When creating a nuget package from a .NET Core project, I noticed the following warning in the NuGet Package Explorer:
Source Link (which I’ll talk about in another post) is Valid but the build is marked as ‘Non deterministic’.
What does this mean?
By default builds are non-deterministic, meaning there is no guarantee that building the same code twice(on the same or different machines) will produce exactly the same binary output. Deterministic builds are important as they enable verification that the resulting binary was built from the specified source and provides traceability.
How to fix it?
To enable deterministic builds a property should be set to through: ContinuousIntegrationBuild
.
Important: This property should not be enabled during local dev as the debugger won't be able to find the local source files.
Therefore, you should use your CI system's variable to set them conditionally.
For Azure Pipelines,the variable is TF_BUILD can be used:
<PropertyGroup Condition="'$(TF_BUILD)' == 'true'"> <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild> </PropertyGroup>
For GitHub Actions, the variable is GITHUB_ACTIONS
, so the result would be:
<PropertyGroup Condition="'$(GITHUB_ACTIONS)' == 'true'"> <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild> </PropertyGroup>