dependabot / dependabot/dependabot-core

NuGet: fails to build project if tools are required

Open
#12,019 1 comment 1 reaction 0 assignees View on GitHub
L: dotnet:nuget T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

nuget

### Package manager version

_No response_

### Language version

C#

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

https://github.com/dorssel/usbipd-win/blob/master/.github/dependabot.yml

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

The GitHub NuGet Dependabot tries to actually build the projects. However, one of the build steps requires a dotnet CLI tool. Since `dotnet tool restore` was never run, the (pre-)build step fails.

log (nuget in /. - Update #995960863):
```
2025/04/09 19:27:46 WARN Error determining dependencies from `/home/dependabot/dependabot-updater/repo/UnitTests/UnitTests.csproj`:
STDOUT:
Determining projects to restore...
Restored /home/dependabot/dependabot-updater/repo/UnitTests/UnitTests.csproj (in 8.62 sec).
Restored /home/dependabot/dependabot-updater/repo/Usbipd/Usbipd.csproj (in 10.01 sec).
Run "dotnet tool restore" to make the "dotnet-gitversion" command available.
/home/dependabot/.nuget/packages/dorssel.gitversion.msbuild/1.1.1/build/Dorssel.GitVersion.MsBuild.targets(28,5): error MSB3073: The command "dotnet tool run dotnet-gitversion "/home/dependabot/dependabot-updater/repo/Usbipd" -output file -outputfile "obj/gitversion.json"" exited with code 1. [/home/dependabot/dependabot-updater/repo/Usbipd/Usbipd.csproj]

Build FAILED.

/home/dependabot/.nuget/packages/dorssel.gitversion.msbuild/1.1.1/build/Dorssel.GitVersion.MsBuild.targets(28,5): error MSB3073: The command "dotnet tool run dotnet-gitversion "/home/dependabot/dependabot-updater/repo/Usbipd" -output file -outputfile "obj/gitversion.json"" exited with code 1. [/home/dependabot/dependabot-updater/repo/Usbipd/Usbipd.csproj]
0 Warning(s)
1 Error(s)

Time Elapsed 00:00:00.64

STDERR:

```

Oddly enough, Dependabot *is* able to detect package updates and correctly creates a PR, simply by analyzing `Directory.Packages.props`, `*.csproj`, etc. The action in the end returns successfully.

I wonder why Dependabot is trying to build the project at all... In any case, it fails if the build requires `dotnet tool restore` first.

Similar issues may arise if a project/solution requires certain dotnet workloads, requiring `dotnet workload restore` before building.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the NuGet updater's dependency-determination path and reproduce using the project configuration in .github/dependabot.yml. Inspect the build involving UnitTests/UnitTests.csproj and Usbipd/Usbipd.csproj, including the dotnet-gitversion failure shown in the log. Done means projects requiring restored .NET tools or workloads no longer cause dependency detection to fail.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.