添加GitHub私有NuGet源后，GitHub Action构建Docker镜像包无法还原

你在GitHub Action主机环境中添加的GitHub私有NuGet源，不会自动传递到Docker构建的容器环境内。Docker构建时的dotnet restore是在独立容器中执行的，默认仅使用nuget.org作为源，因此找不到私有包，触发NU1101错误。

方法一：在Dockerfile构建阶段添加私有源（推荐） #

修改Dockerfile，在build阶段直接配置私有NuGet源，通过构建参数传递认证凭据：

修改后的Dockerfile #

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 7107

ENV ASPNETCORE_URLS=http://+:7107

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
# 定义构建参数，用于传递NuGet认证信息
ARG NUGET_GITHUB_USERNAME
ARG NUGET_GITHUB_TOKEN
WORKDIR /src

# 添加GitHub私有NuGet源
RUN dotnet nuget add source "https://nuget.pkg.github.com/msmith/index.json" \
    --name "githubpackages" \
    --username "${NUGET_GITHUB_USERNAME}" \
    --password "${NUGET_GITHUB_TOKEN}" \
    --store-password-in-clear-text

# 修正csproj复制路径，确保每个项目文件放到对应目录
COPY ["Statistics.BLL/Statistics.BLL.csproj", "Statistics.BLL/"]
COPY ["Statistics.Worker/Statistics.Worker.csproj", "Statistics.Worker/"]
COPY ["Statistics.WebApi/Statistics.WebApi.csproj", "Statistics.WebApi/"]

RUN dotnet restore "Statistics.WebApi/Statistics.WebApi.csproj"
COPY . .
WORKDIR "/src/Statistics.WebApi"
# 修正build命令中的多余前导点
RUN dotnet build "Statistics.WebApi.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Statistics.WebApi.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Statistics.WebApi.dll"]

修改GitHub Action中的构建命令 #

在docker build时传递构建参数：

- run: |
    docker build . \
      --build-arg NUGET_GITHUB_USERNAME="msmith@gmail.com" \
      --build-arg NUGET_GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" \
      -t statqacr.azurecr.io/statisticswebapi:${{ github.sha }}
    docker push statqacr.azurecr.io/statisticswebapi:${{ github.sha }}

方法二：使用NuGet.config文件管理源 #

在项目根目录创建NuGet.config配置私有源，通过环境变量注入真实认证token：

项目根目录创建NuGet.config #

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="githubpackages" value="https://nuget.pkg.github.com/msmith/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <githubpackages>
      <add key="Username" value="msmith@gmail.com" />
      <add key="ClearTextPassword" value="%NUGET_GITHUB_TOKEN%" />
    </githubpackages>
  </packageSourceCredentials>
</configuration>

修改Dockerfile #

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 7107

ENV ASPNETCORE_URLS=http://+:7107

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
ARG NUGET_GITHUB_TOKEN
# 设置环境变量替换NuGet.config中的占位符
ENV NUGET_GITHUB_TOKEN=${NUGET_GITHUB_TOKEN}
WORKDIR /src

# 复制NuGet.config到容器
COPY NuGet.config .
# 修正csproj复制路径
COPY ["Statistics.BLL/Statistics.BLL.csproj", "Statistics.BLL/"]
COPY ["Statistics.Worker/Statistics.Worker.csproj", "Statistics.Worker/"]
COPY ["Statistics.WebApi/Statistics.WebApi.csproj", "Statistics.WebApi/"]

RUN dotnet restore "Statistics.WebApi/Statistics.WebApi.csproj"
COPY . .
WORKDIR "/src/Statistics.WebApi"
RUN dotnet build "Statistics.WebApi.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Statistics.WebApi.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Statistics.WebApi.dll"]

修改GitHub Action构建命令 #

- run: |
    docker build . \
      --build-arg NUGET_GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" \
      -t statqacr.azurecr.io/statisticswebapi:${{ github.sha }}
    docker push statqacr.azurecr.io/statisticswebapi:${{ github.sha }}

• 确保GITHUB_TOKEN或自定义PAT拥有GitHub Packages读取权限（仓库设置→Actions→General→Workflow permissions中勾选Read and write permissions，或PAT包含packages:read权限）
• 原Dockerfile中复制csproj的路径错误，将非WebApi项目的csproj放到了WebApi目录，会导致restore时无法识别正确的依赖结构，已在方案中修正
• 原Dockerfile的dotnet build命令多了一个前导点，会导致找不到项目文件，已修正

内容的提问来源于stack exchange，提问作者Smith Waliko Msiska