.NET 8: Tracking issue for repos specifying and regularly updating their dependencies.

[mmitche]

Description

This is a repo tracking issue related to #2979. Repositories should:

• Specify all dependencies produced by source-built repositories in their eng/Version.Details.xml files. They need only specify dependencies for repos that are produced earlier in source build.

They should then either:

• Add dependency flow that regularly updates these dependencies to latest or
• Pin these dependencies and provide justification as to why these should not be updated. These cases will require a new reference package be added to https://github.com/dotnet/source-build-reference-packages.

Repositories

• Specify all source-built dependencies and ensure they are regularly updated arcade#10576
• Specify all source-built dependencies and ensure they are regularly updated aspnetcore#43530
• Specify all source-built dependencies and ensure they are regularly updated command-line-api#1825
• Specify all source-built dependencies and ensure they are regularly updated deployment-tools#215
• Specify all source-built dependencies and ensure they are regularly updated diagnostics#3326
• Specify all source-built dependencies and ensure they are regularly updated format#1699
• Specify all source-built dependencies and ensure they are regularly updated fsharp#13804
• Specify all source-built dependencies and ensure they are regularly updated installer#14415
• Specify all source-built dependencies and ensure they are regularly updated linker#3007
• llvm-project - Specify all source-built dependencies and ensure they are regularly updated runtime#74764
• Specify all source-built dependencies and ensure they are regularly updated msbuild#7921
• Specify all source-built dependencies and ensure they are regularly updated NuGet/Home#12061
• Specify all source-built dependencies and ensure they are regularly updated razor#7073
• Specify all source-built dependencies and ensure they are regularly updated roslyn-analyzers#6131
• Specify all source-built dependencies and ensure they are regularly updated roslyn#63645
• runtime - Specify all source-built dependencies and ensure they are regularly updated runtime#74765
• Specify all source-built dependencies and ensure they are regularly updated sdk#27532
• Specify all source-built dependencies and ensure they are regularly updated sourcelink#864
• Specify all source-built dependencies and ensure they are regularly updated symreader#264
• Specify all source-built dependencies and ensure they are regularly updated templating#5177
• Specify all source-built dependencies and ensure they are regularly updated test-templates#245
• Specify all source-built dependencies and ensure they are regularly updated microsoft/vstest#3980
• Specify all source-built dependencies and ensure they are regularly updated xdt#461
• Specify all source-built dependencies and ensure they are regularly updated xliff-tasks#660

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[mmitche]

@MichaelSimons is this assertion correct?

They need only specify dependencies for repos that are produced earlier in source build

[MichaelSimons]

They need only specify dependencies for repos that are produced earlier in source build

To avoid confusion, it is really for any dependencies produced in source-build. Because there a cycles in the graph, a dependency could be built after. In that case, the dependency gets satisfied by previous source-built artifacts. Even if that is the case, we are building with a recent version and we would like to avoid pinned references in those cases.

[mmitche]

They need only specify dependencies for repos that are produced earlier in source build

To avoid confusion, it is really for any dependencies produced in source-build. Because there a cycles in the graph, a dependency could be built after. In that case, the dependency gets satisfied by previous source-built artifacts. Even if that is the case, we are building with a recent version and we would like to avoid pinned references in those cases.

We do need to avoid product dependency cycles in order to not break the current official build and staging process. We can have cycles for toolset dependencies, but not for product dependencies. Do you have an example of one of these that exists today that we can analyze a bit?

[mmitche]

@MichaelSimons I believe I have all the child issues opened for this work

[MichaelSimons]

@mmitche - I believe this was done as part of #3043. Can this and all related issues be closed?

[mmitche]

Yep, that and the prebuilt detection work.