Repository navigation
fix(manifest): read .NET projects without running their targets - #1694
Merged
Jeppe Fredsgaard Blaabjerg (jfblaa) merged 2 commits intoNov 3, 2026
Merged
Conversation
The dotnet facts tool ran a design-time Compile build of every project for --with-files (what --reach uses). That executes the repository's own MSBuild targets, writes generated files into obj/, and fails outright on projects without a compiler, such as Microsoft.Build.Traversal aggregators (MSB4057: CoreCompile does not exist). Read every project by evaluation alone instead. The sidecar loses references, analyzers and buildError, which Coana does not read; sources no longer include target-generated files, and define constants no longer include the SDK's implicit framework symbols. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Oskar Haarklou Veileborg (BarrensZeppelin)
left a comment
Member
There was a problem hiding this comment.
A cleanup pass over reuse, simplification and altitude, not a correctness review. The removal itself is clean; these are suggestions, none blocking. The first comment, on classifyNugetFailure, is the one most worth a look.
MSBuild keeps an evaluation error's code out of the exception message, so evaluation and solution-parse failures reached the resolution report without it and were grouped as other failures. Prefix the code so they group as project configuration problems. Inner builds now come from TargetFrameworks, split as the cross-targeting targets do, rather than from restore's list, which only mattered while the tool built projects. Also tidies helpers and tests the evaluation-only change left with one caller.
Jeppe Fredsgaard Blaabjerg (jfblaa)
requested a review
from Oskar Haarklou Veileborg (BarrensZeppelin)
November 3, 2026 15:09
Jeppe Fredsgaard Blaabjerg (jfblaa)
enabled auto-merge (squash)
November 3, 2026 15:11
Oskar Haarklou Veileborg (BarrensZeppelin)
approved these changes
Nov 3, 2026
Jeppe Fredsgaard Blaabjerg (jfblaa)
deleted the
jfblaa/dotnet-evaluation-only
branch
November 3, 2026 16:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LLM Description written by Claude Code:claude-opus-5-5
socket scan create --dynamic-sbom-inference --reachfailed on .NET repositories containing a compiler-less project such as aMicrosoft.Build.Traversalaggregator (MSB4057: The target "CoreCompile" does not exist). Under--reach, the dotnet facts tool ran a design-timeCompilebuild of every project to collect compiler inputs, which runs the repository's own MSBuild targets and writes generated files intoobj/. We don't want to build users' projects at all.The tool now reads every project by MSBuild evaluation only and runs no targets.
What changes in the facts sidecar:
references,analyzersandbuildErrorare gone. Coana reads onlytargets,sources,classpathanddependencies.sourcesno longer include target-generated files (AssemblyInfo, GlobalUsings, XAML.g.cs), matching what Coana's non-facts path already analyses.defineConstantsno longer include the SDK's implicit framework symbols (NET8_0_OR_GREATER, ...), which only theAddImplicitDefineConstantstarget adds.Testing:
evaluation/fixture is a Traversal-shaped aggregator referencing a project whoseInitialTargetscanary fails any target run outside restore.Build.csproj,--with-filesnow yields no failures and sources for every project.🤖 Generated with Claude Code
Note
Medium Risk
Changes how .NET reachability facts are collected and shrinks the sidecar schema Coana consumes, which could affect analysis depth for edge cases but fixes a blocking failure mode for common monorepo layouts.
Overview
Fixes reachability scans failing on repos with compiler-less MSBuild projects (e.g.
Microsoft.Build.Traversalaggregators) where runningCoreCompiletriggeredMSB4057.The dotnet facts tool (
Reader.cs) no longer runs design-timeCompile(or related) targets. It collects project metadata from MSBuild evaluation only afterdotnet restore, so user targets are not executed and nothing is written underobj/from a scan.The per-framework facts sidecar drops fields that depended on those builds:
references,analyzers, andbuildError.sourcesare evaluation-timeCompileitems only (no generated AssemblyInfo/GlobalUsings/XAML outputs).defineConstantsno longer include SDK implicit symbols likeNET8_0_OR_GREATER(those came fromAddImplicitDefineConstants). Projects that would fail a real compile are no longer reported as scan failures solely for that reason.Tests add an
evaluation/Traversal-shaped fixture and retire the old design-time failure case; compat assertions and NuGet failure classification comments are updated accordingly.Reviewed by Cursor Bugbot for commit 00d157b. Configure here.