M⚠️ ◾ Automated Package Update by neilr81 · Pull Request #819 · microsoft/Omex

neilr81 · 2026-02-08T21:43:21Z

This PR was created automatically by the workflow run 21805878640.

This script updates NuGet package versions in the Directory.Packages.props file by querying the latest available versions and updating the Version attributes accordingly, while respecting the PreserveMajor attribute and pre-release version detection.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Changed the trigger for package updates to a scheduled cron job.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Initial plan * Gate PR creation on changes detection flag Co-authored-by: neilr81 <49037171+neilr81@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: neilr81 <49037171+neilr81@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Removed GitHub CLI installation step from workflow.

Removed the 'powershell' label from the automated package update PR.

This script updates .NET SDK and MSBuild SDK versions in the global.json file by querying the latest releases and modifying the file accordingly.

github-actions · 2026-02-08T21:43:47Z

PR Metrics

❌ Try to keep pull requests smaller than 400 lines of new product code by following the Single Responsibility Principle (SRP).
⚠️ Consider adding additional tests.

	Lines
Product Code	709
Test Code	-
Subtotal	709
Ignored Code	68
Total	777

Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs!

Copilot

Pull request overview

Adds GitHub-based automation to periodically update centrally-managed NuGet package versions (and includes a helper script for updating global.json SDK versions), alongside a small package version bump.

Changes:

Bump MSTest packages in Directory.Packages.props.
Add a scheduled GitHub Actions workflow to run an update script, commit changes, and open a PR.
Add PowerShell scripts to update Directory.Packages.props (NuGet packages) and global.json (.NET SDK / MSBuild SDKs).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
Directory.Packages.props	Updates centrally-managed package versions (notably MSTest 4.0.2 → 4.1.0) and formatting churn from XML save.
.github/workflows/package-update.yml	New scheduled workflow that runs the updater script and opens an automated PR.
.github/scripts/Update-NuGetPackageVersions.ps1	New script to search latest NuGet versions and update `Directory.Packages.props`.
.github/scripts/Update-DotNetSdkVersions.ps1	New script to update `.NET SDK` version and MSBuild SDK package versions in `global.json`.

Copilot · 2026-02-08T21:49:48Z

+    [Parameter(Mandatory = $false)]
+    [bool]$FailOnError = $false
+)
+


$SourcesDirectory defaults to $env:BUILD_SOURCESDIRECTORY, which won’t be set in GitHub Actions and may be empty locally. Later Join-Path $SourcesDirectory ... will throw when $SourcesDirectory is null/empty.

Add the same normalization/validation fallback used in Update-NuGetPackageVersions.ps1 (e.g., fall back to $env:GITHUB_WORKSPACE and then Get-Location).

Suggested change

# Normalize and validate SourcesDirectory, with fallbacks for non-Azure environments

if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {

if (-not [string]::IsNullOrWhiteSpace($env:BUILD_SOURCESDIRECTORY)) {

$SourcesDirectory = $env:BUILD_SOURCESDIRECTORY

} elseif (-not [string]::IsNullOrWhiteSpace($env:GITHUB_WORKSPACE)) {

$SourcesDirectory = $env:GITHUB_WORKSPACE

} else {

$SourcesDirectory = (Get-Location).Path

}

}

try {

$SourcesDirectory = (Resolve-Path -LiteralPath $SourcesDirectory).Path

} catch {

# If resolution fails, keep the original value; subsequent operations may handle/throw.

}

Copilot · 2026-02-08T21:49:49Z

+        # Check if NuGet.config exists in the sources directory
+        $nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"
+        $configSourceFlag = ""
+        if (Test-Path $nugetConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet.config from: $nugetConfigPath"
+            }
+        } else {
+            Write-Warning "NuGet.config not found at: $nugetConfigPath - search may not find private feeds"


The repository config file is NuGet.Config, but the script looks for NuGet.config. On case-sensitive file systems this will fail to find the config and may prevent package search from using the intended feeds.

Use the correct casing (NuGet.Config) consistently in both the file check and the warning/verbose messages.

Suggested change

# Check if NuGet.config exists in the sources directory

$nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"

$configSourceFlag = ""

if (Test-Path $nugetConfigPath) {

$configSourceFlag = "--configfile `"$nugetConfigPath`""

if ($EnableVerboseLogging) {

Write-Host " [VERBOSE] Using NuGet.config from: $nugetConfigPath"

}

} else {

Write-Warning "NuGet.config not found at: $nugetConfigPath - search may not find private feeds"

# Check if NuGet.Config exists in the sources directory

$nugetConfigPath = Join-Path $SourcesDirectory "NuGet.Config"

$configSourceFlag = ""

if (Test-Path $nugetConfigPath) {

$configSourceFlag = "--configfile `"$nugetConfigPath`""

if ($EnableVerboseLogging) {

Write-Host " [VERBOSE] Using NuGet.Config from: $nugetConfigPath"

}

} else {

Write-Warning "NuGet.Config not found at: $nugetConfigPath - search may not find private feeds"

Copilot · 2026-02-08T21:49:49Z

+        $searchCmd = "dotnet package search `"$PackageId`" --exact-match --format json $prereleaseFlag $configSourceFlag"
+
+        if ($EnableVerboseLogging) {
+            Write-Host "  [VERBOSE] Executing: $searchCmd"
+        }
+
+        Write-Host "Searching for MSBuild SDK: $PackageId"
+
+        $output = Invoke-Expression $searchCmd 2>&1 | Out-String
+


Invoke-Expression executes a constructed command string, which is error-prone for escaping and increases the blast radius of unexpected input. Since $PackageId and paths are interpolated into the string, prefer invoking dotnet with the call operator (&) and explicit arguments instead.

This will be safer and more reliable across different package IDs/paths.

Copilot · 2026-02-08T21:49:49Z

+          if (git diff --cached --quiet) {
+            echo "No changes detected; skipping commit and PR creation."
+            echo "has-changes=false" >> $env:GITHUB_OUTPUT
+            exit 0
+          }


git diff --cached --quiet doesn’t write to stdout, so in PowerShell if (git diff --cached --quiet) { ... } will always evaluate as false regardless of the exit code. This means the workflow will try to commit even when there are no staged changes, causing the step to fail on git commit.

Capture the exit code (e.g., run the command, then check $LASTEXITCODE / $?) to decide whether to skip PR creation.

Copilot · 2026-02-08T21:49:49Z

+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  pull_request:
+    branches: [ "main" ]
+


This workflow is configured to run on pull_request events targeting main while also pushing branches and opening PRs. On PR events (especially from forks), repository secrets (e.g., CREATE_PULLREQUEST) aren’t available and the job can fail; additionally it risks PR/branch churn when the automation’s own PR triggers the workflow again.

Consider limiting this workflow to schedule/workflow_dispatch only, or add conditions to skip when the actor is the bot and/or when the ref is already an automation/package-update-* branch.

Copilot · 2026-02-08T21:49:49Z

+        # Prefer NuGet-GitHub.Config (used on GitHub runners) when present, otherwise fall back to NuGet.config
+        $nugetGithubConfigPath = Join-Path $SourcesDirectory "NuGet-GitHub.Config"
+        $nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"
+        $configSourceFlag = ""
+        if (Test-Path $nugetGithubConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetGithubConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet-GitHub.Config from: $nugetGithubConfigPath"
+            }
+        }
+        elseif (Test-Path $nugetConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet.config from: $nugetConfigPath"
+            }
+        }
+        else {
+            Write-Warning "NuGet-GitHub.Config or NuGet.config not found at: $SourcesDirectory - search may not find required feeds"
+        }


The repo’s NuGet config file is named NuGet.Config (capital “C”), but the script falls back to NuGet.config. On case-sensitive file systems this fallback will never be found, and the script may search without the intended feeds.

Update the fallback filename (and associated log messages) to match NuGet.Config exactly.

Copilot · 2026-02-08T21:49:50Z

+        $searchCmd = "dotnet package search `"$PackageId`" --exact-match --format json $prereleaseFlag $configSourceFlag"
+
+        if ($EnableVerboseLogging) {
+            Write-Host "  [VERBOSE] Executing: $searchCmd"
+        }
+
+        Write-Host ("Searching for package: {0} {1}" -f $PackageId, ($MajorVersion ? ('(major version {0}.*)' -f $MajorVersion) : ''))
+
+        $output = Invoke-Expression $searchCmd 2>&1 | Out-String
+


Building a command string and executing it via Invoke-Expression is risky and makes argument escaping brittle. Here the command contains values derived from repo data ($PackageId, paths), so a malformed value could change the executed command.

Prefer invoking dotnet directly with the call operator (&) and a proper argument array (or Start-Process) instead of Invoke-Expression.

neilr81 and others added 30 commits February 7, 2026 14:08

Add GitHub Actions workflow for package updates

5a23446

Update script paths in package-update.yml

c0d9eb7

Apply suggestion from @Copilot

bfb26c8

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update package-update workflow to use cron schedule

88eb82c

Changed the trigger for package updates to a scheduled cron job.

Update .github/scripts/Update-NuGetPackageVersions.ps1

671dd97

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/scripts/Update-NuGetPackageVersions.ps1

4b27d31

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

8c3190a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

287fbe0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

c56db37

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add pull_request_target trigger to workflow

1a02929

Apply suggestion from @Copilot

1cf02c9

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update package-update.yml

331b09d

Update package-update.yml

07d2d47

Rename checkout step for clarity

0455764

Remove GitHub CLI installation from package-update.yml

1cbd892

Removed GitHub CLI installation step from workflow.

Update Update-NuGetPackageVersions.ps1

3e92781

Fix label assignment in package-update workflow

fc9b6c7

Remove 'powershell' label from package update PR

527230e

Removed the 'powershell' label from the automated package update PR.

Add label to automated package update PR

34493b9

Fix label formatting in package-update.yml

f2afff8

Add token input for create pull request action

f5431d8

Update GH_TOKEN to use secrets for PR creation

cd5081d

Update package-update.yml

852325b

Add script to update .NET SDK and MSBuild SDK versions

0150f4e

This script updates .NET SDK and MSBuild SDK versions in the global.json file by querying the latest releases and modifying the file accordingly.

Merge 0150f4e into 60e2378

6c0ff0c

chore(automation): apply PowerShell updates

3d8c054

Merge 3d8c054 into 60e2378

7d85dac

Merge 7d85dac into 60e2378

2e990e3

neilr81 added 7 commits February 8, 2026 21:33

Merge 2e990e3 into 60e2378

3188132

Merge 3188132 into 60e2378

d9a33c9

Merge d9a33c9 into 60e2378

de397b9

Merge de397b9 into 60e2378

483c42f

Merge 483c42f into 60e2378

46a3008

Merge 46a3008 into 60e2378

ef098de

Merge ef098de into 60e2378

c062660

Copilot AI review requested due to automatic review settings February 8, 2026 21:43

neilr81 requested a review from a team as a code owner February 8, 2026 21:43

neilr81 added the automation Item has been created automatically. label Feb 8, 2026

neilr81 self-assigned this Feb 8, 2026

github-actions Bot changed the title ~~Automated Package Update~~ M⚠️ ◾ Automated Package Update Feb 8, 2026

Copilot started reviewing on behalf of neilr81 February 8, 2026 21:43 View session

neilr81 closed this Feb 8, 2026

neilr81 deleted the automation/package-update-21805878640 branch February 8, 2026 21:48

Copilot AI reviewed Feb 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

M⚠️ ◾ Automated Package Update#819

M⚠️ ◾ Automated Package Update#819
neilr81 wants to merge 37 commits into
mainfrom
automation/package-update-21805878640

neilr81 commented Feb 8, 2026

Uh oh!

github-actions Bot commented Feb 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

+# Normalize and validate SourcesDirectory, with fallbacks for non-Azure environments
+if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {
+    if (-not [string]::IsNullOrWhiteSpace($env:BUILD_SOURCESDIRECTORY)) {
+        $SourcesDirectory = $env:BUILD_SOURCESDIRECTORY
+    } elseif (-not [string]::IsNullOrWhiteSpace($env:GITHUB_WORKSPACE)) {
+        $SourcesDirectory = $env:GITHUB_WORKSPACE
+    } else {
+        $SourcesDirectory = (Get-Location).Path
+    }
+}
+try {
+    $SourcesDirectory = (Resolve-Path -LiteralPath $SourcesDirectory).Path
+} catch {
+    # If resolution fails, keep the original value; subsequent operations may handle/throw.
+}

Conversation

neilr81 commented Feb 8, 2026

Uh oh!

github-actions Bot commented Feb 8, 2026

PR Metrics

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants