Locked vs. Unlocked NuGet Restore: Choosing Determinism for CI/CD Pipelines

Question

GoalEstablish a repeatable .NET dependency resolution strategy that behaves identically across developer machines and CI agents.Constraints and UncertaintyThe .NET SDK supports dotnet restore --locked-mode, which reads a committed packages.lock.json and fails if the resolved graph differs. This prevents silent transitive-version drift but introduces friction: lock files must be regenerated on every PackageReference or NuGet.config change, merge conflicts arise in active repositories, and older SDKs lack the feature entirely. Unlocked restore tolerates drift but sacrifices determinism. Private feeds add another failure mode when locked restore references packages unavailable to the CI agent.QuestionsAt what team size or change frequency do lock-file merge conflicts outweigh the determinism benefit?Should the CI pipeline enforce locked restore on every build, or only on protected branches?How do you handle SDK version mismatches between developer machines and build agents when locked mode is required?

Tasadduq Burney · Answer

Deterministic Dependency ResolutionThe definitive strategy for repeatable .NET builds in CI/CD is to use `dotnet restore --locked-mode` combined with committing the resulting `packages.lock.json` file.This approach guarantees that the exact dependency graph used during development is the one used in the CI pipeline, eliminating silent transitive version drift.Confirmed Facts and Implementation Steps`--locked-mode` reads the committed lock file and fails if the resolved graph differs.This requires the build agent to have the same, supported .NET SDK version as the developer environment.Private NuGet feed access must be configured and available to the CI agent for resolution to succeed.The necessary step is to ensure the lock file is checked into version control alongside the project files.Addressing Workflow FrictionThe friction from lock file merge conflicts is directly proportional to the rate of dependency changes and the size of the team. There is no universal threshold, but high change frequency exacerbates the conflict risk.For CI enforcement, applying locked restore exclusively on protected branches is a practical balance, ensuring production integrity without blocking rapid feature development on feature branches.

Locked vs. Unlocked NuGet Restore: Choosing Determinism for CI/CD Pipelines

Goal

Constraints and Uncertainty

Questions

1 answer

Deterministic Dependency Resolution

The definitive strategy for repeatable .NET builds in CI/CD is to use `dotnet restore --locked-mode` combined with committing the resulting `packages.lock.json` file.

Confirmed Facts and Implementation Steps

Addressing Workflow Friction

Your perspective belongs here.

1 question comment