Support for additional Nuget feeds

[priorax]

Story

As a engineer who utilises private feeds, I want to be able to scan internal packages, so that I am also conscious of drift from internal standards.

Current research done

At the moment it looks like the URL for api.nuget is hard coded, is it possible to have this project either utilise the package sources section of nuget.config file or at least an environment variable so that multiple feeds could be targetted?

I did a very quick look (and hope to look further tonight) and I think the main concerns I would have if you'd like me to contribute this would be:

• Where in a repository is a nuget.config file supported (eg, top level only, or is the first file found utilised)?
• Is any validation required for the use of <clear /> or is it just a case of "anything listed takes priority"?
• Is any authentication required that should be considered?

[SteveDesmond-ca]

Thanks for bringing this up -- given the scope and complexity of your concerns (unless the NuGet package can handle them on its own) I'd hesitate to push too hard for this, but feel free to experiment and come back with what you think it could look like and we can discuss from there!

[priorax]

Would a minimum viable change just be considered a sane MVP?

Rather than supporting the whole Nuget config file, this allows for the similar behaviour as dotnet restore which takes a -s|--source that points at a specific feed.

This MVP doesn't currently account for "Multiple sources can be provided by specifying this option multiple times.", but that's partially due to my lack of familiarity with this library to quickly implement it.

diff --git a/src/LibYear/Command.cs b/src/LibYear/Command.cs
index 3a12b83..1a6a84d 100644
--- a/src/LibYear/Command.cs
+++ b/src/LibYear/Command.cs
@@ -25,5 +25,5 @@ public class Command : AsyncCommand<Settings>
    }

    private Func<StatusContext, Task<int>> Run(Settings settings)
-       => async _ => await Factory.App(_console).Run(settings);
+       => async _ => await Factory.App(_console, settings).Run(settings);
 }
\ No newline at end of file
diff --git a/src/LibYear/Factory.cs b/src/LibYear/Factory.cs
index 21fad6e..a59b2d1 100644
--- a/src/LibYear/Factory.cs
+++ b/src/LibYear/Factory.cs
@@ -8,17 +8,17 @@ namespace LibYear;

 public static class Factory
 {
-   public static App App(IAnsiConsole console)
+   public static App App(IAnsiConsole console, Settings settings)
    {
-       var packageVersionChecker = new PackageVersionChecker(PackageMetadataResource());
+       var packageVersionChecker = new PackageVersionChecker(PackageMetadataResource(settings));
        var fileSystem = new FileSystem();
        var projectRetriever = new ProjectFileManager(fileSystem);
        return new App(packageVersionChecker, projectRetriever, console);
    }

-   private static PackageMetadataResource PackageMetadataResource()
+   private static PackageMetadataResource PackageMetadataResource(Settings settings)
    {
-       var source = new PackageSource("https://api.nuget.org/v3/index.json");
+       var source = new PackageSource(settings.Source);
        var provider = Repository.Provider.GetCoreV3();
        var repo = new SourceRepository(source, provider);
        return repo.GetResource<PackageMetadataResource>();
diff --git a/src/LibYear/Settings.cs b/src/LibYear/Settings.cs
index 3658a3d..3fe67ec 100644
--- a/src/LibYear/Settings.cs
+++ b/src/LibYear/Settings.cs
@@ -32,4 +32,8 @@ public class Settings : CommandSettings
    [CommandOption("-r|--recursive")]
    [Description("search recursively for all compatible files, even if one is found in a directory passed as an argument")]
    public bool Recursive { get; set; }
+
+   [CommandOption("-s|--source")]
+   [Description("search recursively for all compatible files, even if one is found in a directory passed as an argument")]
+   public string Source { get; set; } = "https://api.nuget.org/v3/index.json";
 }
\ No newline at end of file

[SteveDesmond-ca]

I like the command line option route!

It seems like SourceRepositoryProvider would be a good lead to check for being able to have multiple repos.

Maybe see what a new Factory method that creates one of those with the sources passed in? See this discussion, I think it's just as simple as having the option return an array.