Pin the dependency graph with lock files

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
             10.0.x
 
       - name: Restore
-        run: dotnet restore
+        run: dotnet restore --locked-mode
 
       - name: Build
         run: dotnet build --configuration Release --no-restore /p:ContinuousIntegrationBuild=true
@@ -58,7 +58,7 @@ jobs:
             10.0.x
 
       - name: Restore
-        run: dotnet restore
+        run: dotnet restore --locked-mode
 
       - name: Build
         run: dotnet build --configuration Release --no-restore

.github/workflows/publish.yml

@@ -98,7 +98,7 @@ jobs:
           fi
 
       - name: Restore
-        run: dotnet restore
+        run: dotnet restore --locked-mode
 
       - name: Build
         run: >

Directory.Build.props

@@ -1,6 +1,13 @@
 <Project>
 
   <PropertyGroup>
+    <!--
+      Writes the resolved dependency graph to a packages.lock.json beside each project. CI restores
+      in locked mode, so a graph that drifts from the lock fails the build rather than quietly
+      resolving to something else. Changing a version in Directory.Packages.props now also means
+      regenerating the locks; a restore with the force-evaluate switch does that.
+    -->
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
   </PropertyGroup>

samples/Healthie.AppHost/Healthie.AppHost.csproj

@@ -14,6 +14,14 @@
       runs on CI and on arm64. Acknowledged deliberately rather than reverting to the Windows one.
     -->
     <NoWarn>$(NoWarn);ASPIRECOSMOSDB001</NoWarn>
+    <!--
+      The one project that opts out of the repository's lock files. The Aspire SDK adds a
+      runtime-specific Aspire.Dashboard.Sdk package, so the resolved graph differs per operating
+      system: a lock generated on Windows names win-x64 and a Linux restore then asks for
+      linux-x64 and fails as inconsistent. A lock file cannot describe a graph that depends on
+      where the restore runs, and this is a sample orchestrator rather than anything shipped.
+    -->
+    <RestorePackagesWithLockFile>false</RestorePackagesWithLockFile>
   </PropertyGroup>
 
   <ItemGroup>

samples/Healthie.Sample.BlazorUI/Dockerfile

@@ -7,8 +7,8 @@ WORKDIR /src
 # Restore against the manifests alone first, so this layer is only rebuilt when dependencies change.
 COPY Directory.Build.props Directory.Packages.props ./
 COPY src/ src/
-COPY samples/Healthie.Sample.BlazorUI/Healthie.Sample.BlazorUI.csproj samples/Healthie.Sample.BlazorUI/
-RUN dotnet restore samples/Healthie.Sample.BlazorUI/Healthie.Sample.BlazorUI.csproj
+COPY samples/Healthie.Sample.BlazorUI/Healthie.Sample.BlazorUI.csproj samples/Healthie.Sample.BlazorUI/packages.lock.json samples/Healthie.Sample.BlazorUI/
+RUN dotnet restore samples/Healthie.Sample.BlazorUI/Healthie.Sample.BlazorUI.csproj --locked-mode
 
 COPY samples/ samples/
 RUN dotnet publish samples/Healthie.Sample.BlazorUI/Healthie.Sample.BlazorUI.csproj \