assets file lists a dependency for a package that isn't included #14698
Description
NuGet Product Used
dotnet.exe
Product Version
10.0.1xx SDK
Worked before?
No response
Impact
It bothers me. A fix would be nice
Repro Steps & Context
Using the https://github.com/dotnet/sdk repo on the release/10.0.2xx branch (my current commit is 583915c878df4160a31c5fe2db73c65b4dcb9b70, in case that turns out to be important), if I restore project src\Tasks\Microsoft.NET.Build.Tasks\Microsoft.NET.Build.Tasks.csproj, the assets file is created at artifacts\obj\Sdks\Microsoft.NET.Sdk\tools\project.assets.json.
The assets file says that the referenced project Microsoft.Dotnet.ApiSymbolExtensions has a dependency on Microsoft.CodeAnalysis.CSharp, but that package is nowhere to be seen in the assets file. Not in either of the project's targets, not in the libraries section.
The command "dotnet msbuild -getItem:PackageReference .\src\Compatibility\Microsoft.DotNet.ApiSymbolExtensions\Microsoft.DotNet.ApiSymbolExtensions.csproj" shows the PackageReference has "ExcludeAssets": "Runtime", but unless I'm missing something, I don't see PrivateAssets, or overriding NuGet's default IncludeAssets.
When I create a test solution to try to reproduce this issue, I can't. Using ExcludeAssets=runtime in the child project, the parent project gets the package in the assets file's targets and libraries. If I set PrivateAssets=all, then the parent project doesn't even list the package as the child project's dependency. I also tried enabling CPM and transitive pinning, but it still has the same outcome.
Given that the simple tests show that private package references in project references don't get listed as dependencies, then I assume the intent is that the assets file should be internally consistent. I haven't yet been able to figure out why the dotnet/sdk repo has this output where it lists a dependency but doesn't actually restore it.
This causes problems for any tooling that processes the assets file and assumes it's internally consistent. For example, I'm working on dotnet nuget why, and when testing the changes for this PR, I found my changes crash: NuGet/NuGet.Client#7017
I now need to remove input validation checks because restore is writing this dependency without including it as a library.
This is happening with both the "new" and legacy restore algorithms.