MSBuildBinaryLog: Retrieve inner assets files for multi-target project

[Julien Lebosquain (MrJul)]

Problem

When using the MSBuildBinaryLog detector with a multi-target project, any information from the project, such as <IsShipping>false</IsShipping> isn't applied and a warning is logged:

No ProjectAssetsFile property found in binlog for project [...]

This is because the outer builder doesn't really have an asset file, each inner build does (even though it's shared).

Solution

This PR now iterates through all inner builds to map the assets file to its matching project.

Two unit tests, which were failing before the changes, have been added.

[Julien Lebosquain (MrJul)]

@microsoft-github-policy-service agree

[Copilot]

🟡 Changes recommended

Multi-binlog merging can discard inner-build metadata, and the behavior change requires a detector version bump.

2 open findings

• Merge inner builds when combining multi-target project info · New
• Bump detector version after changing devDependencies · New

What changed in this PR

Enables MSBuild binlog detection for multi-target projects whose assets files are recorded only by inner builds.

Changes:

• Indexes and validates inner-build assets files.
• Adds multi-target regression tests for development dependencies.

File	Description
MSBuildBinaryLogComponentDetector.cs	Retrieves assets paths from inner builds.
MSBuildBinaryLogComponentDetectorTests.cs	Tests inner-build lookup and dependency classification.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Julien Lebosquain (MrJul)]

ac03948 now merges the inner builds.

[Copilot]

🔵 Needs a closer look

Inner-build merging can incorrectly discard IsShipping=false, causing dependency misclassification.

1 open finding

• Merge inner builds when combining multi-target project info

1 resolved since last review

• Bump detector version after changing devDependencies

Previously missed (1)

In code that hasn't changed since last review

MergeWith incorrectly prefers true for inverted IsShipping flag

src/​Microsoft.ComponentDetection.Detectors/​nuget/​MSBuildProjectInfo.cs:284

The recursive merge can discard a development-only classification. MergeWith merges every nullable boolean with “true wins” (MSBuildProjectInfo.cs:257-262), but IsShipping has inverted semantics: false marks all dependencies as development dependencies (MSBuildBinaryLogComponentDetector.cs:201-204, also documented in docs/detectors/nuget.md:52). If one binlog reports an inner build as shipping and a later build/publish binlog reports IsShipping=false, this call retains true, so the dependencies are incorrectly classified as shipping. Merge IsShipping with false-wins semantics and add a conflicting multi-binlog inner-build regression test.

🧠 Review effort: Balanced