From ededccbda50b7c2d8801492d9b01a682dcff5f52 Mon Sep 17 00:00:00 2001
From: Daniel Cazzulino <daniel@cazzulino.com>
Date: Wed, 24 Jun 2026 16:23:17 -0300
Subject: [PATCH 1/2] fix: prevent transitive ThisAssembly.Constants deps from
 copying assemblies to output

Fixes https://github.com/devlooped/GitInfo/issues/389

The change ensures that the runtime assemblies brought in by
ThisAssembly.Constants (System.Runtime.CompilerServices.Unsafe.dll
and System.Threading.Tasks.Extensions.dll) are not copied into the
consumer's build output folder, by restricting the package reference
assets to build/analyzers only (and enforcing via buildTransitive).

- Updated authoring PackageReference
- Added PackageReference Update in buildTransitive + buildMultiTargeting
- Updated changelog
---
 changelog.md                                    | 6 ++++++
 src/GitInfo/GitInfo.msbuildproj                 | 2 +-
 src/GitInfo/buildMultiTargeting/GitInfo.targets | 3 +++
 src/GitInfo/buildTransitive/GitInfo.targets     | 3 +++
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/changelog.md b/changelog.md
index 82bf38a..a45a48f 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+:bug: Fixed bugs:
+
+- Assemblies of transitive nuget dependencies are placed into the build folder [\#389](https://github.com/devlooped/GitInfo/issues/389)
+
 ## [v3.6.0](https://github.com/devlooped/GitInfo/tree/v3.6.0) (2025-10-17)
 
 [Full Changelog](https://github.com/devlooped/GitInfo/compare/v3.6.0-beta...v3.6.0)
diff --git a/src/GitInfo/GitInfo.msbuildproj b/src/GitInfo/GitInfo.msbuildproj
index 5ae11c9..72aec79 100644
--- a/src/GitInfo/GitInfo.msbuildproj
+++ b/src/GitInfo/GitInfo.msbuildproj
@@ -14,7 +14,7 @@
   <ItemGroup>
     <PackageReference Include="NuGetizer" Version="1.4.5" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="all" />
-    <PackageReference Include="ThisAssembly.Constants" Version="2.1.2" Pack="true" TargetFramework="netstandard2.0" />
+    <PackageReference Include="ThisAssembly.Constants" Version="2.1.2" Pack="true" PrivateAssets="all" IncludeAssets="build;analyzers" TargetFramework="netstandard2.0" />
   </ItemGroup>
   <ItemGroup>
     <None Include="build/**/*.*" />
diff --git a/src/GitInfo/buildMultiTargeting/GitInfo.targets b/src/GitInfo/buildMultiTargeting/GitInfo.targets
index bd02a40..3409738 100644
--- a/src/GitInfo/buildMultiTargeting/GitInfo.targets
+++ b/src/GitInfo/buildMultiTargeting/GitInfo.targets
@@ -4,6 +4,9 @@
     <!-- Make sure we're always private to the referencing project. Prevents analyzers from "flowing out" of the referencing project. -->
     <PackageReference Update="GitInfo" PrivateAssets="all" PackTransitive="false" />
 
+    <!-- Ensure ThisAssembly.Constants (a dependency) is only used for build/analyzers to avoid bringing its transitive runtime assemblies (e.g. System.Threading.Tasks.Extensions.dll, System.Runtime.CompilerServices.Unsafe.dll) into the build output. See https://github.com/devlooped/GitInfo/issues/389 -->
+    <PackageReference Update="ThisAssembly.Constants" PrivateAssets="all" IncludeAssets="build;analyzers" />
+
     <!-- This makes sure we don't enforce SponsorLink transitively, but only when consumers are directly referencing our package. -->
     <SponsorablePackageId Include="GitInfo" />
 
diff --git a/src/GitInfo/buildTransitive/GitInfo.targets b/src/GitInfo/buildTransitive/GitInfo.targets
index bd02a40..3409738 100644
--- a/src/GitInfo/buildTransitive/GitInfo.targets
+++ b/src/GitInfo/buildTransitive/GitInfo.targets
@@ -4,6 +4,9 @@
     <!-- Make sure we're always private to the referencing project. Prevents analyzers from "flowing out" of the referencing project. -->
     <PackageReference Update="GitInfo" PrivateAssets="all" PackTransitive="false" />
 
+    <!-- Ensure ThisAssembly.Constants (a dependency) is only used for build/analyzers to avoid bringing its transitive runtime assemblies (e.g. System.Threading.Tasks.Extensions.dll, System.Runtime.CompilerServices.Unsafe.dll) into the build output. See https://github.com/devlooped/GitInfo/issues/389 -->
+    <PackageReference Update="ThisAssembly.Constants" PrivateAssets="all" IncludeAssets="build;analyzers" />
+
     <!-- This makes sure we don't enforce SponsorLink transitively, but only when consumers are directly referencing our package. -->
     <SponsorablePackageId Include="GitInfo" />
 

From 1da64450bca2e5d0d434a7c13f01bf64292e3ee0 Mon Sep 17 00:00:00 2001
From: Daniel Cazzulino <daniel@cazzulino.com>
Date: Wed, 24 Jun 2026 16:27:22 -0300
Subject: [PATCH 2/2] fix: use 'dotnet dnx' for portable invocation in CI test
 steps

The bare 'dnx' command was not found in the pwsh-invoked test steps
in GHA (despite the dotnet-env setup), causing build job failures.
Using the explicit 'dotnet dnx' form (which the local env also exposes)
makes the test step robust across shells and runners.

This is incidental to the main fix but required to get green CI.
---
 .github/workflows/build.yml   | 2 +-
 .github/workflows/publish.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 94db3ff..af76b6a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -73,7 +73,7 @@ jobs:
 
       - name: 🧪 test
         shell: pwsh
-        run: dnx --yes retest -- --no-build
+        run: dotnet dnx --yes retest -- --no-build
 
       - name: 🐛 logs
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 035d811..9ad32c1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: 🧪 test
         shell: pwsh
-        run: dnx --yes retest -- --no-build
+        run: dotnet dnx --yes retest -- --no-build
 
       - name: 🐛 logs
         uses: actions/upload-artifact@v4