build: pin the single-file analyzer package so lock files survive SDK patches #138

2026-11-10T18:15:18Z

james.maes commented

2026-11-10 18:15:18 +00:00

What

Pins the implicit Microsoft.NET.ILLink.Tasks package (the single-file analyzer) in a new Directory.Build.targets, so packages.lock.json no longer depends on which .NET SDK patch is installed.

Also: the weekly NuGet-update workflow now commits Directory.Packages.props, and VersionPrefix moves to 1.1.1.

Why

Closes #137.

The SDK adds that package at its own bundled runtime version. global.json rolls forward to the newest 10.0 SDK, as the KofTwentyTwo standard asks, so every SDK patch resolved a different version: a locked restore failed with NU1004 (the lock files said 10.0.12, SDK 10.0.403 wanted 10.0.14) and an unlocked restore rewrote three lock files.

Pinning the version through the SDK's KnownILLinkPack item keeps rollForward: latestFeature, keeps the analyzer, and leaves the committed lock files untouched. The alternative, an exact SDK pin, would need a standards exception and an SDK install for every contributor on a different patch.

The value must stay at the version bundled with the SDK named in global.json (the oldest SDK allowed), never newer; the comment in the file says so.

How it was tested

With SDK 10.0.403 and the unchanged lock files:

Before: dotnet restore gclo.slnx --locked-mode fails with NU1004 in gclo.Engine, gclo.ViewModels and gclo.Cli.
After: the same command passes.
dotnet build gclo.slnx -p:Platform=x64 -warnaserror -p:RestoreLockedMode=true: 0 warnings, 0 errors.
gclo.Engine.Tests 480 passed, gclo.Cli.Tests 142 passed; line coverage 100% on gclo.Engine, gclo.ViewModels and gclo.
dotnet format gclo.slnx --verify-no-changes --severity warn: clean.
Release-style publish of the CLI (-c Release -r win-x64 --self-contained -p:PublishSingleFile=true -p:RestoreLockedMode=true) succeeds; gclo.exe --version prints 1.1.1-dev.

Not run: the UI suite (no shell or view-model change), and the workflow change itself, which only runs on its weekly schedule.

Checklist

Commits are signed and signed off (git commit -S -s)
Zero build warnings; format and lint are clean
Tests added or updated; the 100% coverage gate still passes (no code change; no test added)
Docs updated for user-visible changes; threat model updated if the attack surface changed (neither applies)
No secrets, credentials, or personal data
New dependencies are justified below, or none were added (none)
Substantial AI assistance, if any, is noted here: written with Claude Code (Claude Fable 5.2)

🤖 Generated with Claude Code

## What Pins the implicit `Microsoft.NET.ILLink.Tasks` package (the single-file analyzer) in a new `Directory.Build.targets`, so `packages.lock.json` no longer depends on which .NET SDK patch is installed. Also: the weekly NuGet-update workflow now commits `Directory.Packages.props`, and `VersionPrefix` moves to 1.1.1. ## Why Closes #137. The SDK adds that package at its own bundled runtime version. `global.json` rolls forward to the newest 10.0 SDK, as the KofTwentyTwo standard asks, so every SDK patch resolved a different version: a locked restore failed with NU1004 (the lock files said 10.0.12, SDK 10.0.403 wanted 10.0.14) and an unlocked restore rewrote three lock files. Pinning the version through the SDK's `KnownILLinkPack` item keeps `rollForward: latestFeature`, keeps the analyzer, and leaves the committed lock files untouched. The alternative, an exact SDK pin, would need a standards exception and an SDK install for every contributor on a different patch. The value must stay at the version bundled with the SDK named in `global.json` (the oldest SDK allowed), never newer; the comment in the file says so. ## How it was tested With SDK 10.0.403 and the unchanged lock files: - Before: `dotnet restore gclo.slnx --locked-mode` fails with NU1004 in `gclo.Engine`, `gclo.ViewModels` and `gclo.Cli`. - After: the same command passes. - `dotnet build gclo.slnx -p:Platform=x64 -warnaserror -p:RestoreLockedMode=true`: 0 warnings, 0 errors. - `gclo.Engine.Tests` 480 passed, `gclo.Cli.Tests` 142 passed; line coverage 100% on `gclo.Engine`, `gclo.ViewModels` and `gclo`. - `dotnet format gclo.slnx --verify-no-changes --severity warn`: clean. - Release-style publish of the CLI (`-c Release -r win-x64 --self-contained -p:PublishSingleFile=true -p:RestoreLockedMode=true`) succeeds; `gclo.exe --version` prints `1.1.1-dev`. Not run: the UI suite (no shell or view-model change), and the workflow change itself, which only runs on its weekly schedule. ## Checklist - [x] Commits are signed and signed off (`git commit -S -s`) - [x] Zero build warnings; format and lint are clean - [x] Tests added or updated; the 100% coverage gate still passes (no code change; no test added) - [x] Docs updated for user-visible changes; threat model updated if the attack surface changed (neither applies) - [x] No secrets, credentials, or personal data - [x] New dependencies are justified below, or none were added (none) - [x] Substantial AI assistance, if any, is noted here: written with Claude Code (Claude Fable 5.2) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 1 commit 2026-11-10 18:15:18 +00:00

build: pin the single-file analyzer package so lock files survive SDK patches 48610f54cc

The SDK adds Microsoft.NET.ILLink.Tasks implicitly, at its own runtime
version, for projects with EnableSingleFileAnalyzer. global.json rolls
forward to the newest 10.0 SDK, so each SDK patch resolved a different
version: a locked restore failed with NU1004 and an unlocked one rewrote
three lock files.

Directory.Build.targets now fixes the version through the SDK's
KnownILLinkPack item, at the one bundled with the SDK named in
global.json. The committed lock files are unchanged and restore in locked
mode with SDK 10.0.403, for a build and for the single-file publish.

Also:
- nuget-updates: commit Directory.Packages.props with the weekly bump;
  without it the pull request carried lock files that no longer matched.
- VersionPrefix: 1.1.1, the next release after v1.1.0.

Closes #137

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

james.maes merged commit 2526eea747 into main

2026-11-10 18:15:50 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#138