Package analyzers always included, ignoring exclude settings

[natemcmaster]

NuGet provides the "ExcludeAssets" setting to allow excluding analyzers from packages. However, it appears the SDK still includes analyzers in the build even if excluded.

(cref https://docs.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#controlling-dependency-assets)

Repro

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <TargetFramework>netcoreapp2.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="15.0.0" />
    <PackageReference Include="xunit" Version="2.2.0" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.2.0" />

    <PackageReference Include="xunit.analyzers" Version="0.1.0" ExcludeAssets="analyzers" />

  </ItemGroup>

</Project>

using System;                              
using Xunit;                               
                                           
namespace test1                            
{                                          
    public class UnitTest1                 
    {                                      
        [Fact]                             
        public void Test1(string data) // this line intentionally trips an error in xunit.analyzers...just to prove the analyzer is running
        {                                  
        }                                  
    }                                      
}                                          

dotnet restore
dotnet build

Expected
The analyzer in xunit.analzyers/0.1.0/analyzers/dotnet/cs/xunit.analyzers.dll should not have been passed to CSC, and build succeeds.

Result

Build FAILED.

UnitTest1.cs(9,21): error xUnit1001: Fact methods cannot have parameters [C:\tmp\test1\test1.csproj]
    0 Warning(s)
    1 Error(s)

Details
Using dotnet.exe 2.0.0-preview2-006067

project.assets.json file contains:

{
  // ...
  "libraries": {
    "xunit.analyzers/0.1.0": {
      "sha512": "wPHthUmM0vdhL3lrTlyxJFfTgGh+2bkOn5CuxgZaPEMxLJArMCvUx8WmsVFeIATLVulVGvwNnZFkuwc0lsun7g==",
      "type": "package",
      "path": "xunit.analyzers/0.1.0",
      "files": [
        "analyzers/dotnet/cs/xunit.analyzers.dll",
        "tools/install.ps1",
        "tools/uninstall.ps1",
        "xunit.analyzers.0.1.0.nupkg.sha512",
        "xunit.analyzers.nuspec"
      ]
    }
  },
  // ...
  "project": {
    "frameworks": {
      "netcoreapp2.0": {
        "dependencies": {
          // ...
          "xunit.runner.visualstudio": {
            "target": "Package",
            "version": "2.2.0"
          },
          "xunit.analyzers": {
            "include": "Runtime, Compile, Build, Native, ContentFiles",
            "target": "Package",
            "version": "0.1.0"
          },
          // ...
        }
      }
    }
  }
}

[natemcmaster]

Ping @nguerrera. Still happening in 2.0.0-preview3-006609

cc @rrelyea

[natemcmaster]

cc @mikeharder

[Cryowatt]

This issue also occurs when a project includes a package that excludes analyzes from it's .nuspec. The solution ends up including the nested dependency analyzers and I get IDE1002 errors during the build.

[nguerrera]

Blocked by NuGet/Home#6279

[aidapsibr]

I'm encountering this in a conversion to the new SDK style projects. The change in behavior of transitive dependencies means that a single package with an analyzer is now breaking our builds as that analyzer is enforcing itself virally. When coupled with warn as error, this is a difficult problem to work around.

[davkean]

This is hit/referred to in these other issues:

dotnet/aspnetcore#11935
dotnet/efcore#18618
dotnet/roslyn#26222
Particular/NServiceBus.AmazonSQS#185

[nguerrera]

Still blocked by NuGet/Home#6279