fix: restore SourceLink and deterministic builds in published packages

[thomhurst]

Summary

• Remove explicit Microsoft.SourceLink.GitHub GlobalPackageReference; rely on SDK 10's implicit SourceLink SDK instead
• Fixes published .nupkg/.snupkg showing "No Source Link" and "Non deterministic" in NuGet Package Explorer

Root cause

The GlobalPackageReference "Microsoft.SourceLink.GitHub" PrivateAssets="all" made NuGet:

1. Restore Common + Build.Tasks.Git transitively as buildTransitive/_._ (empty marker — developmentDependency packages don't flow through private refs)
2. Still set PkgMicrosoft_SourceLink_Common path property

Microsoft.NET.Sdk.SourceLink.props then flips SuppressImplicitGitSourceLink=true, skipping SDK-bundled Common/Build.Tasks.Git imports. Only Microsoft.SourceLink.GitHub.targets imported → LocateRepository task and InitializeSourceControlInformationFromSourceControlManager target never ran → @(SourceRoot) empty → no SourceLink JSON generated, no PathMap normalization, non-deterministic paths in PE.

Fix

Delete the GlobalPackageReference. .NET 10 SDK bundles SourceLink at $(DotnetRoot)/sdk/<ver>/Sdks/Microsoft.SourceLink.*. With no NuGet ref, PkgMicrosoft_SourceLink_Common stays empty, suppression doesn't fire, SDK auto-imports all three (Common + Build.Tasks.Git + GitHub).

Test plan

• MSBuild preprocess (-pp) shows SDK's implicit imports activating (InitializeSourceControlInformationFromSourceControlManager, LocateRepository, GenerateSourceLinkFile)
• obj/*/TUnit.Core.sourcelink.json generated with {"/_/*":"https://raw.githubusercontent.com/thomhurst/TUnit/<sha>/*"}
• Built TUnit.Core + TUnit.Assertions × {netstandard2.0, net8.0, net9.0, net10.0}: each DLL has Reproducible debug entry, each PDB has SourceLink CDI (cc110556-a091-4d38-9fec-25ab9a351a6a)
• CI build produces packages that pass "Source Link" and "Deterministic" checks in NuGet Package Explorer

[claude]

Code Review

Summary

This is a minimal, well-reasoned fix: a 3-line deletion that removes the explicit GlobalPackageReference for Microsoft.SourceLink.GitHub and relies on the .NET 10 SDK's implicit SourceLink integration instead.

Analysis

The root cause diagnosis in the PR description is accurate and thorough. The suppression chain is:

1. GlobalPackageReference with PrivateAssets="all" causes NuGet to resolve PkgMicrosoft_SourceLink_Common
2. Microsoft.NET.Sdk.SourceLink.props detects the non-empty property and sets SuppressImplicitGitSourceLink=true
3. Only Microsoft.SourceLink.GitHub.targets gets imported — without Common + Build.Tasks.Git, LocateRepository never runs
4. Empty @(SourceRoot) → no SourceLink JSON → no PathMap normalization → non-deterministic PEs

Removing the NuGet reference keeps PkgMicrosoft_SourceLink_Common empty, suppression never fires, and the SDK's bundled SourceLink takes over cleanly.

Prerequisites correctly in place

Directory.Build.props already has the required companion properties:

• PublishRepositoryUrl=true — embeds the repo URL in the package metadata
• EmbedUntrackedSources=true — includes files not tracked by Git in the PDB
• ContinuousIntegrationBuild=true — enables deterministic source paths on CI
• SymbolPackageFormat=snupkg — publishes symbols as a separate .snupkg

Nothing else needs changing.

SDK version lock is appropriate

global.json pins 10.0.202 (with rollForward: latestMajor), matching the version of the removed GlobalPackageReference. The implicit SourceLink support has been available since SDK 8.0.2xx, so this is safe across the project's target frameworks (net8.0 / net9.0 / net10.0).

One consideration worth noting

The PrivateAssets="all" on the removed reference meant the SourceLink package was a development-only dependency and never leaked into consumers' dependency graphs — the SDK-bundled approach behaves the same way, so there's no regression there.

Verdict

The fix is correct, minimal, and well-documented. The PR description contains more explanation than the diff, which is exactly right for a build-tooling change like this. No issues found.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}