Modern .NET Project Structure and Deployment

Prerequisites: Namespaces, projects, and NuGet

Old and new project styles

Older VB projects target the .NET Framework (4.8 is the last version) and use long .vbproj files listing every source file. Modern projects target .NET (8, 9, 10...) and use the short SDK-style format:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <RootNamespace>Shop.Cli</RootNamespace>
    <OptionStrict>On</OptionStrict>
    <OptionInfer>On</OptionInfer>
    <Nullable>disable</Nullable>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
  </PropertyGroup>

  <ItemGroup>
    <ProjectReference Include="..\Shop.Core\Shop.Core.vbproj" />
    <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.0" />
  </ItemGroup>

</Project>

All .vb files in the folder are included automatically. The .NET Upgrade Assistant helps move .NET Framework projects to modern .NET; Windows Forms and WPF apps move over well, while ASP.NET Web Forms has no modern equivalent and must be rewritten (for example, as an ASP.NET Core app, typically in C#).

A typical solution layout

Shop/
  Shop.sln
  src/
    Shop.Core/        class library: business logic, no UI
    Shop.Data/        data access (ADO.NET, Dapper, or EF Core)
    Shop.Desktop/     Windows Forms or WPF front end
  tests/
    Shop.Core.Tests/  MSTest, xUnit, or NUnit
  Directory.Build.props   shared settings (Option Strict, warnings)

Directory.Build.props applies settings to every project below it — the easy way to enforce Option Strict On everywhere.

Publishing

dotnet publish -c Release -o out
dotnet publish src/Shop.Desktop -c Release -r win-x64 --self-contained -p:PublishSingleFile=true

Framework-dependent output is small but needs the .NET runtime installed.
Self-contained output includes the runtime; single-file bundles everything into one .exe.
Desktop apps are often distributed with an installer (MSIX, WiX, Inno Setup) or ClickOnce for automatic updates.

Continuous integration

A build server (GitHub Actions, Azure DevOps, Jenkins) typically runs:

dotnet restore
dotnet build -c Release --no-restore
dotnet test -c Release --no-build
dotnet publish src/Shop.Desktop -c Release -o artifacts

Windows Forms and WPF projects need a Windows build agent; class libraries and console apps build on Linux too.

Security checklist

Option Strict On, and treat warnings as errors.
Parameterized SQL only; never build queries from user input.
Keep secrets (connection strings, API keys) out of source code — use environment variables, user secrets, or a secrets vault.
dotnet list package --vulnerable to find packages with known vulnerabilities, and keep the runtime updated.
Validate and limit file paths and sizes when users choose files.