.NET pipelines — private NuGet feed

1. Prepare the release

1. Choose an authenticated NuGet service approved by Yanbor LLC and the customer, such as Azure Artifacts, GitHub Packages, Artifactory, Nexus, or a secured file-share feed.
2. Create a production feed whose readers are limited to licensed customer identities. Keep evaluation and production packages in separate feeds or views.
3. Obtain the two authorized 1.0.0 packages and the production checksum manifest from the controlled release location.
4. Compare each package hash with ARTIFACTS.sha256. Stop if a file is missing, renamed unexpectedly, or has a different hash.
5. Inspect package metadata with the customer or an isolated validation project. Confirm the package ID, immutable version, Yanbor LLC ownership, dependencies, embedded JARs, license link, documentation link, and supported runtime baseline.
6. Create a release record containing customer, package IDs, versions, SHA-256 values, feed URL, approver, publication date, license/order reference, and rollback contact.

2. Publish both packages

1. Open the feed provider's Connect to feed page and use its current NuGet v3 source URL.
2. Create a short-lived publishing token or service identity with package-write permission only. Do not put the token in a script, repository, package, log, or customer document.
3. Publish the runtime package first because the integration package depends on it. With the provider-specific source and API key syntax, run dotnet nuget push Yanbor.DataAI.Etl.Spark.Runtime.1.0.0.nupkg --source <feed-url-or-name> --api-key <provider-required-value>.
4. Publish Yanbor.DataAI.Etl.Spark.1.0.0.nupkg using the same controlled source.
5. Open the feed UI and confirm that both exact IDs and version 1.0.0 are visible. Do not overwrite or reuse an already published version; issue a new version for changed bytes.
6. Remove or expire the publishing credential after release if it is not needed for automation.

3. Grant and test customer access

1. Grant the customer's approved group read/download permission. Avoid individual permanent tokens when group or workload identities are available.
2. Give the customer the feed URL, approved package/version, license certificate or order reference, checksum values, credential setup method, production installation guide, and support contact through an authorized channel.
3. In a clean test environment, add the feed with dotnet nuget add source <feed-url> --name DataAI. Supply credentials using the provider's credential manager or approved secret store; do not place a clear-text password in NuGet.Config.
4. Restore with dotnet add package Yanbor.DataAI.Etl.Spark --version 1.0.0 --source DataAI.
5. Verify that the runtime package is restored transitively, its DataAI JARs are copied as documented, and the clean project passes the packaged smoke test.
6. Remove the test identity and record the test result. Send access instructions only to the licensed customer contacts.

4. Operate future releases

• Use a new semantic version for every changed package and keep previous authorized versions available during the agreed upgrade window.
• Revoke customer access when the commercial authorization ends; retain audit records according to Yanbor policy.
• Never use dependency-confusion-prone source ordering. Pin the DataAI source and package version in customer build policy.
• Repeat hash, clean-restore, runtime, and license validation for every release.

Official references

• Microsoft: hosting private NuGet feeds
• Microsoft: dotnet nuget add source
• Microsoft: publish NuGet packages to Azure Artifacts

Back to DataAI ETL Markets