Open YuliiaKovalova opened 1 year ago
This would be beyond the "check for explicit MSBuild package references" we have:
We'd want something like a list of assemblies that shouldn't be deployed next to the final application, because they're expected to be found from the MSBuild installation.
+1 to searching actual assemblies being deployed rather than looking at PackageReference items. Problematic assemblies like these (or System.CodeDom.dll) can be deployed without any PackageReference, including by transitive dependency.
Add guardrails that can notify a customer that some of the deployed assemblies in a project can break MSBuild stuff.