skills.rest
dotnet
dotnetOFFICIAL
Explore all skills by this author →
Website𝕏@dotnetfdnGitHub

cleanup-unreferenced-packages

Removes unreferenced packages from source-build-assets using VMR usage reports and git history.

1.2k|337|Updated Oct 13, 2022
Search Tags:#dependency analysis#Azure DevOps#gitHub#vmr#DotNet#source-build#package cleanup
One-click install
npx skills add https://github.com/dotnet/dotnet --skill cleanup-unreferenced-packages
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cleanup-unreferenced-packages
Source: https://github.com/dotnet/dotnet/tree/main/src/source-build-assets/.github/skills/cleanup-unreferenced-packages
Command: npx skills add https://github.com/dotnet/dotnet --skill cleanup-unreferenced-packages

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The source-build-assets repository accumulates packages that are no longer referenced by the .NET VMR build, and deleting them blindly risks removing packages whose uptake is still in progress or that are false positives in the usage report.

Core Features & Use Cases

  • Usage Report Analysis: Downloads and parses the sbaPackageUsage.json artifact from the latest successful VMR unified build to identify unreferenced packages.
  • Safe Deletion Workflow: Protects known false positives, not-yet-flowed packages, and recently added packages using a tiered age-based grace period (14/60 days).
  • Author Notification: Identifies original authors of middle-window packages, resolves their transitive dependencies, and @-mentions them in the cleanup PR.
  • Use Case: A maintainer wants to shrink the source-build-assets repo by removing stale reference packages while ensuring in-flight package uptakes are not accidentally deleted.

Quick Start

Clean up unreferenced packages from the source-build-assets repository and open a PR with the removals.

Frequently Asked Questions about cleanup-unreferenced-packages

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I remove unreferenced packages from source-build-assets?▼

Download the sbaPackageUsage.json artifact from the latest successful VMR unified build, extract the UnreferencedSbaPackages list, filter out protected packages, then delete the package directories and open a PR against dotnet/source-build-assets.

How does the cleanup avoid deleting packages still being onboarded?▼

It compares the SBA commit recorded in the VMR's source-manifest.json against local HEAD to find additions that have not flowed yet, and applies a tiered grace period: packages under 14 days old are protected, and packages 14-60 days old trigger author notification in the PR.

What tools are required to run the package cleanup workflow?▼

The workflow requires the gh CLI authenticated against dotnet/dotnet and dotnet/source-build-assets, the az CLI for downloading Azure DevOps build artifacts, git for history analysis, and unzip for reading nuspec dependency data from built nupkgs.

Why are some packages always reported as unreferenced?▼

MSBuild SDKs like microsoft.build.notargets and microsoft.build.traversal are referenced implicitly via global.json, which the usage reporter cannot detect. These are listed as knownFalsePositives in cleanup-packages-config.json and permanently protected from deletion.

What happens to transitive dependencies of deleted packages?▼

For middle-window packages, the workflow builds each package, extracts dependencies from the nupkg nuspec, and reclassifies any mature deletion candidates found as dependencies as middle-window, attributing them to the same author in the PR's Action Required table.

Related Skills

Explore More Software Engineering Skills→
vercelvercel
26.1k

list-npm-package-content

List npm package tarball contents before publishing.

Official
Intermediate
CoolCoderSuperCoolCoderSuper
4

vmr-codeflow-status

Analyze VMR codeflow PR status for dotnet repositories using GitHub CLI and build freshness signals.

Community
Advanced
ilonatommyilonatommy
3

vmr-codeflow-status

Analyze VMR codeflow PR status for .NET repositories using GitHub CLI and darc.

Community
Advanced
fstr21fstr21

artifact-explorer

Identify, count and validate sports data artifacts across raw, derived and packages directories.

Community
Intermediate