Directory.Build.Props and dependabot behaviour

What is this file?

The Directory.Build.Props is a file that allows the developer to share several configurations and variables between different dotnet projects in the same repository. Having this in mind makes it easier to enforce the projects following the same rules, such as the Language version or even the dotnet target framework. Please note the file Directory.Build.props needs to be in the root folder of the repository or solution to all children's projects to be affected.

Let's see an example of this file.

Directory.Build.props

<Project>
    <!-- Shared Settings -->
    <PropertyGroup>
        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
        <LangVersion>latest</LangVersion>
        <Nullable>enable</Nullable>
        <ImplicitUsings>enable</ImplicitUsings>
    </PropertyGroup>
    <!-- Versions -->
    <PropertyGroup>
        <AspNetCoreVersion>5.0.0</AspNetCoreVersion>
        <EntityFrameworkVersion>5.0.2</EntityFrameworkVersion>
    </PropertyGroup>
</Project>

Project.csproj

<Project Sdk="Microsoft.NET.Sdk.Web">

    <!-- Specific project properties that override the properties present on Directory.Build.props -->
    <PropertyGroup>
        <TargetFramework>net5.0</TargetFramework>
        <LangVersion>latest</LangVersion>
    </PropertyGroup>

    <!-- Nuget packages using the version from Directory.Build.props -->
    <ItemGroup>
        <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.AspNetCore.ApiAuthorization.IdentityServer" Version="$(AspNetCoreVersion)" />
        <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="$(EntityFrameworkVersion)" />
        <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="$(EntityFrameworkVersion)" />
    </ItemGroup>

    <!-- Other properties here -->

</Project>

Using it as a versioning system for NuGet dependencies

As we can see in the top two files, we are creating a variable named AspNetCoreVersion in the Directory.Build.props. By using that, we can ensure all the packages that use that variable as version number are going to use the same version. This way we can prevent multiple updates and mismatch versions by only controlling one variable.

Please note, at the time of writing this article, Rider doesn't integrate quite well with this versioning system. We should manually edit the Directory.Build.props file instead of using Rider tooling for upgrading packages. The same happens with the dotnet tool dotnet-outdated. As for Visual Studio, it was not possible to test the behaviour due to system restraints.

Integration with dependabot

The integration of this way of versioning the dependencies works quite well with dependabot. The bot is going to give us a list of affected packages that will affect the change of the version. For example, in the example above, the bot would create a new pull request for EntityFrameworkVersion stating that is going to upgrade from 1.0.0 to 1.0.1 affecting the packages Microsoft.EntityFrameworkCore.Sqlite and Microsoft.EntityFrameworkCore.Tools.

View the Pull Request for more information and the screenshot below for details:

References

• https://docs.github.com/en/code-security/dependabot
• https://docs.microsoft.com/en-us/visualstudio/msbuild/customize-your-build?view=vs-2022
• https://github.com/askpt/blazzing-pizza-workshop

Samples

askpt / blazzing-pizza-workshop

Blazor WebAssembly Workshop

blazzing-pizza-workshop

Blazor WebAssembly Workshop

This project is based on repository: https://github.com/dotnet-presentations/blazor-workshop/. It also has some extra features like dependabot and Code Scanning.

View on GitHub

Co-Author

Piotr JustynaFollow

/piotrjustyna