NuGetCommand@2 in Azure Devops Pipeline is unable to get Azure Artifacts feed

Question

I am trying to retrieve a custom NuGet package that I have pushed into a Azure DevOps Artifacts (project)feed.

But the NuGetCommand@2 fails with error:

NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json.

My build yaml file has got following steps:

steps:
- task: NuGetToolInstaller@1
# Required for custom access to Artifacts
- task: PowerShell@2
  displayName: "Install Artifacts Provider"
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "Install Artifacts Provider"
      Invoke-Expression "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx"
- task: NuGetAuthenticate@1
- task: NuGetCommand@2
  inputs:
    command: 'restore'
    FeedsToUse: 'select'
    restoreSolution: '$(solution)'
    vstsFeed: [FEED_NAME]

In my nuget.config file I have the following configuration:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="[FEED_NAME]" value="https://pkgs.dev.azure.com/[COMPANY_NAME]/[PROJECT_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <[FEED_NAME]%>
      <add key="Username" value="[USER_NAME]" />
      <add key="Password" value="[PAC]" />
    </[FEED_NAME]>
  </packageSourceCredentials>
</configuration>

Under the artifact permissions settings I have given the project build service the collaborator role.

With this setup I get the following messages in the log:

The NuGetAuthenticate step gives this output and is successfull:

Setting up the credential provider to use the identity '[PROJECT_NAME] Build Service ([COMPANY_NAME])' for feeds in your organization/collection starting with:
  https://pkgs.dev.azure.com/[COMPANY_NAME]/
  https://[COMPANY_NAME].pkgs.visualstudio.com/

The NuGetCommand step fails with following log:

Using D:\a\_tasks\NuGetCommand_333b11bd-d341-40d9-afcf-b32d5ce6f23b\2.238.1\CredentialProviderV2\plugins\netfx\CredentialProvider.Microsoft\CredentialProvider.Microsoft.exe as a credential provider plugin.

Feeds used:
    C:\Program Files\dotnet\library-packs
    https://api.nuget.org/v3/index.json
    https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json


...


[CredentialProvider]Handling 'Request' 'GetAuthenticationCredentials'. Time elapsed in ms: 4 - Payload: {"Uri":"https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json","IsRetry":false,"IsNonInteractive":true,"CanShowDialog":true}
[CredentialProvider]Creating a progress reporter with interval: 00:00:02
[CredentialProvider]Handling auth request, Uri: https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json, IsRetry: False, IsNonInteractive: True, CanShowDialog: True
[CredentialProvider]URI: https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json
[CredentialProvider]VstsBuildTaskServiceEndpointCredentialProvider - This credential provider must be run under the Team Build tasks for NuGet with external endpoint credentials. Appropriate environment variable needs to be set.

...

[CredentialProvider]Skipping NuGetCredentialProvider.CredentialProviders.VstsBuildTaskServiceEndpoint.VstsBuildTaskServiceEndpointCredentialProvider, cannot provide credentials for https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json

...

NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json.

The strange part is that all source URL have removed the project name. Instead of

https://pkgs.dev.azure.com/[COMPANY_NAME]/[PROJECT_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json

he uses the url without the project name:

https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json

Answer 1

Possible Cause

According to Setting up the credential provider to use the identity '[PROJECT_NAME] Build Service ([COMPANY_NAME])' for feeds in your organization/collection starting with:... your pipeline is using the project-level build service account. You can check whether Limit job authorization scope to current project for non-release pipelines option is turned on in your target project. Go to Project Settings -> Settings (Under Pipeline).

According to Unable to load the service index for source https://pkgs.dev.azure.com/[COMPANY_NAME]/_packaging/[FEED_NAME]/nuget/v3/index.json., you are trying to restore from an organization-level feed.

When Limit job authorization scope to current project for non-release pipelines has been enabled, the scope of access for all non-release pipelines will be reduced to the current project. It's expected that unable to access organization-level feed.

Possible solution

1. If you want to access organization-level feed, turn off Limit job authorization scope to current project for non-release pipelines in your affected project.

2. If you want to use the feed configured in your nuget.config file, set feedsToUse to config and specify the path to your nuget.config file in nugetConfigPath. (If you just want to consume the packages from one Azure artifact feed, there is no need to use nuget.config file and config Artifacts Provider. Setting FeedsToUse in NuGetCommand@2 to select and select your target feed is enough.)

- task: NuGetCommand@2
  inputs:
    command: 'restore'
    restoreSolution: '**/*.sln'
    feedsToUse: 'config'
    nugetConfigPath: '{Path to nuget.config}'

---

Update: Using DotNetCoreCLI@2 task to restore

1. Configure packageSourceCredentials as shown below.

  <packageSourceCredentials>
    <feed-name>
      <add key="Username" value="yourName" />
      <add key="Password" value="%PASSWORD%" />
    </feed-name>
  </packageSourceCredentials>

2. Create a PAT in your org with at least "Packaging Read & write" scope. Add this PAT as a secret variable in your pipeline.

3. Run the following yaml to restore.

steps:
- task: DotNetCoreCLI@2
  env:
    PASSWORD: $(PAT)
  inputs:
    command: 'restore'
    projects: '**/*.sln'
    feedsToUse: 'config'
    nugetConfigPath: 'AppLogger/nuget.config'