Central transitive pinning updates app.config but does not deploy dependencies

[jaredpar]

Describe the bug

As part of responding to the Microsoft.IO.Redist MSA the Roslyn repo needed to move to version 6.0.1. This is an implicit transitive dependency on that package via our Microsoft.Build package references. To fix this we needed to move to an explicit reference.

Our repo utilizes CentralPackageTransitivePinningEnabled so to approach this issue we just added a new entry to our Directory.Packages.props file:

<PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />

This fixes the GC issue but resulted in a number of test failures. After a lot of debugging we discovered that this ends up doing the following for our net472 applications that transitively bring in Microsoft.IO.Redist.

1. The exe.config generates proper binding redirects for the DLL
2. The build does not deploy the DLL

This means it effectively produces a non-functioning application. There is a binding redirect for a DLL that does not deploy and that results in runtime errors

To Reproduce

1. Clone github.com/dotnet/roslyn
2. Reset to commit de10517376b251c28365aae6d27a8e7bb1352598
3. Run msbuild .\src\Workspaces\Core\MSBuild.BuildHost\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.csproj /v:m /m
4. Open artifacts\bin\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost\Debug\net472

Observe that the .exe.config file has the following binding redirect

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="Microsoft.IO.Redist" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-6.0.0.1" newVersion="6.0.0.1" />
      </dependentAssembly>
    </assemblyBinding>

Also observe that Microsoft.IO.Redist is not deployed.

Further technical details

This can be fixed by putting an explicit reference into the exe.

<PackageReference Include="Microsoft.IO.Redist" Condition="'$(TargetFrameworkIdentifier)' != '.NETCoreApp'" />

[baronfel]

I think what's happening here after some experimentation is that the ExcludeAssets="runtime" on the MSBuild references is transtively applying to Microsoft.IO.Redist as well, so it's not being copied to the output directory. As soon as I remove that from my repro project the expected file is copied to the output directory.