.NET 10 dotnet tool exec: Pin the Version and Feed in CI
A CI step that says dotnet tool exec Some.Tool looks isolated, but it is not fully reproducible. Without a version, the command can resolve the latest package from the configured feeds. Machine-level NuGet settings can also change which feeds participate. I use .NET 10 dotnet tool exec with an exact @version and an explicit feed policy when I want one-shot tooling without a global install or a…
The DOTNET 10 release introduced the dotnet tool exec command, which allows for invoking a package tool in a single execution without fully installing it. However, this command can still drift between runs due to lack of version pinning and feed configuration. To address this, using an exact version and an explicit feed policy in a local NuGet.Config file ensures stable invocation.
The dotnet tool exec command, when coupled with a checked-in NuGet.Config file specifying a local package source, can provide reproducible CI steps. This approach allows for one-time tooling without global installations or committed tool manifests, while maintaining the original tool exit code for CI gating. While this method is helpful for short-lived CI checks, it does not replace the need for trusted package sources and update processes in production pipelines.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
