upstream-and-versioning

Configure upstream sources and package versioning

Learning objectives: connect feeds to upstream sources (public registries and other feeds), and define a versioning strategy that keeps packages reproducible and promoteable.

Overview

Two levers that govern where packages come from and how versions are labeled: upstream caching/proxying for external dependencies, and SemVer-based versioning for internal packages across the build pipeline.

Concepts introduced (link to term notes)

• upstream-sources
• package-feed
• semantic-versioning
• azure-artifacts
• dependency-management

Units

• Enable and configure upstream sources (nuget.org, npmjs, PyPI, Maven Central, other feeds)
• Feed-to-feed upstreams (project → org feed hierarchy)
• Define a versioning scheme (SemVer: MAJOR.MINOR.PATCH)
• Use GitVersion/build metadata to version packages in the pipeline
• Choose stable vs. prerelease versions and views

Key terms & commands

upstream · proxy + cache · feed-to-feed · SemVer (MAJOR.MINOR.PATCH) · gitversion · -prerelease · lock files

Hands-on

Add nuget.org as an upstream to a feed, verify a package is cached on first pull, and wire GitVersion into a pipeline to auto-version published packages.

Exam focus

• Upstreams cache external packages, making builds reproducible and reducing direct internet egress.
• Upstreams can point at public registries or other Azure Artifacts feeds.
• Publish with a stable SemVer to your feed; use prerelease versions for work-in-progress.
• Lock files pin transitive versions so resolution is deterministic.

Related

Path MOC · intro-dependency-management · azure-artifacts-feeds · packaging-in-pipelines