How to Consume a Private NuGet Feed Hosted on GitHub from an Azure DevOps Pipeline

Learn effective methods to authenticate and consume private GitHub-hosted NuGet packages within Azure DevOps pipelines using Docker and .NET SDK. --- This video is based on the question https://stackoverflow.com/q/79116113/ asked by the user 'David Keaveny' ( https://stackoverflow.com/u/319980/ ) and on the answer https://stackoverflow.com/a/79116300/ provided by the user 'Kevin Lu-MSFT' ( https://stackoverflow.com/u/13464420/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions. Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Consuming private NuGet feed hosted on GitHub from an Azure Devops pipeline Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/licensing The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license. If anything seems off to you, please feel free to drop me a comment under this video. --- Introduction Consuming private NuGet packages hosted on GitHub from an Azure DevOps pipeline can be challenging due to authentication complexities. While GitHub Actions workflows handle this smoothly, Azure DevOps requires special handling to pass proper credentials during restore operations, especially in Docker-based builds. The Problem Using a NuGet service connection and NuGetAuthenticate@ 1 task in Azure DevOps seems straightforward, but the authentication token output by this task is not directly usable as a GitHub Personal Access Token (PAT) inside Docker builds for dotnet restore. This results in 401 Unauthorized errors when restoring packages from the private GitHub feed. Solutions Two reliable approaches address this issue: Method 1: Manual PAT Injection Without NuGetAuthenticate If you maintain a nuget.config with the GitHub feed: Do not use NuGetAuthenticate@ 1 in your Azure DevOps pipeline. Securely store your GitHub PAT as a secret pipeline variable (e.g., GithubPAT). Pass this PAT as a Docker build argument. Inside your Dockerfile, update the NuGet source with the explicit PAT during the build. Azure DevOps YAML snippet: [[See Video to Reveal this Text or Code Snippet]] Dockerfile excerpt: [[See Video to Reveal this Text or Code Snippet]] Method 2: Using NuGetAuthenticate with VSS_NUGET_EXTERNAL_FEED_ENDPOINTS If you prefer keeping the NuGetAuthenticate@ 1 task: Remove the GitHub source from your nuget.config. In your Dockerfile: Remove the dotnet nuget update source command. Install the Azure Artifacts Credential Provider. Set the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable with credentials for your GitHub feed. Dockerfile example: [[See Video to Reveal this Text or Code Snippet]] Azure DevOps YAML snippet: [[See Video to Reveal this Text or Code Snippet]] Summary Direct usage of NuGetAuthenticate@ 1 token inside Docker for GitHub feeds does not work as-is. Pass a real GitHub PAT manually for dotnet nuget update inside Docker (Method 1). Or configure VSS_NUGET_EXTERNAL_FEED_ENDPOINTS with the credential provider in Docker when using NuGetAuthenticate@ 1 (Method 2). This ensures your Azure DevOps pipeline can securely restore private NuGet packages hosted on GitHub within containerized builds.