[ANE-2523] NuGet: analyze every .csproj in a directory

[zlav]

Overview

Discovery in src/Strategy/NuGet.hs used find isPackageRefFile files, which returned only the first matching project file per directory. Any directory containing multiple .csproj/.xproj/.vbproj/.dbproj/.fsproj files would silently drop all siblings — and if the surviving file had no dependencies, the directory looked empty in the FOSSA report. This PR switches to filter, mapping NuGetProject over every match.

Acceptance criteria

A directory with multiple project files now produces one NuGetProject per file. Single-project directories and the project.assets.json short-circuit branch are unchanged.

Testing plan

1. cabal test unit-tests --test-options="--match=NuGet" — 132 examples pass, including the new NuGet.NuGet discovery spec.
2. New unit fixture test/NuGet/testdata/multi-csproj/ contains two .csproj files; the new spec asserts both are discovered.
3. Integration: ServiceStack expected target count goes from 64 → 92 (every project file under v5.13.2: 91 .csproj + 1 .fsproj). 19 directories hold 2–3 sibling .csproj files (e.g. src/ServiceStack/{ServiceStack, ServiceStack.Core, ServiceStack.Source}.csproj for the .NET-Framework / .NET-Core / source-distribution variants); the old find isPackageRefFile picked one alphabetically and silently dropped the rest. The new count is every project file the bug was masking.

Risks

The integration tests in integration-test/Analysis/NugetSpec.hs (ServiceStack, dotnet-core-2.0-example, DapperAOT-CPM) assert literal target counts. If any of those fixtures contains a directory with multiple sibling .csproj files, the count goes up. Per the ticket: if those tests fail with higher counts, that's the bug being fixed — update the expected counts.

Metrics

N/A.

References

• ANE-2523 (support ticket TKT-12984)
• File changed: https://github.com/fossas/fossa-cli/blob/main/src/Strategy/NuGet.hs#L54

Checklist

• Tests added (test/NuGet/NuGetSpec.hs).
• No docs changes — docs/references/strategies/languages/dotnet/packagereference.md already documents the fixed behavior ("all NuGet project files").
• Changelog.md updated under 3.17.6.
• No subcommand option or schema changes.

[zlav]

@CodeRabbit review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

This PR enables NuGet package discovery to analyze all .csproj/.xproj/.vbproj/.dbproj/.fsproj files in a directory instead of stopping at the first match. The findProjects function in the NuGet strategy was modified to return all matching package-reference projects when project.assets.json is absent. A new test specification validates this behavior against a multi-project directory fixture. The changelog documents the change for version 3.17.6.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: switching NuGet discovery to analyze every .csproj file in a directory instead of just the first.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	PR description comprehensively follows the template structure with all major sections completed: Overview, Acceptance criteria, Testing plan, Risks, Metrics, References, and Checklist.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Changelog.md`:
- Line 7: Update the Changelog entry that starts "NuGet: PackageReference
discovery now analyzes every `.csproj`/`.xproj`/`.vbproj`/`.dbproj`/`.fsproj` in
a directory..." by appending the PR reference " (PR `#1712`)" to the end of that
line so it matches the existing entry style and provides traceability to PR
`#1712`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 22d7394e-b7f6-4213-8b74-eb5b32f93dab

📥 Commits

Reviewing files that changed from the base of the PR and between f44528b and cf5af6f.

📒 Files selected for processing (6)

• Changelog.md
• spectrometer.cabal
• src/Strategy/NuGet.hs
• test/NuGet/NuGetSpec.hs
• test/NuGet/testdata/multi-csproj/App.Core.csproj
• test/NuGet/testdata/multi-csproj/IngageWeb.csproj