microsoft / microsoft/react-native-windows
Stop using `/p:RestoreForceEvaluate=true` in CI
Nobody has claimed this yet.
- #13634 by @jonthysell — closed without merging
- Dominant language
- C++
- Stars
- 17.3k
- Forks
- 1.2k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 33
Description
Problem Description
The whole point of using (NuGet) dependency lock files is to ensure reliable builds by locking to the dependencies in the lock file.
However, we let the PR/CI re-evaluate the dependencies at build time, which is a big no-no. Worst case scenario we download and use a hijacked dependency package, ignoring that the version/hash doesn't match what's in our (trusted) lock file.
Steps To Reproduce
See PR/CI issues such as #11998 for examples of PR/CI using dependencies we didn't expect.
Expected Results
No response
CLI version
npx react-native -v
Environment
npx react-native info
Target Platform Version
None
Target Device(s)
Desktop
Visual Studio Version
Visual Studio 2022
Build Configuration
None
Snack, code example, screenshot, or link to a repository
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or workflow is named. Start by searching the CI and PR configuration for /p:RestoreForceEvaluate=true, then review the dependency-lock behavior discussed in #11998 and the linked work in #13634. Done means the flag is no longer used in CI and builds honor the lock file without re-evaluating dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native
- Domain
- build-system, ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100