Build NPOI from source via git submodule

Merged
JA
3mo ago
+520-107

Replaces the NPOI 2.8.0 NuGet binary — whose build targets now demand OSMF EULA acceptance (AcceptNPOIOSMFLicense) — with a from-source build of the same code, which remains Apache-2.0.

How

  • Git submodule externals/npoi -> nissl-lab/npoi pinned at 2.8.0-rc3 (commit 1f40df99f) — upstream publishes final releases under the last rc tag; NuGet 2.8.0 is built from this commit.
  • Four thin wrapper projects (externals/NPOI.Core|NPOI.OpenXmlFormats|NPOI.OpenXml4Net|NPOI.OOXML) compile the submodule sources under RDMP's own build settings and Central Package Management, mirroring upstream's source globs, embedded resources, npoi.snk signing and assembly names (net10.0 only). The EULA enforcement lives solely in the nupkg's build/NPOI.targets, which a source build never imports.
  • Wrappers rather than referencing NPOI's own csprojs because NPOI pins System.Security.Cryptography.Xml 8.0.2 (8 high-severity GHSAs) with TreatWarningsAsErrors, so its projects cannot restore, and nothing committable can override MSBuild evaluation inside a submodule. The wrappers build against RDMP's patched pins instead.
  • Rdmp.Core / Rdmp.UI / Plugins switch from PackageReference NPOI to ProjectReferences; NPOI's 8 dependencies join Directory.Packages.props at upstream's versions.
  • NoWarn-inheritance fix: several csprojs overwrote the root NoWarn, silently dropping repo-wide NU190x suppressions.
  • CI checkouts fetch submodules; new weekly npoi-update-check.yml compares the pinned submodule against upstream's latest release and opens a duplicate-guarded bump PR (dependabot's gitsubmodule ecosystem tracks branch HEAD, not release tags, so a bespoke check is used).
  • Packages.md + PackageListIsCorrect tests updated.

Verification (macOS, full solution incl. Rdmp.UI via EnableWindowsTargeting)

  • dotnet restore + build Release: 0 errors, 0 warnings, zero OSMF/EULA mentions
  • PackageListIsCorrect tests pass

Known implication

HIC.RDMP.Plugin* nupkgs would now declare dependencies on unpublished NPOI.Core/NPOI.OOXML project IDs instead of the NPOI package. Needs a decision if those packages are still published (pack the wrapper assemblies into the nupkg, or retire the packages with the plugin system).

Summary by cubic

Builds NPOI 2.8.0 from source via a vendored submodule and removes the NPOI NuGet dependency. Previously builds required AcceptNPOIOSMFLicense; now the same code compiles under Apache-2.0 with no EULA prompt or warning.

  • Vendors externals/npoi pinned to 2.8.0-rc3; adds wrapper projects externals/NPOI.Core, externals/NPOI.OpenXml4Net, externals/NPOI.OpenXmlFormats, externals/NPOI.OOXML (net10.0) mirroring upstream sources/resources/signing while building under our package pins.

  • Switches Rdmp.Core, Rdmp.UI, and Plugins from PackageReference NPOI to ProjectReference; adds NPOI runtime deps to Directory.Packages.props and explicitly references NPOI.OpenXmlFormats in Rdmp.Core.

  • CI fetches submodules; weekly npoi-update-check.yml opens bump PRs from origin/main.

  • Repository hygiene/tests skip vendored code via VendoredCode; removes dead helpers from EvaluateNamespacesAndSolutionFoldersTests; package-list tests and docs list NPOI’s dependencies.

  • Restores repository NoWarn inheritance (NU190x suppressions) where projects overwrote it.

  • Action: Ensure local and CI clones fetch submodules to build successfully.

  • Action: Before releasing HIC.RDMP.Plugin* nupkgs, decide how to ship NPOI outputs (include wrapper assemblies or publish wrapper packages).