Directory.Build.props

<Project>
  <PropertyGroup>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <AnalysisLevel>latest</AnalysisLevel>
    <!-- Supply-chain hardening: commit a packages.lock.json per project and make CI restores
         fail (rather than silently resolve a newer package version) if a dependency version
         would change without a corresponding lock-file update. Without this, a floating
         version range (e.g. "1.*") or even an exact version pin can still resolve to a
         different, newer build on NuGet.org between two otherwise-identical container builds,
         since NuGet doesn't re-verify a previously-resolved version by default. -->
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
    <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode>
    <!-- GitHub.Copilot.SDK downloads a native Copilot CLI binary via MSBuild targets and registers
         it as a ContentWithTargetPath item. Every project in the dependency graph that imports the
         SDK targets (AgentRuntime, API) registers its own copy, causing NETSDK1152 (duplicate
         publish output files) when dotnet publish collects them all.

         That collision only happens during *publish*. So we scope the skip to publish only
         (_IsPublishing is a global property the .NET SDK sets to 'true' for `dotnet publish`, and is
         empty for a plain `dotnet build` / `dotnet run`):

           - Publish (Docker image): skip the per-project download/registration. The Dockerfile
             pre-downloads the linux-x64 binary once and manually places it in the publish output.
             The EF bundle's temp project lives at /tmp/ and does NOT inherit this file, so it
             downloads exactly one copy on its own (no /src/ duplicates to collide with).
           - Build / run (local dev, e.g. `npm run dev` in WSL): do NOT skip, so the SDK downloads
             and copies the binary for the build host RID (e.g. linux-arm64) into
             bin/<config>/net10.0/runtimes/<rid>/native/copilot. Without this, the SDK's runtime
             auto-resolution fails at runtime with "Copilot runtime not found". -->
    <CopilotSkipCliDownload Condition="'$(_IsPublishing)' == 'true'">true</CopilotSkipCliDownload>
    <!-- Belt-and-suspenders: if any project somehow still ends up with duplicates, suppress the error
         rather than failing the build. -->
    <ErrorOnDuplicatePublishOutputFiles>false</ErrorOnDuplicatePublishOutputFiles>
    <!-- The GitHub.Copilot.SDK download target (above) defaults to https://registry.npmjs.org, which
         Microsoft-managed devices block outbound access to. Route it through the corporate npm proxy
         instead (verified to mirror the exact @github/copilot-<platform> tarballs this target needs)
         so local `dotnet build`/`dotnet run` doesn't trip Defender/network-policy blocks. -->
    <CopilotNpmRegistryUrl Condition="'$(CopilotNpmRegistryUrl)' == ''">https://packagefeedproxy.microsoft.io/npm/</CopilotNpmRegistryUrl>
  </PropertyGroup>
</Project>