ci: add NuGet package cache to dotnet setup steps by ANcpLua · Pull Request #287 · ANcpLua/qyl

ANcpLua · 2026-05-08T04:13:05Z

Adds cache: true and cache-dependency-path: '**/Directory.Packages.props' to all four setup-dotnet steps in ci.yml.

This caches restored NuGet packages between runs, reducing CI time for the build and audit jobs.

Left as uncommitted changes on main — this PR finishes and tracks the work.

^{Need help on this PR? Tag @codesmith with what you need.}

Let Codesmith autofix CI failures and bot reviews

Add cache: true and cache-dependency-path: '**/Directory.Packages.props' to all setup-dotnet steps in ci.yml. Speeds up CI by caching restored NuGet packages across runs. Jobs affected: build (3 dotnet setup steps) + audit job (1 dotnet setup step)

coderabbitai · 2026-05-08T04:13:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: bd17d691-dfd6-4a7c-bf92-8399009448ca

📥 Commits

Reviewing files that changed from the base of the PR and between ba25488 and fd67f78.

📒 Files selected for processing (1)

.github/workflows/ci.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

GitHub Check: Frontend Coverage
GitHub Check: Schema Drift (TypeSpec → Generated)
GitHub Check: Backend (.NET)
GitHub Check: claude-review
GitHub Check: Analyze (csharp)
GitHub Check: Analyze (python)
GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (1)

.github/**

⚙️ CodeRabbit configuration file

GitHub Actions workflows. Review for: action version pinning (use SHA not tags), proper secret handling (no secrets in logs), unnecessary workflow triggers, and job dependency correctness. Flag missing concurrency groups on push-triggered workflows.

Files:

.github/workflows/ci.yml

🔇 Additional comments (1)

.github/workflows/ci.yml (1)

45-51: No actionable issues in the modified setup-dotnet cache blocks after applying the repository workflow guidelines checks.

Also applies to: 201-207, 270-276, 301-307

📝 Walkthrough

Walkthrough

This PR adds .NET SDK caching to four CI jobs in the GitHub Actions workflow. Each actions/setup-dotnet invocation in the backend, schema-drift, dependency-audit, and regen-clean jobs now includes cache: true and scopes the cache key to **/Directory.Packages.props. This change applies the same caching strategy uniformly across all affected workflow jobs, eliminating redundant dependency restoration across job executions.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commits format with 'ci' prefix, clear scope '(add NuGet package cache to dotnet setup steps)', and is under 72 characters.
Description check	✅ Passed	Description directly addresses the changeset by explaining what cache configuration was added, which jobs were affected, and the performance rationale.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly

Built for teams:

Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-08T04:13:20Z

@coderabbitai autofix

claude · 2026-05-08T04:13:27Z

Claude finished @ANcpLua's task in 1m 47s —— View job

Code review

Read CI workflow change
Inspect surrounding setup-dotnet steps
Verify Directory.Packages.props exists at repo root
Post review

Verdict: looks good — no changes requested.

Walked through the diff and the surrounding workflow:

cache: true + cache-dependency-path: '**/Directory.Packages.props' is the documented workaround for repos without packages.lock.json files (none in this repo — confirmed). With <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>, the root Directory.Packages.props holds every PackageVersion pin, so its hash is a faithful proxy for the dependency version surface.
All four setup-dotnet invocations are updated consistently (backend ci.yml:42, schema-drift ci.yml:193, dependency-audit ci.yml:257, regen-clean ci.yml:283), so each job benefits from the same cache.
Glob resolution is stable across jobs: only one Directory.Packages.props exists in the tree (root), and the OTel semantic-conventions submodule doesn't ship one, so submodules: true vs not (the dependency-audit job omits it) doesn't change the hash. Same key everywhere.
TypeSpec regen (packages/Qyl.Contracts/Generated/**, gitignored) runs after setup-dotnet, so it can't perturb the cache key for its own run, and there's nothing for it to perturb on later runs since those paths aren't committed.

Minor caveat — not blocking, just worth knowing: if a future change adds a new package by editing only a .csproj PackageReference (without touching Directory.Packages.props), the cache key won't change. dotnet restore will fetch the missing package on a cache hit but won't re-save the cache. Functionally correct, occasionally suboptimal. If that pattern becomes common you could broaden to '**/Directory.Packages.props\n**/*.csproj', but for the current repo shape (versions concentrated in CPM) the current key is the right tradeoff.

Note: I can't push fixes to .github/workflows/ even if I wanted to — GitHub App permissions block workflow edits — so this would have been a comment-only review either way. Nothing to fix here.
· dev/dotnet-cache-ci

coderabbitai · 2026-05-08T04:13:27Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 45-46: The CI cache configuration for each setup-dotnet step
currently uses only cache-dependency-path: '**/Directory.Packages.props'; update
those setup-dotnet blocks to broaden cache-dependency-path so cache keys also
consider project and lock files (e.g., include patterns like '**/*.csproj',
'**/*.fsproj', '**/packages.lock.json' alongside '**/Directory.Packages.props')
so cache invalidation becomes deterministic and visible in logs; modify all four
setup-dotnet blocks referenced in the comment to use the expanded list of paths.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e1ebaa48-4204-4839-b326-7ea6f11eb8b6

📥 Commits

Reviewing files that changed from the base of the PR and between bb1485c and ba25488.

📒 Files selected for processing (1)

.github/workflows/ci.yml

📜 Review details

⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)

GitHub Check: Agent
GitHub Check: Backend (.NET)
GitHub Check: Schema Drift (TypeSpec → Generated)
GitHub Check: Regen Clean (T2)
GitHub Check: Frontend (React)
GitHub Check: Dependency Audit
GitHub Check: claude-review
GitHub Check: Analyze (python)
GitHub Check: Analyze (csharp)
GitHub Check: Analyze (javascript-typescript)

🧰 Additional context used

📓 Path-based instructions (1)

.github/**

⚙️ CodeRabbit configuration file

GitHub Actions workflows. Review for: action version pinning (use SHA not tags), proper secret handling (no secrets in logs), unnecessary workflow triggers, and job dependency correctness. Flag missing concurrency groups on push-triggered workflows.

Files:

.github/workflows/ci.yml

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

github-actions · 2026-05-08T06:01:16Z

@coderabbitai autofix

claude · 2026-05-08T06:01:21Z

Claude finished @ANcpLua's task in 52s —— View job

Claude finished review — PR looks good, no further changes needed.

Code review

Read PR diff against origin/main
Verify CodeRabbit feedback was addressed in fd67f78
Confirm cache-key inputs exist in the tree
Post review

Verdict: approve. No commits needed.

Re-checked after fd67f78 ("broaden dotnet cache dependency paths") landed. All four setup-dotnet blocks (backend ci.yml:42, schema-drift ci.yml:198, dependency-audit ci.yml:267, regen-clean ci.yml:298) now hash:

cache-dependency-path: |
  **/Directory.Packages.props
  **/*.csproj
  **/*.fsproj
  **/packages.lock.json
  **/nuget.config

Verified inputs against the tree:

Directory.Packages.props — present at root (CPM source of truth).
nuget.config — present at root.
*.csproj — many; adding/removing a PackageReference now correctly invalidates.
*.fsproj, packages.lock.json — none today; harmless future-proofing, the globs just match nothing.

This addresses the only substantive concern from the prior review (silent cache reuse when a new package was added via .csproj without touching CPM). Setup-dotnet still saves the post-restore cache on a hit, so even a partial-key match would have been functionally correct — but explicit invalidation is more visible in CI logs, which is the right call.

Pinning, secret hygiene, concurrency group, and job dependencies in ci.yml all look correct (SHA-pinned actions, cancel-in-progress gated to PRs, no cross-job leakage). Nothing else to flag.
· dev/dotnet-cache-ci

coderabbitai · 2026-05-08T06:01:23Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

Copilot AI review requested due to automatic review settings May 8, 2026 04:13

Copilot started reviewing on behalf of ANcpLua May 8, 2026 04:13 View session

coderabbitai Bot requested changes May 8, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

Copilot AI reviewed May 8, 2026

ci: broaden dotnet cache dependency paths

fd67f78

coderabbitai Bot approved these changes May 8, 2026

View reviewed changes

ANcpLua merged commit 52b68d4 into main May 8, 2026
13 checks passed

ANcpLua deleted the dev/dotnet-cache-ci branch May 8, 2026 06:06

Navigation Menu

ci: add NuGet package cache to dotnet setup steps - #287

ci: add NuGet package cache to dotnet setup steps#287
ANcpLua merged 2 commits into
mainfrom
dev/dotnet-cache-ci

ANcpLua commented May 8, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

coderabbitai Bot commented May 8, 2026 •

edited

Loading

Walkthrough

Uh oh!

github-actions Bot commented May 8, 2026

Uh oh!

claude Bot commented May 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 8, 2026

Uh oh!

claude Bot commented May 8, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ANcpLua commented May 8, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

github-actions Bot commented May 8, 2026

Uh oh!

claude Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 8, 2026

Uh oh!

claude Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ANcpLua commented May 8, 2026 •

edited by blacksmith-sh Bot

Loading

coderabbitai Bot commented May 8, 2026 •

edited

Loading

claude Bot commented May 8, 2026 •

edited

Loading

claude Bot commented May 8, 2026 •

edited

Loading