|
46 | 46 | <SBOMPackageSupplier>Organization: $(Company)</SBOMPackageSupplier> |
47 | 47 | </PropertyGroup> |
48 | 48 |
|
| 49 | + <!-- Runtime Dependencies --> |
49 | 50 | <ItemGroup> |
50 | 51 | <PackageReference Include="DemaConsulting.TestResults" Version="1.5.0" /> |
51 | | - <!-- PrivateAssets="All" prevents these build-time-only packages from becoming transitive dependencies --> |
| 52 | + </ItemGroup> |
| 53 | + |
| 54 | + <!-- Build Tool Dependencies --> |
| 55 | + <ItemGroup> |
52 | 56 | <PackageReference Include="Microsoft.Sbom.Targets" Version="4.1.5" PrivateAssets="All" /> |
53 | 57 | <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.103" PrivateAssets="All" /> |
54 | | - <!-- |
55 | | - Analyzer and source-only packages require both PrivateAssets and IncludeAssets: |
56 | | - PrivateAssets="all" - prevents these build-time assets from flowing to consumers |
57 | | - IncludeAssets - explicitly enables contentfiles (source injection) and |
58 | | - analyzers/buildtransitive (Roslyn analyzers at compile time) |
59 | | - --> |
| 58 | + <PackageReference Include="Polyfill" Version="9.12.0" PrivateAssets="All" /> |
| 59 | + </ItemGroup> |
| 60 | + |
| 61 | + <!-- Code Analysis Dependencies --> |
| 62 | + <ItemGroup> |
| 63 | + <!-- Analyzer packages use child-element form to configure both PrivateAssets and IncludeAssets: |
| 64 | + - PrivateAssets="all" prevents these build-time analyzers from becoming transitive dependencies |
| 65 | + in packages that consume this tool. |
| 66 | + - IncludeAssets lists all asset types (including 'analyzers' and 'buildtransitive') to ensure |
| 67 | + Roslyn analyzers and MSBuild targets are fully activated during the build. --> |
60 | 68 | <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.103"> |
61 | 69 | <PrivateAssets>all</PrivateAssets> |
62 | 70 | <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets> |
|
65 | 73 | <PrivateAssets>all</PrivateAssets> |
66 | 74 | <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets> |
67 | 75 | </PackageReference> |
68 | | - <!-- Polyfill is a source-only package; contentfiles delivers the polyfill source into this project --> |
69 | | - <PackageReference Include="Polyfill" Version="9.12.0"> |
70 | | - <PrivateAssets>all</PrivateAssets> |
71 | | - <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets> |
72 | | - </PackageReference> |
73 | 76 | </ItemGroup> |
74 | 77 |
|
75 | 78 | <ItemGroup> |
|
0 commit comments