Command-line tool

Meziantou.Framework.NuGetPackageValidation.Tool runs the rules of the library on the packages you give it.

The command reference lists every option of the tool.

Install the tool

Install or update it as a global tool:

dotnet tool update Meziantou.Framework.NuGetPackageValidation.Tool --global

Validate packages

Pass one or more package paths:

meziantou.validate-nuget-package artifacts/MyLibrary.1.0.0.nupkg artifacts/MyLibrary.Tool.1.0.0.nupkg

• The packages are validated in parallel, up to the number of processors. --max-parallelism 1 validates one package at a time.
• A path given twice is validated once.
• The tool does not expand wildcards: let your shell do it, for instance artifacts/*.nupkg.
• A .snupkg file next to a package is used to check its symbols.

Read the output

The result is written to the standard output as JSON. The packages are keyed by their full path, in the order of the arguments:

{
  "IsValid": false,
  "Packages": {
    "/home/user/src/artifacts/Debug.1.0.0.nupkg": {
      "Errors": [
        {
          "ErrorCode": 81,
          "Message": "Assembly is not optimized",
          "HelpText": "Build the package using the Release configuration: 'dotnet pack --configuration Release'. ...",
          "FileName": "lib/net6.0/samplelib.dll"
        }
      ],
      "IsValid": false
    }
  }
}

• The exit code is 0 when every package is valid, and 1 otherwise. It is also 1 when the arguments are invalid, such as an unknown rule.
• --only-report-errors leaves the valid packages out of the output, which keeps the log of a large build short.
• HelpText and FileName are null when the error has none.

Choose the rules

Without options, the tool applies the default rules. --rules replaces them, and --excluded-rules removes rules. Both take the rule names of NuGetPackageValidationRules, separated by , or ;, and default stands for the default rules:

meziantou.validate-nuget-package MyLibrary.1.0.0.nupkg --rules default,PackageIdAvailableOnNuGetOrg

meziantou.validate-nuget-package MyLibrary.1.0.0.nupkg --excluded-rules ReadmeMustBeSet,TagsMustBeSet

The names are case-sensitive, as written in --help.

Ignore some errors

--excluded-rule-ids ignores error codes without removing their rule, like ExcludedRuleIds in code:

meziantou.validate-nuget-package MyLibrary.1.0.0.nupkg --excluded-rule-ids 52,119

Excluding 119 or 120 also skips the download of the source files of the symbols. See Ignore some errors.

Authenticate the requests

The Symbols rule downloads the source files that Source Link points to. For a private GitHub repository, these downloads need a token:

meziantou.validate-nuget-package MyLibrary.1.0.0.nupkg --github-token "$GITHUB_TOKEN"

The token is only sent to raw.githubusercontent.com and its subdomains, as a bearer token. Requests to other hosts are sent without it.

Options

meziantou.validate-nuget-package --help shows the same list with the names of all the rules.