[jdx]

https://entire.io/gh/jdx/mise/trails/880

Problem

Someone running the `dotnet` backend against a password-protected Nexus feed could not tell where to put credentials (discussion 12241). The private-feeds section covered `NuGet.Config` for installs but said nothing about the version-listing step, which authenticates separately.

Change

The private-feeds section of the dotnet backend page now says:

• version listing reads the NuGet service index through mise's HTTP client, which sends `netrc` credentials to matching hosts by default, with an example `~/.netrc` entry
• `dotnet tool install` does not read netrc, so the feed's credentials also go in `NuGet.Config` (or `dotnet nuget add source`)

Docs only. I confirmed from the code that `nuget_search_url` fetches through `HTTP_FETCH`, which applies netrc. I did not test against a real authenticated feed.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only change with no runtime or configuration behavior changes.

Overview
Private feeds documentation now explains that version listing and dotnet tool install use different credential paths.

mise’s mise ls-remote / registry lookup hits the service index via mise’s HTTP client, which applies netrc (HTTP Basic) to matching hosts—documented with a sample ~/.netrc entry for Nexus/Artifactory-style feeds. dotnet tool install is called out as not reading netrc; credentials for installs must live in NuGet.Config (packageSourceCredentials or dotnet nuget add source), alongside the existing note to align dotnet.registry_url with the feed.

^{Reviewed by Cursor Bugbot for commit 34e8ac8. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Documentation
  • Clarified that version listing and package installation authenticate separately for private feeds.
  • Documented how to configure credentials for each operation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: fa009e3e-e048-4aac-8c43-b79051271572

📥 Commits

Reviewing files that changed from the base of the PR and between 7f18f10 and 34e8ac8.

📒 Files selected for processing: 1

• docs/dev-tools/backends/dotnet.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The .NET backend documentation now explains that mise version listing and dotnet tool install use separate authentication configuration for private NuGet feeds.

Changes: Private NuGet Feed Authentication

Layer / File(s)	Summary
Document authentication requirements docs/dev-tools/backends/dotnet.md	The documentation states that mise version listing uses matching-host netrc credentials with HTTP Basic authentication. It explains that package installation instead requires credentials in NuGet.Config or configuration through dotnet nuget add source.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 34e8a

The documentation accurately distinguishes authentication for version listing from package installation. No actionable merge risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the documentation change. It identifies the .NET scope and explains that the change covers authentication for private feeds.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] The documentation change appears safe to merge.

Summary

The PR explains how private .NET feeds authenticate:

• Private-feed guidance now separates version-listing and install credentials.

No actionable issues were found. The review checked the code paths; it did not test a live authenticated feed.

_{Reviews (1) · Last reviewed commit: "docs(dotnet): explain how private feeds ..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▇▁▅█▅▆▆	30,806,829 → 30,806,194	-0.00%	20.38 → 20.72ms	+1.69%
hook-env	▃▂▂▇█▆▁	33,085,638 → 33,046,162	-0.12%	21.70 → 21.70ms	-0.01%
ls	▆▅██▁▄▆	35,040,060 → 35,058,723	+0.05%	22.56 → 22.62ms	+0.25%
registry	▅▃▁▆██▁	43,918,665 → 43,801,568	-0.27%	18.82 → 18.59ms	-1.21%
startup	▄▄▁▄█▃▅	12,009,534 → 12,015,716	+0.05%	12.53 → 12.75ms	+1.77%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{34e8ac807f15 vs a53284feb44e · measured on the runner, not pushed to the history.}