fix: disable NuGetAudit when AccessToNugetFeed=false to fix CI NU1900

NuGet vulnerability audit queries all sources in nuget.config (including the private Azure DevOps feed) regardless of RestoreSources. When credentials aren't available in CI, this produces NU1900 which TreatWarningsAsErrors escalates to an error.

Disable NuGetAudit when AccessToNugetFeed!=true. Also reverts --ignore-failed-sources workaround which didn't help.

Author: BenjaminMichaelis

.github/workflows/PR-Build-And-Test.yml

@@ -29,7 +29,7 @@ jobs:
             ${{ runner.os }}-nuget-
 
       - name: Restore with dotnet
-        run: dotnet restore /p:AccessToNugetFeed=false --ignore-failed-sources
+        run: dotnet restore /p:AccessToNugetFeed=false
 
       - name: Restore local dotnet tools
         run: dotnet tool restore

Directory.Packages.props

@@ -4,6 +4,10 @@
     <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
     <ToolingPackagesVersion>1.1.1.19025</ToolingPackagesVersion>
     <AccessToNugetFeed Condition="'$(AccessToNugetFeed)' == ''">false</AccessToNugetFeed>
+    <!-- Disable NuGet vulnerability audit when the private feed is unavailable (e.g. CI without credentials).
+         NuGet audit queries all sources in nuget.config regardless of RestoreSources, causing NU1900 which is
+         escalated to an error by TreatWarningsAsErrors. -->
+    <NuGetAudit Condition="'$(AccessToNugetFeed)' != 'true'">false</NuGetAudit>
   </PropertyGroup>
   <PropertyGroup>
     <SemanticKernelVersion>1.72.0</SemanticKernelVersion>