From dfa6ba01d4e6798f95b31c8cf4faf922dd6420dc Mon Sep 17 00:00:00 2001
From: Mikayla Hutchinson <m.j.hutchinson@gmail.com>
Date: Tue, 3 Sep 2024 18:08:03 -0400
Subject: [PATCH] Switch to CPM and update build/test dependencies

---
 .github/workflows/build.yml                   | 16 ++++-------
 .github/workflows/publish.yml                 |  2 +-
 Directory.Build.props                         |  6 ++--
 Directory.Packages.props                      | 28 +++++++++++++++++++
 .../MSBuildTestContext.cs                     |  4 ++-
 .../Mono.TextTemplating.Build.Tests.csproj    | 24 ++++++----------
 .../Mono.TextTemplating.Build.csproj          |  8 +++---
 .../Mono.TextTemplating.Roslyn.csproj         |  2 +-
 .../Mono.TextTemplating.Tests.csproj          |  6 ++--
 .../Mono.TextTemplating.csproj                |  5 ++--
 TextTransform/TextTransform.csproj            |  2 +-
 11 files changed, 62 insertions(+), 41 deletions(-)
 create mode 100644 Directory.Packages.props

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 76c8cf97..3a10cd53 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,23 +15,19 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         submodules: recursive
         fetch-depth: 0 # GitVersioning needs deep clone
 
     - name: Set up dotnet
-      uses: actions/setup-dotnet@v2
+      uses: actions/setup-dotnet@v4
       with:
         dotnet-version: |
           6.0.x
-          7.0.x
+          8.0.x
 
-    - name: Find MSBuild
-      if: startsWith(matrix.os, 'windows')
-      uses: microsoft/setup-msbuild@v1.1.0
-
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: ${{ env.NUGET_PACKAGES }}
         key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
@@ -51,12 +47,12 @@ jobs:
 
     - name: Upload Test Results
       if: failure()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: "TestResults-${{ matrix.os }}-${{ matrix.config }}"
         path: "TestResults-${{ matrix.os }}-${{ matrix.config }}"
 
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: matrix.config == 'Release' && startsWith(matrix.os, 'windows')
       with:
         name: packages
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index dda45251..393e9657 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,7 +11,7 @@ jobs:
   publish:
     runs-on: windows-latest
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: packages
           name: packages
diff --git a/Directory.Build.props b/Directory.Build.props
index 33b96ee4..cd3a16ca 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -7,6 +7,8 @@
     <PackageRequireLicenseAcceptance>false</PackageRequireLicenseAcceptance>
     <PackageOutputPath>$(MSBuildThisFileDirectory)packages\$(Configuration)</PackageOutputPath>
     <EnablePackageValidation>true</EnablePackageValidation>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
 
   <PropertyGroup>
@@ -16,8 +18,8 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Nerdbank.GitVersioning" Version="3.6.133" PrivateAssets="all" />
-    <PackageReference Include="DotNet.ReproducibleBuilds" Version="1.1.1" PrivateAssets="All"/>
+    <PackageReference Include="Nerdbank.GitVersioning" PrivateAssets="all" />
+    <PackageReference Include="DotNet.ReproducibleBuilds" PrivateAssets="All"/>
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Directory.Packages.props b/Directory.Packages.props
new file mode 100644
index 00000000..cedfacc3
--- /dev/null
+++ b/Directory.Packages.props
@@ -0,0 +1,28 @@
+<Project>
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.7.0" />
+    <PackageVersion Include="Microsoft.Build.Locator" Version="1.7.8" />
+    <PackageVersion Include="Microsoft.Build" Version="17.3.2" />
+    <PackageVersion Include="Microsoft.Build.Framework" Version="17.3.2" />
+    <PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.3.2" />
+    <PackageVersion Include="System.Reflection.MetadataLoadContext" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.0" />
+    <PackageVersion Include="xunit" Version="2.9.0" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.133" />
+    <PackageVersion Include="DotNet.ReproducibleBuilds" Version="1.1.1" />
+    <PackageVersion Include="MessagePackAnalyzer" Version="2.5.192" />
+    <PackageVersion Include="MessagePack" Version="2.5.192" />
+    <!-- limit to 6.0 so that the MSBuild task can load on .NET 6.0 -->
+    <PackageVersion Include="System.CodeDom" Version="6.0.0" />
+    <!--
+    Microsoft.NET.Test.Sdk brings in a version of NuGet.Frameworks that's older than the one used by MSBuild
+    and loads first, thereby breaking loading of MSBuild assemblies. Force-upgrade it.
+    -->
+    <PackageVersion Include="NuGet.Frameworks" Version="6.12.1" />
+    <!-- upgrade vulnerable transitive deps  -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <PackageVersion Include="System.Drawing.Common" Version="8.0.8" />
+
+  </ItemGroup>
+</Project>
\ No newline at end of file
diff --git a/Mono.TextTemplating.Build.Tests/MSBuildTestContext.cs b/Mono.TextTemplating.Build.Tests/MSBuildTestContext.cs
index a804144e..cb1aa41d 100644
--- a/Mono.TextTemplating.Build.Tests/MSBuildTestContext.cs
+++ b/Mono.TextTemplating.Build.Tests/MSBuildTestContext.cs
@@ -29,8 +29,10 @@ public MSBuildTestContext ([CallerMemberName] string testName = null, bool creat
 
 			var globalProps = new Dictionary<string, string> {
 				{ "ImportDirectoryBuildProps", "false" },
+				{ "ImportDirectoryBuildTargets", "false" },
 				{ "TemplatingTargetsPath", buildTargetsProjectDir },
-				{ "TextTransformTaskAssembly", buildTasksPath }
+				{ "TextTransformTaskAssembly", buildTasksPath },
+				{ "ManagePackageVersionsCentrally", "false" }
 			};
 
 			Engine = new ProjectCollection (globalProps);
diff --git a/Mono.TextTemplating.Build.Tests/Mono.TextTemplating.Build.Tests.csproj b/Mono.TextTemplating.Build.Tests/Mono.TextTemplating.Build.Tests.csproj
index 9f81497c..011253eb 100644
--- a/Mono.TextTemplating.Build.Tests/Mono.TextTemplating.Build.Tests.csproj
+++ b/Mono.TextTemplating.Build.Tests/Mono.TextTemplating.Build.Tests.csproj
@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
-    <TargetFrameworks>net6.0;net7.0</TargetFrameworks>
+    <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
     <TargetFrameworks Condition="$([MSBuild]::IsOSPlatform('Windows'))">net48;$(TargetFrameworks)</TargetFrameworks>
     <IsPackable>false</IsPackable>
     <DefaultItemExcludes>$(DefaultItemExcludes);TestCases\**</DefaultItemExcludes>
@@ -11,23 +11,17 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Build.Locator" Version="1.6.10" />
-    <PackageReference Include="Microsoft.Build" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="Microsoft.Build.Framework" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.3.2" ExcludeAssets="runtime" />
-    <PackageReference Include="System.Reflection.MetadataLoadContext" Version="7.0.0" />
-    <!--
-    Microsoft.NET.Test.Sdk brings in a version of NuGet.Frameworks that's older than the one used by MSBuild
-    and loads first, thereby breaking loading of MSBuild assemblies. Force-upgrade it.
-    -->
-    <PackageReference Include="NuGet.Frameworks" Version="6.9.1" />
-    <PackageReference Include="System.Text.Json" Version="7.0.3" />
+    <PackageReference Include="Microsoft.Build.Locator" />
+    <PackageReference Include="Microsoft.Build" ExcludeAssets="runtime" />
+    <PackageReference Include="Microsoft.Build.Framework" ExcludeAssets="runtime" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" ExcludeAssets="runtime" />
+    <PackageReference Include="System.Reflection.MetadataLoadContext" />
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
-    <PackageReference Include="xunit" Version="2.5.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Mono.TextTemplating.Build/Mono.TextTemplating.Build.csproj b/Mono.TextTemplating.Build/Mono.TextTemplating.Build.csproj
index 81b90d27..41dccd3c 100644
--- a/Mono.TextTemplating.Build/Mono.TextTemplating.Build.csproj
+++ b/Mono.TextTemplating.Build/Mono.TextTemplating.Build.csproj
@@ -33,11 +33,11 @@
   <ItemGroup>
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <ProjectReference Include="..\Mono.TextTemplating\Mono.TextTemplating.csproj" PrivateAssets="all" />
-    <PackageReference Include="MessagePackAnalyzer" Version="2.5.129" PrivateAssets="all" />
-    <PackageReference Include="MessagePack" Version="2.5.129" PrivateAssets="all" />
+    <PackageReference Include="MessagePackAnalyzer" PrivateAssets="all" />
+    <PackageReference Include="MessagePack" PrivateAssets="all" />
     <!-- intentionally downlevel these so they can be loaded in older VS versions -->
-    <PackageReference Include="Microsoft.Build.Framework" Version="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
-    <PackageReference Include="Microsoft.Build.Utilities.Core" Version="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
+    <PackageReference Include="Microsoft.Build.Framework" VersionOverride="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
+    <PackageReference Include="Microsoft.Build.Utilities.Core" VersionOverride="17.0.0" PrivateAssets="all" IncludeAssets="compile" />
   </ItemGroup>
 
   <!-- https://github.com/dotnet/msbuild/issues/4751-->
diff --git a/Mono.TextTemplating.Roslyn/Mono.TextTemplating.Roslyn.csproj b/Mono.TextTemplating.Roslyn/Mono.TextTemplating.Roslyn.csproj
index 5b47239e..2c4e41a3 100644
--- a/Mono.TextTemplating.Roslyn/Mono.TextTemplating.Roslyn.csproj
+++ b/Mono.TextTemplating.Roslyn/Mono.TextTemplating.Roslyn.csproj
@@ -10,7 +10,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.7.0" />
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" />
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <ProjectReference Include="..\Mono.TextTemplating\Mono.TextTemplating.csproj" />
   </ItemGroup>
diff --git a/Mono.TextTemplating.Tests/Mono.TextTemplating.Tests.csproj b/Mono.TextTemplating.Tests/Mono.TextTemplating.Tests.csproj
index 00bdac8b..3331d6d7 100644
--- a/Mono.TextTemplating.Tests/Mono.TextTemplating.Tests.csproj
+++ b/Mono.TextTemplating.Tests/Mono.TextTemplating.Tests.csproj
@@ -13,9 +13,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
-    <PackageReference Include="xunit" Version="2.5.1" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" />
+    <PackageReference Include="xunit" />
+    <PackageReference Include="xunit.runner.visualstudio" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Mono.TextTemplating/Mono.TextTemplating.csproj b/Mono.TextTemplating/Mono.TextTemplating.csproj
index b1188a86..6b74e8a2 100644
--- a/Mono.TextTemplating/Mono.TextTemplating.csproj
+++ b/Mono.TextTemplating/Mono.TextTemplating.csproj
@@ -2,7 +2,7 @@
   <PropertyGroup>
     <TargetFrameworks>netstandard2.0;net6.0;net472</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <NoWarn>1591;1573</NoWarn>
+    <NoWarn>$(NoWarn);1591;1573</NoWarn>
     <TFxId>$([MSBuild]::GetTargetFrameworkIdentifier('$(TargetFramework)'))</TFxId>
     <DefineConstants Condition="'$(TFxId)'=='.NETFramework'">$(DefineConstants);FEATURE_APPDOMAINS</DefineConstants>
     <DefineConstants Condition="'$(TFxId)'=='.NETCoreApp'">$(DefineConstants);FEATURE_ASSEMBLY_LOAD_CONTEXT</DefineConstants>
@@ -21,8 +21,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <!-- limit to 6.0 so that the MSBuild task can load on .NET 6.0 -->
-    <PackageReference Include="System.CodeDom" Version="6.0.0" Condition="'$(TargetFramework)'!='net472'" />
+    <PackageReference Include="System.CodeDom" Condition="'$(TargetFramework)'!='net472'" />
     <None Include="readme.md" Pack="true" PackagePath="\" />
     <None Include="package\Mono.TextTemplating.targets" Pack="true" PackagePath="buildTransitive\Mono.TextTemplating.targets" />
   </ItemGroup>
diff --git a/TextTransform/TextTransform.csproj b/TextTransform/TextTransform.csproj
index dde71b24..9696bcab 100644
--- a/TextTransform/TextTransform.csproj
+++ b/TextTransform/TextTransform.csproj
@@ -3,7 +3,7 @@
     <TargetFramework>net472</TargetFramework>
     <OutputType>Exe</OutputType>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <NoWarn>1591;1573</NoWarn>
+    <NoWarn>$(NoWarn);1591;1573</NoWarn>
     <PackageId>Mono.TextTemplating.Console</PackageId>
     <IsTool>True</IsTool>
     <Description>Command-line T4 text transform tool.</Description>