[main] Remove unreferenced packages

[dotnet-sb-bot]

Removed the following packages which were detected as unreferenced:
humanizer.core/2.2.0
microsoft.bcl.asyncinterfaces/5.0.0
microsoft.codeanalysis.common/3.11.0
microsoft.codeanalysis.common/4.0.1
microsoft.codeanalysis.csharp.workspaces/3.11.0
microsoft.codeanalysis.csharp/3.11.0
microsoft.codeanalysis.csharp/4.0.1
microsoft.codeanalysis.visualbasic.workspaces/3.11.0
microsoft.codeanalysis.visualbasic/3.11.0
microsoft.codeanalysis.visualbasic/4.0.1
microsoft.codeanalysis.workspaces.common/3.11.0
system.composition.attributedmodel/1.0.31
system.composition.convention/1.0.31
system.composition.hosting/1.0.31
system.composition.runtime/1.0.31
system.composition.typedparts/1.0.31
system.io.pipelines/5.0.1

[MichaelSimons]

VMR Validation: dotnet/sdk#47172

[JoeRobich]

@ViktorHofer I am moving roslyn-analyzer projects into the roslyn repo (see dotnet/roslyn#77617) and am getting source build errors for the 3.11.0 and 4.0.1 M.CodeAnalysis packages. I believe we may need to revert part of this PR.

[ViktorHofer]

@JoeRobich this change is correct and shouldn't get reverted. Let me provide some details. When building the product from source, there are two build modes:

• The repo source-build mode which is in approximation and depends on transport/intermediate packages from dependent repos to consume live artifacts.
• The product source-build mode which builds all repositories inside the VMR (https://github.com/dotnet/dotnet) which uses either live artifacts from the (inner) repositories that build before the one in question or the N-1 artifacts (from the LKG build).

Roslyn-analyzers doesn't have a live dependency on roslyn when source-building in product mode: https://github.com/dotnet/dotnet/blob/main/repo-projects/roslyn-analyzers.proj#L13-L17. That's why the N-1 artifacts of Microsoft.CodeAnalysis should be used and not the live ones.

The problem with roslyn-analyzers that I fixed several weeks ago was that it didn't use the N-1 artifacts of Microsoft.CodeAnalysis* package dependencies when building the product source-build but a very old version: 3.11.*. That's what required the packages that got deleted in this PR in SBRP.

@ViktorHofer I copied your changes from dotnet/roslyn-analyzers#7560, but am still seeing .NETStandard 1.x errors. Do I need to add Microsoft.CodeAnalysis to the Version.Details?

Given that I see it in the roslyn-analyzers repo, I think so, yes: https://github.com/dotnet/roslyn-analyzers/blob/1e98fa3f107e780569a167a9250bb600778456dc/eng/Version.Details.xml#L4-L7

---

I think the actual problem in your PR is that in repo source-build mode, roslyn-analyzers projects bring netstandard1.x dependencies in as they use the old versions of Microsoft.CodeAnalysis. That's already the current state in the roslyn-analyzers repo and therefore expected for your repo migration. The difference that I see that probably explains the errors that you see in CI are:

• https://github.com/dotnet/roslyn/blob/878db64fd6db1fcf95dbcd80f8b4e8e98e8f4f6d/eng/Versions.props#L106-L107
• https://github.com/dotnet/roslyn-analyzers/blob/1e98fa3f107e780569a167a9250bb600778456dc/eng/Versions.props#L20-L21

DotNetBuildOrchestrator means that product build mode inside the VMR. You could define this property under src/RoslynAnalyzers via a Directory.Build.props file so that it applies only to the projects under that tree or you change roslyn's default value to the one from roslyn-analyzers.

So to summarize, roslyn-analyzers projects bring netstandard1.x dependencies in, in the repo source-build mode which is OK as I don't think there's a good way to avoid that today. In product source-build mode, live or N-1 dependencies must be used (including SBRP / SBE checked-in projects). Netstandard1.x references are disallowed.