test: guard PrivateAssets=all per shipping project - #26
Merged
Conversation
The SBOM filter test flattens all three src/ projects into one set of package ids, so it only asks whether a name is somewhere private. Drop PrivateAssets=all from a single csproj and the other two keep the id in that set: every check stays green while that one nuspec starts declaring the dependency and its consumers restore the whole subtree behind it. For Microsoft.EntityFrameworkCore.Design that subtree is ~45 MSBuild/Roslyn components carrying System.Security.Cryptography.Xml 9.0.0 and its eight high advisories. "Consumers never receive it" is the premise NU1903 staying a warning rests on (Directory.Build.props) and the reason dependabot.yml ignores that package under src/ — and nothing checked it per project. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Triaging the 32 open Dependabot alerts (all one package —
System.Security.Cryptography.Xml9.0.0, 8 advisories × 4 projects) confirmed none reach a consumer: it arrives only throughMicrosoft.EntityFrameworkCore.Design, which everysrc/project marksPrivateAssets=all. That is the premiseNU1903staying a warning rests on (Directory.Build.props) and the reasondependabot.ymlignores the package undersrc/.Nothing checked that premise per project.
Sbom_filter_covers_every_private_referencebuilds its set withSelectMany(...).ToHashSet(...), flattening all three projects into one collection of ids, so it only ever asks whether a name is somewhere private. DropPrivateAssets=allfrom a single csproj and the other two keep the id in that set — the SBOM test stays green while that one package's nuspec starts declaring the dependency.What
Build_only_references_are_private_in_every_project: every package id markedPrivateAssets=allin anysrc/project must not be referenced publicly by another. General rather than hardcoded to EF Core Design, so it catches the class of drift; the failure message names the project, the id, and the escape hatch if a consumer genuinely needs the package at runtime.CLAUDE.mdgains the rationale next to the existing SBOM-filter paragraph.Verified (verify-the-guard)
The subject is delivery, so the counterfactual breaks the mechanism rather than reverting a source fix. Removed
PrivateAssets=allfromMicrosoft.EntityFrameworkCore.DesigninEFCore.ComplexIndexes.SqlServer.csprojonly:EFCore.ComplexIndexes.SqlServer -> Microsoft.EntityFrameworkCore.Design — marked PrivateAssets=all elsewhere under src/ but not here…Sbom_filter_covers_every_private_referenceThat contrast is the reason the test exists.
The stated consequence was checked rather than assumed. Packing the broken project yields a nuspec declaring
<dependency id="Microsoft.EntityFrameworkCore.Design" …>, and a throwaway consumer restoring it — outside the repo, source-mapped, with a freshNUGET_PACKAGESso the good 5.0.3 built minutes earlier could not shadow it — reports all eight advisories onSystem.Security.Cryptography.Xml. The good build of the same package reports none.Tree restored; full unit suite green at 195.
🤖 Generated with Claude Code