[sean0407]

Summary

• Honor an explicit SelfContained value from the MSBuild binlog before considering the lock-file heuristic; retain PublishAot=true as a positive self-contained signal.
• Add regression coverage for runtime-pack download metadata that would otherwise classify an explicitly framework-dependent library as self-contained.

Fixes #1893

Reproduction

A library with SelfContained=false can still have Microsoft.NETCore.App.Runtime.* download dependencies in its assets file. With that lock-file metadata and an explicit false binlog value, the detector previously reported library-selfcontained; it should report library. The regression test exercises that metadata and binlog combination.

Changed files

• src/Microsoft.ComponentDetection.Detectors/nuget/MSBuildBinaryLogComponentDetector.cs
• test/Microsoft.ComponentDetection.Detectors.Tests/nuget/MSBuildBinaryLogComponentDetectorTests.cs

Validation

• Detector test project on .NET 8: 997/997 passed.
• git diff --check passed.

[Copilot]

🟡 Changes recommended

The new precedence can suppress positive AOT signals and misclassify self-contained inner builds.

2 open issues

• Preserve AOT as a self-contained signal · New
• Use matching inner build for self-contained classification · New

What changed in this PR

This PR addresses #1893 by making explicit binlog self-containment values override the NuGet lock-file heuristic.

Changes:

• Adds a nullable binlog decision to distinguish explicit false from missing information.
• Adds regression coverage for framework-dependent libraries with runtime-pack downloads.

File	Description
test/​Microsoft.ComponentDetection.Detectors.Tests/​nuget/​MSBuildBinaryLogComponentDetectorTests.cs	Adds the explicit-false regression and runtime-pack fixture.
src/​Microsoft.ComponentDetection.Detectors/​nuget/​MSBuildBinaryLogComponentDetector.cs	Prioritizes explicit binlog values over lock-file inference.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Self-containment detection incorrectly lets SelfContained=false suppress PublishAot=true and uses outer-build properties instead of per-target inner-build values, causing incorrect classifications.

2 open issues

• Use matching inner build for self-contained classification
• Preserve AOT as a self-contained signal

_{Review effort: Balanced}

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂