Enable Nuget Audit (#1149)

* Enable Nuget Audit

* Update WarningsAsErorrs

Author: MichaelSimons

Directory.Build.props

@@ -23,6 +23,9 @@
     <CustomizationsPrefix>Customizations</CustomizationsPrefix>
     <CustomizationsPropsFile>$(CustomizationsPrefix).props</CustomizationsPropsFile>
     <CustomizationsSourceFile>$(CustomizationsPrefix).cs</CustomizationsSourceFile>
+
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
   </PropertyGroup>
 
 </Project>

NuGet.config

@@ -24,4 +24,8 @@
     <add key="darc-pub-DotNet-msbuild-Trusted" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-DotNet-msbuild-Trusted-a400405b/nuget/v3/index.json" />
   </packageSources>
   <disabledPackageSources />
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
 </configuration>

src/packageSourceGenerator/PackageSourceGenerator.proj

@@ -2,6 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>$(NetCurrent)</TargetFramework>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <PackageSourceGeneratorTaskAssembly>$(ArtifactsBinDir)PackageSourceGeneratorTask\$(Configuration)\$(NetCurrent)\PackageSourceGeneratorTask.dll</PackageSourceGeneratorTaskAssembly>
     <!-- The packages output directory. -->
     <PackagesTargetDirectory Condition="'$(PackageType)' != 'text'">$(RepoRoot)src\referencePackages\src\</PackagesTargetDirectory>

src/referencePackages/Directory.Build.props

@@ -33,6 +33,7 @@
     <SourceControlInformationFeatureSupported>false</SourceControlInformationFeatureSupported>
     <Configuration>Release</Configuration>
     <EnableSourceLink>false</EnableSourceLink>
+    <NuGetAudit>false</NuGetAudit>
 
     <NoStdLib>true</NoStdLib>
     <NoConfig>true</NoConfig>

src/targetPacks/Directory.Build.props

@@ -10,6 +10,7 @@
     <TargetFramework>netstandard2.0</TargetFramework>
     <IncludeBuildOutput>false</IncludeBuildOutput>
     <DisableImplicitFrameworkReferences>true</DisableImplicitFrameworkReferences>
+    <NuGetAudit>false</NuGetAudit>
 
     <RestoreIlTooling>true</RestoreIlTooling>