Dependencies getting copied to private feed in Azure DevOps

Question

I have set up a build pipeline for a model library that's shared between several of my projects. I'm accessing it through a private feed in Azure DevOps, and it works just fine. I can retrieve the library in Visual Studio and my projects all get the most up-to-date version. However, in the feed are all the dependency libraries used within the model library (eg Microsoft.Azure.Storage.Blob, System.Threading, Microsoft.AspNetCore, etc.). I haven't been able to find any guidance on why this is happening, if it's the expected behavior, or if I'm screwing something up. My YAML file for the build pipeline is below:

Also, does anyone know a better to handle package versioning? This seems really hacky, but it was the only way I could get auto-incrementing versions to work.

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

name: $(projectName)-$(majorMinorVersion).$(semanticVersion)

pool:
  vmImage: 'windows-latest'

# pipeline variables
variables:
  majorMinorVersion: 1.1
  # semanticVersion counter is automatically incremented by one in each execution of pipeline
  # second parameter is seed value to reset to every time the referenced majorMinorVersion is changed
  semanticVersion: $[counter(variables['majorMinorVersion'], 0)]
  projectName: 'MyProject.Models'
  buildConfiguration: 'Release'
  projectPath: 'Shared/MyProject.Models.csproj'
  fullVersion: '$(majorMinorVersion).$(semanticVersion)'

steps:
# show version number on start
- task: Bash@3
  inputs:
    targetType: 'inline'
    script: |
      echo Building $(projectName)-$(fullVersion)

- task: DotNetCoreCLI@2
  inputs:
    command: 'pack'
    packagesToPack: $(projectPath)
    versioningScheme: 'byEnvVar'
    versionEnvVar: 'fullVersion'

- task: DotNetCoreCLI@2
  inputs:
    command: 'push'
    packagesToPush: '$(Build.ArtifactStagingDirectory)/MyProject.Models*.nupkg'
    nuGetFeedType: 'internal'
    publishVstsFeed: '<feed GUID>'

Answer 1

Dependencies getting copied to private feed in Azure DevOps

That because your private Nuget Feed set nuget.org as an Upstream source by default if you set Package from public sources enable when you create the this feed:

Then go to Setting->Upstream source, you will find there are three public sources listed:

When we download any packages from the Upstream sources, it will been cached in the Artifacts, you will see it next time. They are cached packages from upstream sources, so we do not need to download them again from upstream sources next time we use them, and the included upstream sources are all approved by MS , so you do not need to worry about them.

Besides, if you still worry about them, you can disable the Upstream sources, but in this case, you need publish all the dependencies to your private feed, otherwise, your model library package will throw the error could not found the dependencies .

Hope this helps.