Check outdated nuget packages in DevOps pipeline

Question

I'm trying to check for outdated packages in one of our build pipelines. What complicates matters is that we're using packages coming from nuget.org as well as packages from our own repository (DevOps artifact feed). These sources are configured in a nuget.config. The package restore task succeeds without any problems:

- task: NuGetCommand@2
  displayName: Restore Nuget Packages
  inputs:
    command: 'restore'
    restoreSolution: '**/*.sln'
    feedsToUse: 'config'
    nugetConfigPath: 'nuget.config'

After this step we install the dotnet-outdated-tool:

- task: DotNetCoreCLI@2
  displayName: install dotnet-outdated-tool
  inputs:
    command: 'custom'
    custom: 'tool'
    arguments: 'install dotnet-outdated-tool -g --ignore-failed-sources'

note that we already add the --ignore-failed-sources option here or else the tool won't install properly since it complains about our feeds not being accessible, but we can get passed by adding the --ignore-failed-sources.

Next, and most important step regarding my question, is where we try to run the outdated tool to check for outdated packages:

- task: DotNetCoreCLI@2
  displayName: Check outdated packages
  inputs:
    command: 'custom'
    custom: 'outdated'
    arguments: '$(pathTosolution)'
  env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

for the packages from nuget.org this seems to be working fine:

  Microsoft.Extensions.DependencyInjection  5.0.0  -> 5.0.1 
  Microsoft.NET.Test.Sdk                    16.7.1 -> 16.9.1
  MSTest.TestAdapter                        2.1.1  -> 2.2.1 

for pacakges from our own feeds it can't resolve the latest version:

Some.Internal.Component            1.22.0        ->     

it also mentions:

Errors occurred while analyzing dependencies for some of your projects. Are you sure you can connect to all your configured NuGet servers?

So it's quite clear it can't connect to our internal nuget feeds. Tried solving it by adding the system access token to the task: SYSTEM_ACCESSTOKEN: $(System.AccessToken) But that doesn't solve anything unfortunately. What am I missing????

Inanity

I have exactly the same issue – Amund

We eventually solved it. See the answer I posted myself. – Inanity

Answer 1

We eventually solved it by injecting the PAT in the nuget.config using

powershell:
- task: PowerShell@2
  inputs:
    pwsh: true
    targetType: 'inline'
    script: |
       echo 'Adding tokens'
       foreach($line in Get-Content nuget.config) {
         if($line -match 'key=\"(?<key>[^\"]+)\"\s*value=\"(?<value>[^\"]+)\"'){
           if($Matches.key -notmatch 'nuget.org') {
             echo $Matches.key
             nuget sources remove -name $Matches.key
             nuget sources add -name $Matches.key -source $Matches.value -username anything -password $(System.AccessToken)
           }
         }
       }

Inanity

I think this is the preferred approach. github.com/dotnet-outdated/…, note setting the path for dotnet is required with the credential provider. I hope that helps. – Power