Investigate the need for cssparser in source-build

[MichaelSimons]

cssparser no longer appears to be needed in source-build. The 5.0.204 tarball builds offline and tests pass with cssparser removed.

This was discovered as part of ArPow while investigating/defining the repo dependency graph. This issue is intended to be used to research this and log any follow-up issues per the findings.

[omajid]

cssparser was required by ASP.NET Core (razor, in particular): #1814

https://github.com/dotnet/aspnetcore/blob/release/5.0/src/Razor/Microsoft.AspNetCore.Razor.Tools/src/rzc.csproj still has a dependency on it:

    <ExcludeFromSourceBuild>false<ExcludeFromSourceBuild>
 
  <ItemGroup>
    <Reference Include="Microsoft.CodeAnalysis.Razor" />
    <Reference Include="Microsoft.Css.Parser" />
    <Reference Include="Newtonsoft.Json" />
  </ItemGroup>

[MichaelSimons]

aspnetcore pull request that introduced the dependency - dotnet/aspnetcore#23657

This was refactored to be version agnostic in https://github.com/dotnet/aspnetcore/pull/24136/files#diff-a1101ac616ef1ed07d7e31509e84668b39843b26da6c506eea37e06659b54491. A possible reason the 5.0.204 tarball still builds is because the reference is picked up from the previously source-build artifacts.

This project however does not exist in 6.0. It appears to have been moved to the SDK repo - https://github.com/dotnet/sdk/blob/main/src/RazorSdk/Tool/Microsoft.NET.Sdk.Razor.Tool.csproj#L31. This implies the dependency should be moved from aspnetcore to the sdk. It also appears that this aspnetcore versions property can get cleaned up - https://github.com/dotnet/aspnetcore/blob/main/eng/Versions.props#L192

[omajid]

A possible reason the 5.0.204 tarball still builds is because the reference is picked up from the previously source-build artifacts.

Ouch. That means we can accidentally use "prebuilts" instead of building things ourselves :( I thought we were using techniques like poisoning to avoid this? Is there an issue tracking this bug?

[MichaelSimons]

Here are the two PRs in which the Razor SDK was moved from aspnetcore to the sdk.

aspnetcore - dotnet/aspnetcore#29548
sdk - dotnet/sdk#15248

[MichaelSimons]

A possible reason the 5.0.204 tarball still builds is because the reference is picked up from the previously source-build artifacts.

Ouch. That means we can accidentally use "prebuilts" instead of building things ourselves :( I thought we were using techniques like poisoning to avoid this? Is there an issue tracking this bug?

@crummel - can you answer this?

[crummel]

I believe we didn't consider previously-source-built packages as "external", so those aren't poisoned or considered prebuilts. I thought of a couple more scenarios where this could happen wouldn't be caught by our current checks so I logged #2222 - the idea being to add a check that we don't stop producing any packages without knowing about it.

[MichaelSimons]

Closing as the dependency has simply moved as noted in the conversation.