Nuget manager fails to update packages.lock.json artifact if nuget.config contains default registry

[skyfrk]

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

If you're self-hosting Renovate, select which platform you are using.

None

If you're self-hosting Renovate, tell us what version of the platform you run.

No response

Was this something which used to work for you, and then stopped?

I never saw this working

Describe the bug

Minimal reproduction repository: https://github.com/skyfrk/renovate-nuget-issue-20888

If the nuget.config contains the default registry RenovateBot tries to add it using dotnet nuget add source and it fails, because it is already configured. This should theoretically also happen if there is no nuget.config and renovate tries to add the defaultRegistryUrls of the nuget datasource.

To fix this issue, renovate should run dotnet nuget list source to get a list of already existing sources and only add additional sources.

Relevant debug logs

Logs

installing v2 tool dotnet v7.0.201
dotnet-install: Note that the intended use of this script is for Continuous Integration (CI) scenarios, where:
dotnet-install: - The SDK needs to be installed without user interaction and without admin rights.
dotnet-install: - The SDK installation doesn't need to persist across multiple CI runs.
dotnet-install: To set up a development environment or to run apps, use installers rather than this script. Visit https://dotnet.microsoft.com/download to get the installer.

dotnet-install: Attempting to download using primary link https://dotnetcli.azureedge.net/dotnet/Sdk/7.0.201/dotnet-sdk-7.0.201-linux-x64.tar.gz
dotnet-install: Extracting zip from https://dotnetcli.azureedge.net/dotnet/Sdk/7.0.201/dotnet-sdk-7.0.201-linux-x64.tar.gz
dotnet-install: Installed version is 7.0.201
dotnet-install: Binaries of dotnet can be found in /opt/buildpack/tools/dotnet
dotnet-install: Note that the script does not resolve dependencies during installation.
dotnet-install: To check the list of dependencies, go to https://learn.microsoft.com/dotnet/core/install, select your operating system and check the "Dependencies" section.
dotnet-install: Installation finished successfully.
linking tool dotnet v7.0.201
.NET SDK:
 Version:   7.0.201
 Commit:    68f2d7e7a3

Runtime Environment:
 OS Name:     ubuntu
 OS Version:  20.04
 OS Platform: Linux
 RID:         ubuntu.20.04-x64
 Base Path:   /opt/buildpack/tools/dotnet/sdk/7.0.201/

Host:
  Version:      7.0.3
  Architecture: x64
  Commit:       0a2bda10e8

.NET SDKs installed:
  7.0.201 [/opt/buildpack/tools/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 7.0.3 [/opt/buildpack/tools/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 7.0.3 [/opt/buildpack/tools/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  None

Environment variables:
  DOTNET_ROOT       [/opt/buildpack/tools/dotnet]

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download
Installed v2 /usr/local/buildpack/tools/v2/dotnet.sh in 36 seconds
skip cleanup, not a docker build: 70dfe6ce810a
Package source with Name: Package source 1 added successfully.
error: The source specified has already been added to the list of available package sources. Provide a unique source.


Usage: dotnet nuget add source [arguments] [options]

Arguments:
  PackageSourcePath  Path to the package source.

Options:
  -n|--name                       Name of the source.
  -u|--username                   Username to be used when connecting to an authenticated source.
  -p|--password                   Password to be used when connecting to an authenticated source.
  --store-password-in-clear-text  Enables storing portable package source credentials by disabling password encryption.
  --valid-authentication-types    Comma-separated list of valid authentication types for this source. Set this to basic if the server advertises NTLM or Negotiate and your credentials must be sent using the Basic mechanism, for instance when using a PAT with on-premises Azure DevOps Server. Other valid values include negotiate, kerberos, ntlm, and digest, but these values are unlikely to be useful.
  --configfile                    The NuGet configuration file. If specified, only the settings from this file will be used. If not specified, the hierarchy of configuration files from the current directory will be used. For more information, see https://docs.microsoft.com/nuget/consume-packages/configuring-nuget-behavior.
  -h|--help                       Show help information

Have you created a minimal reproduction repository?

I have read the minimal reproductions documentation and linked to such a repository in the bug description

[skyfrk]

An alternative solution might be to just ignore the failed dotnet nuget add source command, but that seems hacky.

[skyfrk]

After reading #7769 (comment) I was able to fix this issue in my minimal reproduction repository using this nuget.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
</configuration>

I guess a documentation update would also be sufficient to resolve this issue?