Analyzers flow from dependency into referencing project

If you have a project set up as follows

- Sln
  |-- ProjectA
  |-- ProjectB

And add an analyzer to ProjectA, and then reference ProjectA in ProjectB, ProjectB also ends up having the analyzer run. Is this expected? Is there a way to turn this off for solutions where ProjectB does not want the analyzer to be run?

[nguerrera]

@sharwell observed that PrivateAssets="all" does actually work around the issue in many cases. So I took a deeper look, and it turns out that is a reasonable workaround for a common case where the analyzers come from a package with no other assets that you need to flow to consumers.

Consider the Project Caller -> Project Callee -> Package Analyzers

If Callee.csproj has:

    <PackageReference Include="Analyzers" Version="1.2.3" PrivateAssets="All" />

Then Analyzers will not be picked up by project B.

However, if a package has a mix of of both analyzers and API, then you cannot block the analyzers without also blocking the API from flowing. The reason for this is that when PrivateAssets="All", then NuGet will not write out the package and its list of "files" in the "libraries" section of Caller’s project.assets.json. However, if PrivateAssets is anything else, then it will write them. For non-analyzer assets, these "files" don’t matter, it is the "compile", "runtime" lists under "targets" that do. But there is no such section for "analyzers" under "targets" (NuGet/Home#6279) and so the SDK uses "files" under "libraries", which leads to this behavior.

The irony remains that the default value of PrivateAssets is "contentfiles;analyzers;build", but analyzers do flow by default unlike contentfiles and build.

[tdwright]

@nguerrera Thanks for that workaround. Got me out of a pickle.

What’s the status of a proper fix? Is this something for which contributions would be welcome?