect honors <packageSourceMapping> from the selected NuGet configuration:

<packageSourceMapping>
  <packageSource key="private">
    <package pattern="MyCompany.*" />
  </packageSource>
  <packageSource key="nuget.org">
    <package pattern="*" />
  </packageSource>
</packageSourceMapping>

An exact package id wins over prefixes; otherwise the longest matching prefix wins. Mapping is applied independently to top-level packages, dependencies, RID companions, platform packs, tool redirects, searches, and routing probes. Every package id must match an active named source. --source and --add-source do not disable mapping; an override must match the configured endpoint to retain its mapped source name.

Azure Artifacts credential provider

Install Microsoft's provider as a global tool. dotnet-inspect discovers NUGET_NETCORE_PLUGIN_PATHS, then NUGET_PLUGIN_PATHS, then ~/.nuget/plugins/netcore/ and nuget-plugin-* executables on PATH.

dotnet tool install --global Microsoft.Artifacts.CredentialProvider.NuGet.Tool

Credential plugins run only after a feed answers 401. dotnet-inspect requests credentials noninteractively: cached and environment-supplied credentials work, but it never opens a sign-in prompt. az login alone does not supply a NuGet credential.

In Azure Pipelines, authenticate before restore or inspection:

- task: NuGetAuthenticate@1
- script: dotnet restore
- script: dnx dotnet-inspect -y -- package MyCompany.Widget

Outside Azure Pipelines, provide the provider's documented unattended credential input. Do not print the expanded value:

export ARTIFACTS_CREDENTIALPROVIDER_EXTERNAL_FEED_ENDPOINTS='{"endpointCredentials":[{"endpoint":"https://example.com/nuget/v3/index.json","username":"unused","password":"'"$TOKEN"'"}]}'

For an Azure Pipelines-compatible build identity, the provider also accepts ARTIFACTS_CREDENTIALPROVIDER_URI_PREFIXES with ARTIFACTS_CREDENTIALPROVIDER_ACCESSTOKEN. Service-principal certificate configuration uses ARTIFACTS_CREDENTIALPROVIDER_FEED_ENDPOINTS.

Explicit credentials

When no provider serves the feed, dotnet-inspect accepts both Username and ClearTextPassword under a matching packageSourceCredentials key. Keep that config outside the repository and select it with --nugetconfig.

Do not rely on %VAR% expansion, encrypted <Password>, NuGetPackageSourceCredentials_*, or credentials embedded in a source URL; dotnet-inspect does not use those forms.

Diagnose failures and caches

A reported 401 Unauthorized means the source was unreadable, not that the package is absent. Check provider discovery, URI matching, token scope, and expiration before changing the package id.

dotnet-inspect's package payload and candidate caches retain source provenance. The NuGet global folder is payload-only: it can fulfill an exact resolved coordinate only when .nupkg.metadata.source names an authorized producer. Missing or mismatched provenance is a cache miss, and installed payloads do not introduce version candidates. Use --no-nuget-cache to exclude that layer. --offline forbids network access and does not start credential plugins, so it succeeds only from producer-authorized caches. Configured non-HTTP sources, including folder feeds, are skipped in every mode; --verbose reports the skip. Pass a local .nupkg path directly when the package is available as a file.

dnx dotnet-inspect -y -- package MyCompany.Widget@1.2.3 \
  --source https://example.com/nuget/v3/index.json --no-nuget-cache
dnx dotnet-inspect -y -- package MyCompany.Widget@1.2.3 \
  --nugetconfig ./NuGet.Config --offline