Your team uses Visual Studio, VS Code and Rider across Windows, macOS and Linux. How do you standardise the developer environment so builds and behaviour match CI?

1. What lives where

repo/
+-- global.json                 <- which SDK (all IDEs + CLI + CI)
+-- nuget.config                <- which package sources (trusted only)
+-- Directory.Build.props       <- shared MSBuild properties
+-- Directory.Packages.props    <- central package versions
+-- .editorconfig               <- style + analyser severities
+-- .vsconfig                   <- Visual Studio workloads
+-- .vscode/extensions.json     <- VS Code recommendations
+-- .devcontainer/devcontainer.json
+-- .gitignore                  <- excludes .vs/, .idea workspace, *.user, bin/, obj/
+-- build.sh                    <- the exact commands CI runs
+-- src/Orders.Api/Properties/launchSettings.json  <- run profiles for every IDE

            developer IDE --+
                            +--> same SDK + same props + same rules --> same output
              CI pipeline --+

2. Which file controls which kind of drift

3. SDK pinning details

• rollForward: latestFeature keeps everyone on .NET 10 while taking the newest feature band and patch installed. Stricter teams use latestPatch and bump the band deliberately.
• Set allowPrerelease: false explicitly. When it isn't set, the command line allows preview SDKs (Visual Studio follows its own preview setting), so an agent with a preview installed could pick it.
• CI installs from the file (actions/setup-dotnet with global-json-file, or UseDotNet@2 with useGlobalJson: true) and prints dotnet --info first, so the SDK in use is visible in every log.

4. Deterministic builds

• Same SDK, same package versions (lock files with RestorePackagesWithLockFile and --locked-mode in CI if you need stronger guarantees), same compiler options.
• CI sets ContinuousIntegrationBuild=true so outputs are deterministic and don't embed local paths.
• Build once, then test and publish the same artefacts (--no-build, --no-restore).

5. Package source security

nuget.config with <clear /> removes machine-level sources nobody reviewed. Package source mapping pins each package id pattern to one source, so an attacker can't publish a same-named package on nuget.org to replace an internal one (dependency confusion):

<packageSourceMapping>
  <packageSource key="nuget.org"><package pattern="*" /></packageSource>
  <packageSource key="internal"><package pattern="Contoso.*" /></packageSource>
</packageSourceMapping>

6. Dev Containers trade-offs

So Windows Visual Studio users still need the setup-script path.

7. Rolling it out without disruption

1. global.json and .editorconfig first: cheap, high impact.
2. One reformatting commit, excluded from blame.
3. Directory.Build.props and Central Package Management.
4. nuget.config hardening.
5. Dev Container and setup script.
6. A shared build.sh adopted by CI.

Measure time to first green build and environment-related CI failures before and after.

8. Keeping it healthy

• A monthly SDK bump (after Microsoft's Patch Tuesday release) in one pull request that also updates CI images and the Dev Container.
• Changes to shared build files reviewed by an owner (CODEOWNERS).
• An onboarding script that prints dotnet --info and checks IDE versions.

9. .NET 11 awareness

To try .NET 11 previews, use a branch with its own global.json (allowPrerelease: true) or a separate container image, never a developer's global install, so the main branch stays on .NET 10 LTS.

10. Try it yourself

1. Add the global.json, Directory.Build.props and .devcontainer/devcontainer.json from the code example to a small solution.
2. Open it in VS Code with Dev Containers: Reopen in Container and run dotnet test.
3. Open the same repo on the host in Visual Studio or Rider and confirm the build is identical.
4. Install a preview SDK, remove allowPrerelease from global.json, and run dotnet --version to see the preview get picked; put the setting back.
5. Time how long a fresh clone takes to reach a green test run.

global.json:

{
  "sdk": {
    "version": "10.0.100",
    "rollForward": "latestFeature",
    "allowPrerelease": false
  }
}

Directory.Build.props:

<Project>
  <PropertyGroup>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
    <AnalysisLevel>latest-recommended</AnalysisLevel>
  </PropertyGroup>
</Project>

nuget.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
</configuration>

.devcontainer/devcontainer.json:

{
  "name": "orders-service",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "features": {
    "ghcr.io/devcontainers/features/dotnet:2": { "version": "10.0" }
  },
  "customizations": {
    "vscode": { "extensions": ["ms-dotnettools.csdevkit"] }
  },
  "postCreateCommand": "dotnet restore"
}

The same commands locally and in CI (build.sh):

#!/usr/bin/env bash
set -euo pipefail
dotnet restore
dotnet format --verify-no-changes --no-restore
dotnet build -c Release --no-restore
dotnet test -c Release --no-build