Repository navigation
Bug: stale-analyzer-include-paths-break-clean-build #936
Description
- Work Mode: minor-audit
Summary
main does not compile after a clean package restore. Dependabot PR #921 (merged 2026-09-26) bumped Meziantou.Analyzer to 3.0.290 and MSTest.Analyzers to 4.4.1 in every packages.config, but left the <Analyzer Include> paths in the project files pointing at the previous version folders. A clean restore does not create those folders, so the compiler fails with CS0006. CI stays green because its actions/cache restore-keys fallback restores an older packages/ cache that still contains the stale folders.
Environment
- OS/version: Windows 11 Pro 10.0.26200
- Python version: not applicable (.NET Framework 4.8.1 packages.config solution)
- Command/flags used:
msbuild TaskMaster.sln /t:Restore /p:RestorePackagesConfig=true, thenmsbuild TaskMaster.sln /t:Rebuild /m /p:Configuration=Debug "/p:Platform=Any CPU" - Data source or fixture: a fresh detached worktree at
maindcce3c816with an emptypackages/folder
Steps to Reproduce
- Create a fresh worktree at
main. - Restore packages into its empty
packages/folder. - Rebuild the solution.
Expected Behavior
The solution builds from a clean restore, and CI fails whenever it would not.
Actual Behavior
The build fails with:
CSC : error CS0006: Metadata file '..\packages\Meziantou.Analyzer.3.0.235\analyzers\dotnet\roslyn5.0\cs\Meziantou.Analyzer.dll' could not be found, in 16 project files. The manifests declare 3.0.290.CSC : error CS0006: Metadata file '..\packages\MSTest.Analyzers.4.4.0\analyzers\dotnet\cs\MSTest.Analyzers.dll' could not be found, plusMSTest.Analyzers.CodeFixes.dll, in 9 project files. The manifests declare 4.4.1.
A scan of every ..\packages\<dir>\ reference against the clean restore finds exactly these two stale directories. It also finds altcover.8.6.45, which is guarded by Exists() and tracked by #929.
Logs / Screenshots
- Attached minimal logs or screenshot
- Snippet: see Actual Behavior. The fix commit records the before and after rebuild output.
Impact / Severity
- Blocker
- High
- Medium
- Low
Blocker: the maintainer cannot build the tool from a clean checkout. Every fresh worktree used by agent runs is affected as well.
Source
From: docs/features/potential/2026-09-29-stale-analyzer-include-paths-break-clean-build.md
Activity
drmoisan commentedon Sep 29, 2026
Sections dropped by
potential_to_issue(defect tracked upstream in #932), reposted verbatim from the promoted record.Suspected Cause / Notes
packages.configversions but does not rewrite<Analyzer Include>paths. This is the same defect class Bug: Bug: Meziantou.Analyzer HintPath skew masked by CI cache restore-keys fallback #898 fixed (PR fix(898): point Analyzer Include at the Meziantou version the manifests declare #913) for the previous Meziantou bump._build-analyzers.yml,_build-nullable.yml,_format-check.yml,_mstest-coverage.yml) key thepackages/cache onhashFiles('**/packages.config')with arestore-keysprefix fallback. On a miss, the fallback cache carries the old version folders, so stale paths resolve in CI and the defect is invisible to every required check.Proposed Fix / Validation Ideas
<Analyzer Include>paths to the versions declared in each project'spackages.config: Meziantou.Analyzer 3.0.290 and MSTest.Analyzers 4.4.1.restore-keysfallback from thepackages/cache in the four workflows, so CI restores exactly what the manifests declare...\packages\<dir>\references finds no missing directory other than theExists()-guarded altcover import.Next Step
drmoisan commentedon Sep 29, 2026
Fixed by PR #937 (merge 89e202e). All 17 stale Analyzer Include paths now name Meziantou.Analyzer 3.0.290 and MSTest.Analyzers 4.4.1, and the restore-keys fallback that masked the failure in CI is removed from the three packages/ cache steps. Verified on a fresh worktree with an empty packages/ folder, where the rebuild with TreatWarningsAsErrors and the analyzer rebuild both exit 0. All six required checks passed on the PR head.