C# Add support for authenticated nuget feeds

[robertcoltheart]

Description of the issue

This is using advanced mode with build-mode: none to take advantage of the "no build" csharp analyzers.

When using authenticated nuget feeds with build-mode: none, CodeQL will try and restore the packages, however there are multiple errors within the logs indicating that the feed failed due to 401 errors:

[2026-03-20 02:10:31] [build-stdout] Checking if NuGet feed 'https://my-artifactory-feed' is reachable...
[2026-03-20 02:10:31] [build-stdout] Querying NuGet feed 'https://my-artifactory-feed' failed in a timely manner. Not considering the feed for use. The reason for the failure: Response status code does not indicate success: 401.

[oscarsj]

This looks like CodeQL’s C# “no-build” (advanced mode, build-mode: none) restore path is probing your NuGet sources without (or before) applying credentials, so an authenticated feed returns HTTP 401 and CodeQL marks the feed “not reachable” and skips it.

That strongly suggests one of these is happening:

• Your credentials aren’t available inside the Action runtime that CodeQL uses for the probe/restore (common with private Artifactory/Azure DevOps feeds).
• Credentials exist, but are stored in a way that the probe doesn’t use (for example, relying on an interactive credential provider, or a NuGet.config that isn’t being picked up).
• The probe is doing a simple HTTP request to the feed URL (not dotnet restore/NuGet client semantics), so it won’t invoke credential plugins and won’t apply auth unless the URL itself is already accessible with basic headers.

Some questions to help diagnose the issue:

• What runner OS? (ubuntu / windows / macos)
• How are you providing NuGet credentials today?
  • NuGet.config with ?
  • dotnet nuget add source --username --password ...?
  • NUGET_AUTH_TOKEN (Azure Artifacts style)?
  • Artifactory token in env var?
  • A credential provider plugin?