From 94012c51ab49ef0026e3e331ab48751c6ed7c880 Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Sun, 16 Aug 2026 13:35:44 +0100
Subject: [PATCH] nuget: add NuGet.config pointing at isn.pschneider.fr

The yavsc solution depends on HigginsSoft.IdentityServer8.* 8.1.0-alpha.*,
which is only published on the internal feed https://isn.pschneider.fr.
Public nuget.org has 8.0.4 as the nearest version, so every project that
uses IdentityServer8 (Yavsc.Org, Yavsc.Api, Yavsc.Blogs, Yavsc.Server,
cli, Yavsc.Org.Tests, Yavsc.Blogs.Tests) fails with NU1102 on restore.

Both feeds are reachable anonymously, so listing isn first and
nuget.org second in a project-level config restores everything without
credentials. The CI runner on forgejo now sees the same sources as a
local clone.
---
 NuGet.config | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 NuGet.config

diff --git a/NuGet.config b/NuGet.config
new file mode 100644
index 00000000..c601d09b
--- /dev/null
+++ b/NuGet.config
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Project-level NuGet configuration.
+
+  The yavsc solution depends on HigginsSoft.IdentityServer8.* 8.1.0-alpha.*,
+  published only on the internal feed https://isn.pschneider.fr. The public
+  nuget.org feed has 8.0.4 as the nearest version, which causes NU1102 on
+  restore for every project that depends on it (Yavsc.Org, Yavsc.Api,
+  Yavsc.Blogs, Yavsc.Server, cli, tests).
+
+  Listing 'isn' before 'nuget.org' here ensures that restore finds the
+  alpha packages first, then falls back to nuget.org for everything else.
+  Both feeds are reachable anonymously; no credentials are stored here.
+
+  See AGENTS.md for the rationale.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="isn" value="https://isn.pschneider.fr/api/v3/index.json" />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+</configuration>