M⚠️ ◾ Automated Package Update by neilr81 · Pull Request #821 · microsoft/Omex

neilr81 · 2026-02-08T21:45:13Z

This PR was created automatically by the workflow run 21805902413.

This script updates NuGet package versions in the Directory.Packages.props file by querying the latest available versions and updating the Version attributes accordingly, while respecting the PreserveMajor attribute and pre-release version detection.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Changed the trigger for package updates to a scheduled cron job.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Initial plan * Gate PR creation on changes detection flag Co-authored-by: neilr81 <49037171+neilr81@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: neilr81 <49037171+neilr81@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Removed GitHub CLI installation step from workflow.

Removed the 'powershell' label from the automated package update PR.

This script updates .NET SDK and MSBuild SDK versions in the global.json file by querying the latest releases and modifying the file accordingly.

github-actions · 2026-02-08T21:45:30Z

PR Metrics

❌ Try to keep pull requests smaller than 400 lines of new product code by following the Single Responsibility Principle (SRP).
⚠️ Consider adding additional tests.

	Lines
Product Code	709
Test Code	-
Subtotal	709
Ignored Code	68
Total	777

Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs!

Copilot

Pull request overview

Adds GitHub Actions automation to keep NuGet package versions (and future SDK versions) up to date via PowerShell scripts, and applies the latest automated update to central package versions.

Changes:

Bumps MSTest packages in Directory.Packages.props (and reformats the file as a side effect of serialization).
Adds a scheduled workflow to run the NuGet package update script and open a PR automatically.
Introduces PowerShell scripts to update Directory.Packages.props (NuGet packages) and global.json (.NET SDK/MSBuild SDKs).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
Directory.Packages.props	Updates MSTest versions; file formatting/encoding also changed.
.github/workflows/package-update.yml	New scheduled workflow to run update script and open a PR.
.github/scripts/Update-NuGetPackageVersions.ps1	New script that searches feeds and updates central package versions.
.github/scripts/Update-DotNetSdkVersions.ps1	New script to update `global.json` SDK and MSBuild SDK versions (not yet wired into workflow).

Copilot · 2026-02-08T21:49:33Z

+        # Check if NuGet.config exists in the sources directory
+        $nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"
+        $configSourceFlag = ""
+        if (Test-Path $nugetConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet.config from: $nugetConfigPath"
+            }
+        } else {
+            Write-Warning "NuGet.config not found at: $nugetConfigPath - search may not find private feeds"


The script looks for NuGet.config, but this repo uses NuGet.Config (capital C). On case-sensitive filesystems this will fail to locate the config and may miss private feeds. Update the filename casing to match the repo root file (NuGet.Config).

Suggested change

# Check if NuGet.config exists in the sources directory

$nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"

$configSourceFlag = ""

if (Test-Path $nugetConfigPath) {

$configSourceFlag = "--configfile `"$nugetConfigPath`""

if ($EnableVerboseLogging) {

Write-Host " [VERBOSE] Using NuGet.config from: $nugetConfigPath"

}

} else {

Write-Warning "NuGet.config not found at: $nugetConfigPath - search may not find private feeds"

# Check if NuGet.Config exists in the sources directory

$nugetConfigPath = Join-Path $SourcesDirectory "NuGet.Config"

$configSourceFlag = ""

if (Test-Path $nugetConfigPath) {

$configSourceFlag = "--configfile `"$nugetConfigPath`""

if ($EnableVerboseLogging) {

Write-Host " [VERBOSE] Using NuGet.Config from: $nugetConfigPath"

}

} else {

Write-Warning "NuGet.Config not found at: $nugetConfigPath - search may not find private feeds"

Copilot · 2026-02-08T21:49:33Z

+        $searchCmd = "dotnet package search `"$PackageId`" --exact-match --format json $prereleaseFlag $configSourceFlag"
+
+        if ($EnableVerboseLogging) {
+            Write-Host "  [VERBOSE] Executing: $searchCmd"
+        }
+
+        Write-Host "Searching for MSBuild SDK: $PackageId"
+
+        $output = Invoke-Expression $searchCmd 2>&1 | Out-String
+


Using Invoke-Expression to execute the dotnet package search command is fragile and can be unsafe. Prefer invoking dotnet with & and a proper argument list to avoid quoting issues and reduce injection risk.

Copilot · 2026-02-08T21:49:34Z

+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  pull_request:
+    branches: [ "main" ]
+


The workflow is configured to run on pull_request events, but the job creates commits/branches and opens a PR. This can run on every PR targeting main and potentially create recursive/duplicate automation PRs. Restrict this workflow to schedule/workflow_dispatch, or add a job-level condition (e.g., only run when github.event_name == 'schedule') before any git push / PR creation steps.

Copilot · 2026-02-08T21:49:34Z

+        # Prefer NuGet-GitHub.Config (used on GitHub runners) when present, otherwise fall back to NuGet.config
+        $nugetGithubConfigPath = Join-Path $SourcesDirectory "NuGet-GitHub.Config"
+        $nugetConfigPath = Join-Path $SourcesDirectory "NuGet.config"
+        $configSourceFlag = ""
+        if (Test-Path $nugetGithubConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetGithubConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet-GitHub.Config from: $nugetGithubConfigPath"
+            }
+        }
+        elseif (Test-Path $nugetConfigPath) {
+            $configSourceFlag = "--configfile `"$nugetConfigPath`""
+            if ($EnableVerboseLogging) {
+                Write-Host "  [VERBOSE] Using NuGet.config from: $nugetConfigPath"
+            }
+        }
+        else {
+            Write-Warning "NuGet-GitHub.Config or NuGet.config not found at: $SourcesDirectory - search may not find required feeds"
+        }


The script falls back to NuGet.config, but this repo uses NuGet.Config (capital C) at the repo root. On case-sensitive filesystems (e.g., Linux/macOS), this fallback will never be found, which can make package searches miss required feeds. Update the filename casing to match the repo (NuGet.Config) and keep the warning text consistent.

Copilot · 2026-02-08T21:49:34Z

+        $searchCmd = "dotnet package search `"$PackageId`" --exact-match --format json $prereleaseFlag $configSourceFlag"
+
+        if ($EnableVerboseLogging) {
+            Write-Host "  [VERBOSE] Executing: $searchCmd"
+        }
+
+        Write-Host ("Searching for package: {0} {1}" -f $PackageId, ($MajorVersion ? ('(major version {0}.*)' -f $MajorVersion) : ''))
+
+        $output = Invoke-Expression $searchCmd 2>&1 | Out-String
+


Using Invoke-Expression to run the dotnet package search command is brittle (quoting/escaping) and introduces command-injection risk if any input ever becomes untrusted. Prefer invoking dotnet directly with the call operator (&) and an argument array, and capture stdout for JSON parsing.

Copilot · 2026-02-08T21:49:34Z

+
+if ($updateCount -gt 0) {
+    Write-Host "##[section]Saving $updateCount package updates to $propsFile"
+    $xml.Save($propsFile)


Saving the XmlDocument via $xml.Save($propsFile) rewrites the file’s formatting/encoding (this PR shows widespread whitespace changes and a BOM added to Directory.Packages.props). To avoid noisy diffs on every run, write with explicit XmlWriter settings (encoding/no BOM, preserve formatting) or update only the Version attribute text in-place without reserializing the whole document.

Suggested change

$xml.Save($propsFile)

# Save XML with explicit settings to avoid changing encoding/formatting (no BOM, preserve whitespace)

$xmlWriterSettings = New-Object System.Xml.XmlWriterSettings

$xmlWriterSettings.Encoding = New-Object System.Text.UTF8Encoding($false) # UTF-8 without BOM

$xmlWriterSettings.Indent = $false

$xmlWriterSettings.NewLineHandling = [System.Xml.NewLineHandling]::None

$xmlWriter = [System.Xml.XmlWriter]::Create($propsFile, $xmlWriterSettings)

try {

$xml.Save($xmlWriter)

}

finally {

$xmlWriter.Dispose()

}

Copilot · 2026-02-08T21:49:35Z

@@ -1,59 +1,59 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>


Directory.Packages.props now starts with a UTF-8 BOM (U+FEFF) and had broad formatting churn. If this is unintended, configure the update script’s save logic to emit UTF-8 without BOM and avoid touching unrelated whitespace so future automated updates produce minimal diffs.

Suggested change

<?xml version="1.0" encoding="utf-8"?>

<?xml version="1.0" encoding="utf-8"?>

Copilot · 2026-02-08T21:49:35Z

+    [Parameter(Mandatory = $false)]
+    [bool]$FailOnError = $false
+)
+


SourcesDirectory defaults only to $env:BUILD_SOURCESDIRECTORY and isn’t normalized/validated like the NuGet update script. When run outside Azure Pipelines (e.g., GitHub Actions or locally), this can be empty and cause Join-Path/Test-Path failures. Add the same fallback logic ($env:GITHUB_WORKSPACE / current directory) and validate the directory exists before use.

Suggested change

# Normalize and validate sources directory for use across environments

if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {

$SourcesDirectory = $env:BUILD_SOURCESDIRECTORY

}

if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {

$SourcesDirectory = $env:GITHUB_WORKSPACE

}

if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {

$SourcesDirectory = (Get-Location).Path

}

if (-not (Test-Path -LiteralPath $SourcesDirectory -PathType Container)) {

throw "Sources directory '$SourcesDirectory' does not exist or is not a directory."

}

$SourcesDirectory = (Resolve-Path -LiteralPath $SourcesDirectory).Path

neilr81 and others added 30 commits February 7, 2026 14:08

Add GitHub Actions workflow for package updates

5a23446

Update script paths in package-update.yml

c0d9eb7

Apply suggestion from @Copilot

bfb26c8

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update package-update workflow to use cron schedule

88eb82c

Changed the trigger for package updates to a scheduled cron job.

Update .github/scripts/Update-NuGetPackageVersions.ps1

671dd97

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/scripts/Update-NuGetPackageVersions.ps1

4b27d31

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

8c3190a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

287fbe0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestion from @Copilot

c56db37

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add pull_request_target trigger to workflow

1a02929

Apply suggestion from @Copilot

1cf02c9

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update package-update.yml

331b09d

Update package-update.yml

07d2d47

Rename checkout step for clarity

0455764

Remove GitHub CLI installation from package-update.yml

1cbd892

Removed GitHub CLI installation step from workflow.

Update Update-NuGetPackageVersions.ps1

3e92781

Fix label assignment in package-update workflow

fc9b6c7

Remove 'powershell' label from package update PR

527230e

Removed the 'powershell' label from the automated package update PR.

Add label to automated package update PR

34493b9

Fix label formatting in package-update.yml

f2afff8

Add token input for create pull request action

f5431d8

Update GH_TOKEN to use secrets for PR creation

cd5081d

Update package-update.yml

852325b

Add script to update .NET SDK and MSBuild SDK versions

0150f4e

This script updates .NET SDK and MSBuild SDK versions in the global.json file by querying the latest releases and modifying the file accordingly.

Merge 0150f4e into 60e2378

6c0ff0c

chore(automation): apply PowerShell updates

3d8c054

Merge 3d8c054 into 60e2378

7d85dac

Merge 7d85dac into 60e2378

2e990e3

neilr81 added 8 commits February 8, 2026 21:33

Merge 2e990e3 into 60e2378

3188132

Merge 3188132 into 60e2378

d9a33c9

Merge d9a33c9 into 60e2378

de397b9

Merge de397b9 into 60e2378

483c42f

Merge 483c42f into 60e2378

46a3008

Merge 46a3008 into 60e2378

ef098de

Merge ef098de into 60e2378

c062660

Merge c062660 into 60e2378

4ab4a26

neilr81 requested a review from a team as a code owner February 8, 2026 21:45

Copilot AI review requested due to automatic review settings February 8, 2026 21:45

neilr81 added the automation Item has been created automatically. label Feb 8, 2026

neilr81 self-assigned this Feb 8, 2026

github-actions Bot changed the title ~~Automated Package Update~~ M⚠️ ◾ Automated Package Update Feb 8, 2026

Copilot started reviewing on behalf of neilr81 February 8, 2026 21:45 View session

neilr81 closed this Feb 8, 2026

neilr81 deleted the automation/package-update-21805902413 branch February 8, 2026 21:47

Copilot AI reviewed Feb 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

M⚠️ ◾ Automated Package Update#821

M⚠️ ◾ Automated Package Update#821
neilr81 wants to merge 38 commits into
mainfrom
automation/package-update-21805902413

neilr81 commented Feb 8, 2026

Uh oh!

github-actions Bot commented Feb 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Copilot AI Feb 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-    $xml.Save($propsFile)
+    # Save XML with explicit settings to avoid changing encoding/formatting (no BOM, preserve whitespace)
+    $xmlWriterSettings = New-Object System.Xml.XmlWriterSettings
+    $xmlWriterSettings.Encoding = New-Object System.Text.UTF8Encoding($false) # UTF-8 without BOM
+    $xmlWriterSettings.Indent = $false
+    $xmlWriterSettings.NewLineHandling = [System.Xml.NewLineHandling]::None
+    $xmlWriter = [System.Xml.XmlWriter]::Create($propsFile, $xmlWriterSettings)
+    try {
+        $xml.Save($xmlWriter)
+    }
+    finally {
+        $xmlWriter.Dispose()
+    }

		@@ -1,59 +1,59 @@
		<?xml version="1.0" encoding="utf-8"?>
		<?xml version="1.0" encoding="utf-8"?>

+# Normalize and validate sources directory for use across environments
+if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {
+    $SourcesDirectory = $env:BUILD_SOURCESDIRECTORY
+}
+if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {
+    $SourcesDirectory = $env:GITHUB_WORKSPACE
+}
+if ([string]::IsNullOrWhiteSpace($SourcesDirectory)) {
+    $SourcesDirectory = (Get-Location).Path
+}
+if (-not (Test-Path -LiteralPath $SourcesDirectory -PathType Container)) {
+    throw "Sources directory '$SourcesDirectory' does not exist or is not a directory."
+}
+$SourcesDirectory = (Resolve-Path -LiteralPath $SourcesDirectory).Path

Conversation

neilr81 commented Feb 8, 2026

Uh oh!

github-actions Bot commented Feb 8, 2026

PR Metrics

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants