test(manifest): cover the .NET review fixes

- Smoke-check that --include-configs filters the per-framework build
  context, that a failed restore never reads another project's assets from
  an earlier restore, and that a project outside the scan root is never
  excluded.
- Unit-test the SDK probe shared under one global.json and the cached
  solution listings, and follow isRootCovered, typed entry ordering and
  code-only NuGet classification.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: jfblaa

src/commands/manifest/cmd-manifest-dotnet.test.mts

@@ -25,7 +25,7 @@ describe('socket manifest dotnet', async () => {
             --bin               Location of the dotnet binary to use, default: dotnet on PATH
             --dotnet-opts       Additional options to pass on to \`dotnet restore\`, e.g. \`-p:Configuration=Release --configfile nuget.config\`. MSBuild properties among them also apply to project evaluation
             --exclude-configs   Comma-separated glob patterns; target frameworks matching any pattern are skipped (applied after --include-configs)
-            --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project.
+            --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags. An excluded JVM build module is not analysed as a project of its own, but where a project that is not excluded depends on it, its code is analysed as part of that project. A build module outside CWD cannot be excluded.
             --ignore-unresolved  Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)
             --include-configs   Comma-separated glob patterns matched against target frameworks (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only target frameworks matching at least one pattern are read, e.g. \`net8.0\`. A runtime-specific target (\`net8.0/win-x64\`) also matches its framework. Default: every target framework
             --verbose           Print debug messages

src/commands/manifest/discover-manifest-roots.test.mts

@@ -8,7 +8,7 @@ import {
   buildRootPath,
   findBuildToolCandidates,
   isBuildRootCovered,
-  isSolutionCovered,
+  isRootCovered,
   sortByDepthThenPath,
 } from './discover-manifest-roots.mts'
 import { testPath } from '../../../test/utils.mts'
@@ -301,6 +301,7 @@ describe('sortByDepthThenPath', () => {
           { dir: '/repo', entryFile: 'App.sln' },
         ],
         '/repo',
+        'dotnet',
       ),
     ).toEqual([
       { dir: '/repo', entryFile: 'App.sln' },
@@ -322,22 +323,24 @@ async function failToList(): Promise<string[]> {
   throw new Error('listed')
 }
 
-describe('isSolutionCovered', () => {
+describe('isRootCovered', () => {
   const root = { dir: '/repo', entryFile: 'App.slnx' }
 
   it('covers a solution once every project it builds is covered', async () => {
     const covered = new Set(['/repo/src/A/A.csproj', '/repo/src/B/B.csproj'])
     expect(
-      await isSolutionCovered(
+      await isRootCovered(
         covered,
+        'dotnet',
         root,
         {},
         listing(['/repo/src/A/A.csproj', '/repo/src/B/B.csproj']),
       ),
     ).toBe(true)
     expect(
-      await isSolutionCovered(
+      await isRootCovered(
         covered,
+        'dotnet',
         root,
         {},
         listing(['/repo/src/A/A.csproj', '/repo/src/C/C.csproj']),
@@ -354,25 +357,28 @@ describe('isSolutionCovered', () => {
       const slnxUnreadable = async ({ entryFile }: { entryFile?: string }) =>
         entryFile?.endsWith('.slnx') ? undefined : []
       expect(
-        await isSolutionCovered(
+        await isRootCovered(
           covered,
+          'dotnet',
           { dir, entryFile: 'App.slnx' },
           {},
           slnxUnreadable,
         ),
       ).toBe(true)
       // Also before anything is covered, e.g. when the twin built nothing.
       expect(
-        await isSolutionCovered(
+        await isRootCovered(
           new Set(),
+          'dotnet',
           { dir, entryFile: 'App.slnx' },
           {},
           slnxUnreadable,
         ),
       ).toBe(true)
       expect(
-        await isSolutionCovered(
+        await isRootCovered(
           covered,
+          'dotnet',
           { dir, entryFile: 'Other.slnx' },
           {},
           slnxUnreadable,
@@ -390,7 +396,13 @@ describe('isSolutionCovered', () => {
       await fs.writeFile(path.join(dir, 'App.slnx'), '')
       const covered = await Promise.all(
         ['App.sln', 'App.slnx'].map(entryFile =>
-          isSolutionCovered(new Set(), { dir, entryFile }, {}, unreadable),
+          isRootCovered(
+            new Set(),
+            'dotnet',
+            { dir, entryFile },
+            {},
+            unreadable,
+          ),
         ),
       )
       expect(covered).toEqual([false, false])
@@ -401,18 +413,20 @@ describe('isSolutionCovered', () => {
 
   it('lists no members while nothing is covered and no twin exists, or for a project or a POM', async () => {
     const list = failToList
-    expect(await isSolutionCovered(new Set(), root, {}, list)).toBe(false)
+    expect(await isRootCovered(new Set(), 'dotnet', root, {}, list)).toBe(false)
     expect(
-      await isSolutionCovered(
+      await isRootCovered(
         new Set(['/x']),
+        'dotnet',
         { dir: '/repo', entryFile: 'A.csproj' },
         {},
         list,
       ),
     ).toBe(false)
     expect(
-      await isSolutionCovered(
+      await isRootCovered(
         new Set(['/x']),
+        'maven',
         { dir: '/repo', entryFile: 'pom.xml' },
         {},
         list,

src/commands/manifest/scripts/resolution-report-nuget.test.mts

@@ -14,7 +14,7 @@ describe('classifyNugetFailure', () => {
       'repository-or-network',
     ],
     [
-      'Response status code does not indicate success: 401 (Unauthorized).',
+      'NU1301: Unable to load the service index for source https://feed/index.json. Response status code does not indicate success: 401 (Unauthorized).',
       'repository-or-network',
     ],
     [
@@ -35,15 +35,15 @@ describe('classifyNugetFailure', () => {
     ],
     [
       'could not evaluate the project: The imported project "x.props" was not found.',
-      'config-problem',
+      'other',
     ],
     [
       'the design-time build failed: MSB3644: The reference assemblies for .NETFramework,Version=v4.8 were not found.',
       'config-problem',
     ],
     [
       'obj/project.assets.json belongs to B.csproj: the projects share an intermediate output directory, so restore output cannot be attributed',
-      'config-problem',
+      'other',
     ],
     [
       'runtime assemblies restore listed are missing from the package folders (lib/net8.0/Foo.dll); re-run `dotnet restore`',

src/commands/manifest/scripts/run.test.mts

@@ -18,12 +18,16 @@ vi.mock('@socketsecurity/registry/lib/spawn', () => ({
   spawn: vi.fn(async () => ({ code: 0, stderr: '', stdout: '' })),
 }))
 // The Maven extension jar and the dotnet tool exist only in a built checkout.
+// Each dotnetDir() case pins its own SDK, so cases never share a probe.
 vi.mock('node:fs', async importOriginal => {
   const actual = await importOriginal<typeof import('node:fs')>()
   return {
     ...actual,
     existsSync: (p: string) =>
-      p.endsWith('.jar') || p.endsWith('.dll') || actual.existsSync(p),
+      p.endsWith('.jar') ||
+      p.endsWith('.dll') ||
+      /[\\/]repo[\\/]dotnet-\d+[\\/]global\.json$/.test(p) ||
+      actual.existsSync(p),
   }
 })
 
@@ -162,8 +166,12 @@ function mockDotnet(sdk: string, records = '', code = 0): void {
   }) as any)
 }
 
+function toolCalls() {
+  return vi.mocked(spawn).mock.calls.filter(c => c[1]?.[0] !== '--version')
+}
+
 function toolCall() {
-  return vi.mocked(spawn).mock.calls.find(c => c[1]?.[0] !== '--version')
+  return toolCalls()[0]
 }
 
 describe('dotnet tool invocation', () => {
@@ -277,6 +285,20 @@ describe('skipWithoutDotnetSdk', () => {
     mockDotnet('8.0.414')
     expect(await skipWithoutDotnetSdk('dotnet', dotnetDir())).toBe(false)
   })
+
+  it('probes the SDK once per global.json', async () => {
+    const pinned = dotnetDir()
+    mockDotnet('8.0.414')
+    for (const dir of ['a', path.join('b', 'c')]) {
+      // eslint-disable-next-line no-await-in-loop
+      expect(await skipWithoutDotnetSdk('dotnet', path.join(pinned, dir))).toBe(
+        false,
+      )
+    }
+    expect(
+      vi.mocked(spawn).mock.calls.filter(c => c[1]?.[0] === '--version'),
+    ).toHaveLength(1)
+  })
 })
 
 function solutionOpts(projectDir: string) {
@@ -311,4 +333,13 @@ describe('listDotnetEntryProjects', () => {
     mockDotnet('8.0.414', 'member\tsrc/A/A.csproj\n', 1)
     expect(await listDotnetEntryProjects(solutionOpts(dotnetDir()))).toEqual([])
   })
+
+  it('lists an entry once for the same options', async () => {
+    const opts = solutionOpts(dotnetDir())
+    mockDotnet('8.0.414', 'member\tsrc/A/A.csproj\n')
+    await listDotnetEntryProjects(opts)
+    await listDotnetEntryProjects({ ...opts })
+    await listDotnetEntryProjects({ ...opts, excludePaths: ['src/A'] })
+    expect(toolCalls()).toHaveLength(2)
+  })
 })

src/commands/manifest/scripts/test/dotnet-compat/assert-facts.py

@@ -177,6 +177,18 @@ def records_phase():
     analyzers = {r[4] for r in info_rows(basic, 'src/Lib/Lib.csproj', 'Analyzer', 'net6.0')}
     check(any('demo.ext.analyzer' in p.lower() for p in analyzers), f'analyzers {analyzers}')
 
+    netstandard = records('basic-netstandard.tsv')
+    built = {(r[1], r[3]) for r in netstandard if r[0] == 'projectSrc'}
+    built |= {(r[1], r[2]) for r in netstandard if r[0] == 'projectInfo'}
+    check(built and {c for _, c in built} == {'netstandard2.0'}, f'builds outside --include-configs {sorted(built)}')
+
+    stale = records('basic-stale.tsv')
+    check(any(r[0] == 'failure' and 'Demo.Ext.DoesNotExist' in '\t'.join(r) for r in stale), 'failed restore reported')
+    reused = {r[2] for r in stale if r[0] == 'root'} - {'test/App.Tests/App.Tests.csproj'}
+    check(not reused, f'projects read from a previous restore {sorted(reused)}')
+    unknown = {r[3] for r in stale if r[0] == 'unscannable' and 'did not restore this project' in r[2]}
+    check({'src/App/App.csproj', 'src/Extra/Extra.csproj', 'src/Lib/Lib.csproj'} <= unknown, f'unrestored projects reported {sorted(unknown)}')
+
     designtime = records('designtime.tsv')
     failed = [r for r in designtime if r[0] == 'failure' and 'the design-time build failed' in r[2]]
     check(len(failed) == 1 and 'generated sources unavailable' in failed[0][2], f'design-time failure {failed}')

src/commands/manifest/scripts/test/dotnet-compat/smoke-test-exclude-base.sh

@@ -3,7 +3,8 @@
 # the build root: a `../shared` project outside the build root is excluded by
 # its scan-root path, and a nested project by the build root's path in the scan
 # root, both from the projects --workspaces follows and from the solution
-# members --members lists.
+# members --members lists. A project outside the scan root is never excluded,
+# even by a wildcard that would match its `../` path.
 #
 # Usage: smoke-test-exclude-base.sh <dotnet> [sdk-version]
 set -euo pipefail
@@ -22,9 +23,12 @@ echo "+ dotnet SDK $SDK_VERSION (exclude base)"
 
 # The project names --workspaces keeps, or the member paths --members lists.
 kept() {
-  local mode="$1" entry="$2" pattern="$3"
+  local mode="$1" entry="$2" pattern="$3" base="${4:-$SCAN_ROOT}"
+  rm -f "$WORK/records.tsv"
   run_tool "$SCAN_ROOT/app" --records "$WORK/records.tsv" --entry "$entry" \
-    "--$mode" --exclude-paths "$pattern" --exclude-base "$SCAN_ROOT"
+    "--$mode" --exclude-paths "$pattern" --exclude-base "$base"
+  # A run that wrote no records keeps nothing, which check reports.
+  [ -f "$WORK/records.tsv" ] || return 0
   if [ "$mode" = workspaces ]; then
     awk -F'\t' '$1 == "project" { print $4 }' "$WORK/records.tsv"
   else
@@ -33,9 +37,9 @@ kept() {
 }
 check() {
   local got
-  got="$(kept "$@")"
+  got="$(kept "$1" "$2" "$3" "${5:-}")"
   if [ "$got" != "$4" ]; then
-    echo "FAIL: --$1 of $2 excluding $3 kept [$got], want [$4]" >&2
+    echo "FAIL: --$1 of $2 excluding $3 from ${5:-$SCAN_ROOT} kept [$got], want [$4]" >&2
     exit 1
   fi
 }
@@ -46,4 +50,7 @@ check workspaces App.csproj '^(?:core)(?:/.*)?$' 'App Core Shared '
 check members App.sln '^(?:shared)(?:/.*)?$' 'App.csproj core/Core.csproj '
 check members App.sln '^(?:app/core)(?:/.*)?$' '../shared/Shared.csproj App.csproj '
 check members App.sln '^(?:core)(?:/.*)?$' '../shared/Shared.csproj App.csproj core/Core.csproj '
-echo "PASS: projects inside and outside the build root are excluded by their scan-root paths"
+# `**/shared`, scanned from app: ../shared is outside the scan root.
+check workspaces App.csproj '^(?:(?:[^/]+/)*shared)(?:/.*)?$' 'App Core Shared ' "$SCAN_ROOT/app"
+check members App.sln '^(?:(?:[^/]+/)*shared)(?:/.*)?$' '../shared/Shared.csproj App.csproj core/Core.csproj ' "$SCAN_ROOT/app"
+echo "PASS: projects are excluded by their scan-root paths, never outside the scan root"

src/commands/manifest/scripts/test/dotnet-compat/smoke-test.sh

@@ -97,8 +97,9 @@ python3 "$HERE/assert-facts.py" "$WORK" "$SDK_VERSION" "$CPM_ENTRY" ignore-unres
 
 # --with-files: the records the reachability sidecar is built from.
 records() {
-  run_tool "$(dirname "$1")" --records "$2" --entry "$1" --with-files
+  run_tool "$(dirname "$1")" --records "$2" --entry "$1" --with-files "${@:3}"
 }
+records "$WORK/basic/Basic.sln" "$WORK/basic-netstandard.tsv" --include-configs netstandard2.0
 records "$WORK/basic/Basic.sln" "$WORK/basic.tsv"
 records "$WORK/langs/Vb/Vb.vbproj" "$WORK/langs.tsv"
 records "$WORK/failures/designtime/DesignTime.csproj" "$WORK/designtime.tsv"
@@ -112,6 +113,17 @@ for pkg_id, version, folder in (('Demo.Ext.Tool', '1.0.0', '1.0.0'), ('Demo.Ext.
     zipfile.ZipFile(nupkg).extractall(os.path.join(work, 'packages-config', 'packages', f'{pkg_id}.{folder}'))
 PY
 records "$WORK/packages-config/Mixed.sln" "$WORK/pc-present.tsv"
+# A restore failing in one project leaves the others' caches as the last
+# restore wrote them, which cannot show they are current.
+python3 - "$WORK/basic/test/App.Tests/App.Tests.csproj" <<'PY'
+import sys
+path = sys.argv[1]
+with open(path) as f:
+    project = f.read()
+with open(path, 'w') as f:
+    f.write(project.replace('</Project>', '<ItemGroup><PackageReference Include="Demo.Ext.DoesNotExist" Version="1.0.0" /></ItemGroup></Project>'))
+PY
+records "$WORK/basic/Basic.sln" "$WORK/basic-stale.tsv"
 python3 "$HERE/assert-facts.py" "$WORK" "$SDK_VERSION" "$CPM_ENTRY" records
 
 echo "dotnet compat smoke test passed: SDK $SDK_VERSION"