dependabot-nuget 0.291.0 → 0.293.0

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/AnalyzeWorker.cs

@@ -7,6 +7,7 @@ using NuGet.Frameworks;
 using NuGet.Versioning;
 
 using NuGetUpdater.Core.Discover;
+using NuGetUpdater.Core.Run.ApiModel;
 
 namespace NuGetUpdater.Core.Analyze;
 
@@ -16,6 +17,7 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 {
     public const string AnalysisDirectoryName = "./.dependabot/analysis";
 
+    private readonly string _jobId;
     private readonly ExperimentsManager _experimentsManager;
     private readonly ILogger _logger;
 
@@ -25,8 +27,9 @@ public partial class AnalyzeWorker : IAnalyzeWorker
         Converters = { new JsonStringEnumConverter(), new RequirementArrayConverter() },
     };
 
-    public AnalyzeWorker(ExperimentsManager experimentsManager, ILogger logger)
+    public AnalyzeWorker(string jobId, ExperimentsManager experimentsManager, ILogger logger)
     {
+        _jobId = jobId;
         _experimentsManager = experimentsManager;
         _logger = logger;
     }
@@ -48,15 +51,11 @@ public partial class AnalyzeWorker : IAnalyzeWorker
         {
             analysisResult = await RunAsync(repoRoot, discovery, dependencyInfo);
         }
-        catch (HttpRequestException ex)
-        when (ex.StatusCode == HttpStatusCode.Unauthorized || ex.StatusCode == HttpStatusCode.Forbidden)
+        catch (Exception ex)
         {
-            var localPath = PathHelper.JoinPath(repoRoot, discovery.Path);
-            using var nugetContext = new NuGetContext(localPath);
             analysisResult = new AnalysisResult
             {
-                ErrorType = ErrorType.AuthenticationFailure,
-                ErrorDetails = "(" + string.Join("|", nugetContext.PackageSources.Select(s => s.Source)) + ")",
+                Error = JobErrorBase.ErrorFromException(ex, _jobId, PathHelper.JoinPath(repoRoot, discovery.Path)),
                 UpdatedVersion = string.Empty,
                 CanUpdate = false,
                 UpdatedDependencies = [],
@@ -68,6 +67,8 @@ public partial class AnalyzeWorker : IAnalyzeWorker
 
     public async Task<AnalysisResult> RunAsync(string repoRoot, WorkspaceDiscoveryResult discovery, DependencyInfo dependencyInfo)
     {
+        MSBuildHelper.RegisterMSBuild(repoRoot, repoRoot);
+
         var startingDirectory = PathHelper.JoinPath(repoRoot, discovery.Path);
 
         _logger.Info($"Starting analysis of {dependencyInfo.Name}...");
@@ -412,6 +413,7 @@ public partial class AnalyzeWorker : IAnalyzeWorker
             .SelectMany(p => p.TargetFrameworks)
             .Select(NuGetFramework.Parse)
             .Distinct()
+            .Select(f => f.GetShortFolderName())
             .ToImmutableArray();
 
         // When updating peer dependencies, we only need to consider top-level dependencies.

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/DependencyFinder.cs

@@ -7,10 +7,10 @@ namespace NuGetUpdater.Core.Analyze;
 
 internal static class DependencyFinder
 {
-    public static async Task<ImmutableDictionary<NuGetFramework, ImmutableArray<Dependency>>> GetDependenciesAsync(
+    public static async Task<ImmutableDictionary<string, ImmutableArray<Dependency>>> GetDependenciesAsync(
         string repoRoot,
         string projectPath,
-        IEnumerable<NuGetFramework> frameworks,
+        IEnumerable<string> frameworks,
         ImmutableHashSet<string> packageIds,
         NuGetVersion version,
         NuGetContext nugetContext,
@@ -23,13 +23,13 @@ internal static class DependencyFinder
             .Select(id => new Dependency(id, versionString, DependencyType.Unknown))
             .ToImmutableArray();
 
-        var result = ImmutableDictionary.CreateBuilder<NuGetFramework, ImmutableArray<Dependency>>();
+        var result = ImmutableDictionary.CreateBuilder<string, ImmutableArray<Dependency>>();
         foreach (var framework in frameworks)
         {
             var dependencies = await MSBuildHelper.GetAllPackageDependenciesAsync(
                 repoRoot,
                 projectPath,
-                framework.ToString(),
+                framework,
                 packages,
                 experimentsManager,
                 logger);

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/Extensions.cs

@@ -7,7 +7,7 @@ using NuGetUpdater.Core;
 
 internal static class Extensions
 {
-    public static ImmutableArray<Dependency> GetDependencies(this ImmutableDictionary<NuGetFramework, ImmutableArray<Dependency>> dependenciesByTfm)
+    public static ImmutableArray<Dependency> GetDependencies(this ImmutableDictionary<string, ImmutableArray<Dependency>> dependenciesByTfm)
     {
         Dictionary<string, Dependency> dependencies = [];
         foreach (var (_framework, dependenciesForTfm) in dependenciesByTfm)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Analyze/RequirementConverter.cs

@@ -7,7 +7,25 @@ public class RequirementConverter : JsonConverter<Requirement>
 {
     public override Requirement? Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
     {
-        return Requirement.Parse(reader.GetString()!);
+        if (reader.TokenType != JsonTokenType.String)
+        {
+            throw new BadRequirementException($"Expected token type {nameof(JsonTokenType.String)}, but found {reader.TokenType}.");
+        }
+
+        var text = reader.GetString();
+        if (text is null)
+        {
+            throw new BadRequirementException("Unexpected null token.");
+        }
+
+        try
+        {
+            return Requirement.Parse(text);
+        }
+        catch
+        {
+            throw new BadRequirementException(text);
+        }
     }
 
     public override void Write(Utf8JsonWriter writer, Requirement value, JsonSerializerOptions options)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/BadRequirementException.cs

@@ -0,0 +1,9 @@
+namespace NuGetUpdater.Core;
+
+internal class BadRequirementException : Exception
+{
+    public BadRequirementException(string details)
+        : base(details)
+    {
+    }
+}

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Clone/CloneWorker.cs

@@ -9,23 +9,49 @@ namespace NuGetUpdater.Core.Clone;
 
 public class CloneWorker
 {
+    private readonly string _jobId;
     private readonly IApiHandler _apiHandler;
     private readonly IGitCommandHandler _gitCommandHandler;
-    private readonly ILogger _logger;
 
-    public CloneWorker(IApiHandler apiHandler, IGitCommandHandler gitCommandHandler, ILogger logger)
+    public CloneWorker(string jobId, IApiHandler apiHandler, IGitCommandHandler gitCommandHandler)
     {
+        _jobId = jobId;
         _apiHandler = apiHandler;
         _gitCommandHandler = gitCommandHandler;
-        _logger = logger;
     }
 
     // entrypoint for cli
     public async Task<int> RunAsync(FileInfo jobFilePath, DirectoryInfo repoContentsPath)
     {
         var jobFileContent = await File.ReadAllTextAsync(jobFilePath.FullName);
-        var jobWrapper = RunWorker.Deserialize(jobFileContent);
-        var result = await RunAsync(jobWrapper.Job, repoContentsPath.FullName);
+
+        // only a limited set of errors can occur here
+        JobFile? jobFile = null;
+        JobErrorBase? parseError = null;
+        try
+        {
+            jobFile = RunWorker.Deserialize(jobFileContent);
+            if (jobFile is null)
+            {
+                parseError = new UnknownError(new Exception("Job file could not be deserialized"), _jobId);
+            }
+        }
+        catch (BadRequirementException ex)
+        {
+            parseError = new BadRequirement(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            parseError = new UnknownError(ex, _jobId);
+        }
+
+        if (parseError is not null)
+        {
+            await ReportError(parseError);
+            return 1;
+        }
+
+        var result = await RunAsync(jobFile!.Job, repoContentsPath.FullName);
         return result;
     }
 
@@ -44,23 +70,29 @@ public class CloneWorker
         catch (HttpRequestException ex)
         when (ex.StatusCode == HttpStatusCode.Unauthorized || ex.StatusCode == HttpStatusCode.Forbidden)
         {
+            // this is a _very_ specific case we want to handle before the common error handling kicks in
             error = new JobRepoNotFound(ex.Message);
         }
         catch (Exception ex)
         {
-            error = new UnknownError(ex.ToString());
+            error = JobErrorBase.ErrorFromException(ex, _jobId, repoContentsPath);
         }
 
         if (error is not null)
         {
-            await _apiHandler.RecordUpdateJobError(error);
-            await _apiHandler.MarkAsProcessed(new("unknown"));
+            await ReportError(error);
             return 1;
         }
 
         return 0;
     }
 
+    private async Task ReportError(JobErrorBase error)
+    {
+        await _apiHandler.RecordUpdateJobError(error);
+        await _apiHandler.MarkAsProcessed(new("unknown"));
+    }
+
     internal static CommandArguments[] GetAllCommandArgs(Job job, string repoContentsPath)
     {
         var commandArgs = new List<CommandArguments>()

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/DependencyDiscovery.targets

@@ -1,9 +1,9 @@
 <Project>
   <Import Project="DependencyDiscovery.props" />
 
-  <Target Name="_DiscoverDependencies" DependsOnTargets="GenerateBuildDependencyFile;ResolvePackageAssets">
+  <Target Name="_DiscoverDependencies" DependsOnTargets="ResolveAssemblyReferences;GenerateBuildDependencyFile;ResolvePackageAssets">
     <!--
-    The target GenerateBuildDependencyFile is sufficient for projects targeting .NET Standard or .NET Core.
+    The targets ResolveAssemblyReferences and GenerateBuildDependencyFile are sufficient for projects targeting .NET Standard or .NET Core.
     The target ResolvePackageAssets is necessary for projects targeting .NET Framework.
     -->
   </Target>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/DiscoveryWorker.cs

@@ -1,5 +1,4 @@
 using System.Collections.Immutable;
-using System.Net;
 using System.Text.Json;
 using System.Text.Json.Serialization;
 
@@ -8,7 +7,9 @@ using Microsoft.Build.Definition;
 using Microsoft.Build.Evaluation;
 using Microsoft.Build.Exceptions;
 
-using NuGetUpdater.Core.Analyze;
+using NuGet.Frameworks;
+
+using NuGetUpdater.Core.Run.ApiModel;
 using NuGetUpdater.Core.Utilities;
 
 namespace NuGetUpdater.Core.Discover;
@@ -17,6 +18,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
 {
     public const string DiscoveryResultFileName = "./.dependabot/discovery.json";
 
+    private readonly string _jobId;
     private readonly ExperimentsManager _experimentsManager;
     private readonly ILogger _logger;
     private readonly HashSet<string> _processedProjectPaths = new(StringComparer.Ordinal); private readonly HashSet<string> _restoredMSBuildSdks = new(StringComparer.OrdinalIgnoreCase);
@@ -27,8 +29,9 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         Converters = { new JsonStringEnumConverter() },
     };
 
-    public DiscoveryWorker(ExperimentsManager experimentsManager, ILogger logger)
+    public DiscoveryWorker(string jobId, ExperimentsManager experimentsManager, ILogger logger)
     {
+        _jobId = jobId;
         _experimentsManager = experimentsManager;
         _logger = logger;
     }
@@ -46,13 +49,11 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         {
             result = await RunAsync(repoRootPath, workspacePath);
         }
-        catch (HttpRequestException ex)
-        when (ex.StatusCode == HttpStatusCode.Unauthorized || ex.StatusCode == HttpStatusCode.Forbidden)
+        catch (Exception ex)
         {
             result = new WorkspaceDiscoveryResult
             {
-                ErrorType = ErrorType.AuthenticationFailure,
-                ErrorDetails = "(" + string.Join("|", NuGetContext.GetPackageSourceUrls(PathHelper.JoinPath(repoRootPath, workspacePath))) + ")",
+                Error = JobErrorBase.ErrorFromException(ex, _jobId, PathHelper.JoinPath(repoRootPath, workspacePath)),
                 Path = workspacePath,
                 Projects = [],
             };
@@ -111,8 +112,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                 DotNetToolsJson = null,
                 GlobalJson = null,
                 Projects = projectResults.Where(p => p.IsSuccess).OrderBy(p => p.FilePath).ToImmutableArray(),
-                ErrorType = failedProjectResult.ErrorType,
-                ErrorDetails = failedProjectResult.FilePath,
+                Error = failedProjectResult.Error,
                 IsSuccess = false,
             };
 
@@ -180,8 +180,7 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                 ImportedFiles = ImmutableArray<string>.Empty,
                 AdditionalFiles = ImmutableArray<string>.Empty,
                 IsSuccess = false,
-                ErrorType = ErrorType.DependencyFileNotParseable,
-                ErrorDetails = "Failed to parse project file found at " + invalidProjectFile,
+                Error = new DependencyFileNotParseable(invalidProjectFile),
             }];
         }
         if (projects.IsEmpty)
@@ -364,19 +363,62 @@ public partial class DiscoveryWorker : IDiscoveryWorker
                     }
                 }
 
-                if (!results.ContainsKey(relativeProjectPath) &&
-                    packagesConfigResult is not null &&
-                    packagesConfigResult.Dependencies.Length > 0)
+                if (packagesConfigResult is not null)
                 {
-                    // project contained only packages.config dependencies
-                    results[relativeProjectPath] = new ProjectDiscoveryResult()
+                    // we might have to merge this dependency with some others
+                    if (results.TryGetValue(relativeProjectPath, out var existingProjectDiscovery))
                     {
-                        FilePath = relativeProjectPath,
-                        Dependencies = packagesConfigResult.Dependencies,
-                        TargetFrameworks = packagesConfigResult.TargetFrameworks,
-                        ImportedFiles = [], // no imported files resolved for packages.config scenarios
-                        AdditionalFiles = packagesConfigResult.AdditionalFiles,
-                    };
+                        // merge SDK and packages.config results
+                        var mergedDependencies = existingProjectDiscovery.Dependencies.Concat(packagesConfigResult.Dependencies)
+                            .DistinctBy(d => d.Name, StringComparer.OrdinalIgnoreCase)
+                            .OrderBy(d => d.Name)
+                            .ToImmutableArray();
+                        var mergedTargetFrameworks = existingProjectDiscovery.TargetFrameworks.Concat(packagesConfigResult.TargetFrameworks)
+                            .Select(t =>
+                            {
+                                try
+                                {
+                                    var tfm = NuGetFramework.Parse(t);
+                                    return tfm.GetShortFolderName();
+                                }
+                                catch
+                                {
+                                    return string.Empty;
+                                }
+                            })
+                            .Where(tfm => !string.IsNullOrEmpty(tfm))
+                            .Distinct()
+                            .OrderBy(tfm => tfm)
+                            .ToImmutableArray();
+                        var mergedProperties = existingProjectDiscovery.Properties; // packages.config discovery doesn't produce properties
+                        var mergedImportedFiles = existingProjectDiscovery.ImportedFiles; // packages.config discovery doesn't produce imported files
+                        var mergedAdditionalFiles = existingProjectDiscovery.AdditionalFiles.Concat(packagesConfigResult.AdditionalFiles)
+                            .Distinct(StringComparer.OrdinalIgnoreCase)
+                            .OrderBy(f => f)
+                            .ToImmutableArray();
+                        var mergedResult = new ProjectDiscoveryResult()
+                        {
+                            FilePath = existingProjectDiscovery.FilePath,
+                            Dependencies = mergedDependencies,
+                            TargetFrameworks = mergedTargetFrameworks,
+                            Properties = mergedProperties,
+                            ImportedFiles = mergedImportedFiles,
+                            AdditionalFiles = mergedAdditionalFiles,
+                        };
+                        results[relativeProjectPath] = mergedResult;
+                    }
+                    else
+                    {
+                        // add packages.config results
+                        results[relativeProjectPath] = new ProjectDiscoveryResult()
+                        {
+                            FilePath = relativeProjectPath,
+                            Dependencies = packagesConfigResult.Dependencies,
+                            TargetFrameworks = packagesConfigResult.TargetFrameworks,
+                            ImportedFiles = [], // no imported files resolved for packages.config scenarios
+                            AdditionalFiles = packagesConfigResult.AdditionalFiles,
+                        };
+                    }
                 }
             }
         }
@@ -397,6 +439,6 @@ public partial class DiscoveryWorker : IDiscoveryWorker
         }
 
         var resultJson = JsonSerializer.Serialize(result, SerializerOptions);
-        await File.WriteAllTextAsync(path: resultPath, resultJson);
+        await File.WriteAllTextAsync(resultPath, resultJson);
     }
 }

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/ProjectDiscoveryResult.cs

@@ -1,5 +1,6 @@
 using System.Collections.Immutable;
-using System.Text.Json.Serialization;
+
+using NuGetUpdater.Core.Run.ApiModel;
 
 namespace NuGetUpdater.Core.Discover;
 
@@ -8,8 +9,7 @@ public record ProjectDiscoveryResult : IDiscoveryResultWithDependencies
     public required string FilePath { get; init; }
     public required ImmutableArray<Dependency> Dependencies { get; init; }
     public bool IsSuccess { get; init; } = true;
-    public string? ErrorDetails { get; init; }
-    public ErrorType? ErrorType { get; init; }
+    public JobErrorBase? Error { get; init; } = null;
     public ImmutableArray<Property> Properties { get; init; } = [];
     public ImmutableArray<string> TargetFrameworks { get; init; } = [];
     public ImmutableArray<string> ReferencedProjectPaths { get; init; } = [];

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Discover/SdkProjectDiscovery.cs

@@ -9,6 +9,8 @@ using NuGet.Versioning;
 
 using NuGetUpdater.Core.Utilities;
 
+using Semver;
+
 using LoggerProperty = Microsoft.Build.Logging.StructuredLogger.Property;
 
 namespace NuGetUpdater.Core.Discover;
@@ -72,6 +74,9 @@ internal static class SdkProjectDiscovery
         Dictionary<string, HashSet<string>> topLevelPackagesPerProject = new(PathComparer.Instance);
         //         projectPath, packageNames
 
+        Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesReplacedBySdkPerProject = new(PathComparer.Instance);
+        //         projectPath        tfm           packageName, packageVersion
+
         Dictionary<string, Dictionary<string, string>> resolvedProperties = new(PathComparer.Instance);
         //         projectPath        propertyName, propertyValue
 
@@ -164,7 +169,7 @@ internal static class SdkProjectDiscovery
                             }
                             break;
                         case NamedNode namedNode when namedNode is AddItem or RemoveItem:
-                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject);
+                            ProcessResolvedPackageReference(namedNode, packagesPerProject, topLevelPackagesPerProject, experimentsManager);
 
                             if (namedNode is AddItem addItem)
                             {
@@ -203,6 +208,70 @@ internal static class SdkProjectDiscovery
                                 }
                             }
                             break;
+                        case Target target when target.Name == "_HandlePackageFileConflicts":
+                            // this only works if we've installed the exact SDK required
+                            if (experimentsManager.InstallDotnetSdks)
+                            {
+                                var projectEvaluation = GetNearestProjectEvaluation(target);
+                                if (projectEvaluation is null)
+                                {
+                                    break;
+                                }
+
+                                var removedReferences = target.Children.OfType<RemoveItem>().FirstOrDefault(r => r.Name == "Reference");
+                                var addedReferences = target.Children.OfType<AddItem>().FirstOrDefault(r => r.Name == "Reference");
+                                if (removedReferences is null || addedReferences is null)
+                                {
+                                    break;
+                                }
+
+                                foreach (var removedAssembly in removedReferences.Children.OfType<Item>())
+                                {
+                                    var removedPackageName = GetChildMetadataValue(removedAssembly, "NuGetPackageId");
+                                    var removedFileName = Path.GetFileName(removedAssembly.Name);
+                                    if (removedPackageName is null || removedFileName is null)
+                                    {
+                                        continue;
+                                    }
+
+                                    var existingProjectPackagesByTfm = packagesPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(PathComparer.Instance));
+                                    var existingProjectPackages = existingProjectPackagesByTfm.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                                    if (!existingProjectPackages.ContainsKey(removedPackageName))
+                                    {
+                                        continue;
+                                    }
+
+                                    var correspondingAddedFile = addedReferences.Children.OfType<Item>()
+                                        .FirstOrDefault(i => removedFileName.Equals(Path.GetFileName(i.Name), StringComparison.OrdinalIgnoreCase));
+                                    if (correspondingAddedFile is null)
+                                    {
+                                        continue;
+                                    }
+
+                                    var runtimePackageName = GetChildMetadataValue(correspondingAddedFile, "NuGetPackageId");
+                                    var runtimePackageVersion = GetChildMetadataValue(correspondingAddedFile, "NuGetPackageVersion");
+                                    if (runtimePackageName is null ||
+                                        runtimePackageVersion is null ||
+                                        !SemVersion.TryParse(runtimePackageVersion, out var parsedRuntimePackageVersion))
+                                    {
+                                        continue;
+                                    }
+
+                                    var packageMapper = DotNetPackageCorrelationManager.GetPackageMapper();
+                                    var replacementPackageVersion = packageMapper.GetPackageVersionThatShippedWithOtherPackage(runtimePackageName, parsedRuntimePackageVersion, removedPackageName);
+                                    if (replacementPackageVersion is null)
+                                    {
+                                        continue;
+                                    }
+
+                                    var packagesPerThisProject = packagesReplacedBySdkPerProject.GetOrAdd(projectEvaluation.ProjectFile, () => new(PathComparer.Instance));
+                                    var packagesPerTfm = packagesPerThisProject.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                                    packagesPerTfm[removedPackageName] = replacementPackageVersion.ToString();
+                                    var relativeProjectPath = Path.GetRelativePath(repoRootPath, projectEvaluation.ProjectFile).NormalizePathToUnix();
+                                    logger.Info($"Re-added SDK managed package [{removedPackageName}/{replacementPackageVersion}] to project [{relativeProjectPath}]");
+                                }
+                            }
+                            break;
                     }
                 }, takeChildrenSnapshot: true);
             }
@@ -228,6 +297,33 @@ internal static class SdkProjectDiscovery
         {
             // gather some project-level information
             var packagesByTfm = packagesPerProject[projectPath];
+            if (packagesReplacedBySdkPerProject.TryGetValue(projectPath, out var packagesReplacedBySdk))
+            {
+                var consolidatedPackagesByTfm = new Dictionary<string, Dictionary<string, string>>(StringComparer.OrdinalIgnoreCase);
+
+                // copy the first dictionary
+                foreach (var kvp in packagesByTfm)
+                {
+                    var tfm = kvp.Key;
+                    var packages = kvp.Value;
+                    consolidatedPackagesByTfm[tfm] = packages;
+                }
+
+                // merge in the second
+                foreach (var kvp in packagesReplacedBySdk)
+                {
+                    var tfm = kvp.Key;
+                    var packages = kvp.Value;
+                    var replacedPackages = consolidatedPackagesByTfm.GetOrAdd(tfm, () => new(StringComparer.OrdinalIgnoreCase));
+                    foreach (var packagePair in packages)
+                    {
+                        replacedPackages[packagePair.Key] = packagePair.Value;
+                    }
+                }
+
+                packagesByTfm = consolidatedPackagesByTfm;
+            }
+
             var projectFullDirectory = Path.GetDirectoryName(projectPath)!;
             var doc = XDocument.Load(projectPath);
             var localPropertyDefinitionElements = doc.Root!.XPathSelectElements("/Project/PropertyGroup/*");
@@ -288,7 +384,8 @@ internal static class SdkProjectDiscovery
     private static void ProcessResolvedPackageReference(
         NamedNode node,
         Dictionary<string, Dictionary<string, Dictionary<string, string>>> packagesPerProject, // projectPath -> tfm -> (packageName, packageVersion)
-        Dictionary<string, HashSet<string>> topLevelPackagesPerProject
+        Dictionary<string, HashSet<string>> topLevelPackagesPerProject,
+        ExperimentsManager experimentsManager
     )
     {
         var doRemoveOperation = node is RemoveItem;

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/EnsureDotNetPackageCorrelation.targets

@@ -0,0 +1,25 @@
+<Project>
+
+  <PropertyGroup>
+    <PackageCorrelationCliDirectory>$(MSBuildThisFileDirectory)..\DotNetPackageCorrelation.Cli</PackageCorrelationCliDirectory>
+    <DotNetCoreDirectory>$(MSBuildThisFileDirectory)..\..\dotnet-core</DotNetCoreDirectory>
+    <PackageCorrelationFile>$(MSBuildThisFileDirectory)dotnet-package-correlation.json</PackageCorrelationFile>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="$(PackageCorrelationFile)" CopyToOutputDirectory="PreserveNewest" />
+    <_DotNetCoreFiles Include="$(DotNetCoreDirectory)\**\*" />
+  </ItemGroup>
+
+  <Target Name="BuildDotNetPackageCorrelationFile" Inputs="@(_DotNetCoreFiles)" Outputs="$(PackageCorrelationFile)" BeforeTargets="GetCopyToOutputDirectoryItems">
+    <Exec Command="dotnet run --core-location &quot;$(DotNetCoreDirectory)&quot; --output &quot;$(PackageCorrelationFile)&quot;" WorkingDirectory="$(PackageCorrelationCliDirectory)" />
+  </Target>
+
+  <Target Name="CleanDotNetPackageCorrelationFile" BeforeTargets="Clean">
+    <Delete Files="$(PackageCorrelationFile)" Condition="Exists('$(PackageCorrelationFile)')" />
+  </Target>
+
+  <Target Name="RebuildDotNetPackageCorrelationFile" BeforeTargets="Rebuild" DependsOnTargets="CleanDotNetPackageCorrelationFile">
+  </Target>
+
+</Project>

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/ExperimentsManager.cs

@@ -1,6 +1,7 @@
 using System.Text.Json;
 
 using NuGetUpdater.Core.Run;
+using NuGetUpdater.Core.Run.ApiModel;
 
 namespace NuGetUpdater.Core;
 
@@ -30,19 +31,28 @@ public record ExperimentsManager
         };
     }
 
-    public static async Task<ExperimentsManager> FromJobFileAsync(string jobFilePath, ILogger logger)
+    public static async Task<(ExperimentsManager ExperimentsManager, JobErrorBase? Error)> FromJobFileAsync(string jobId, string jobFilePath)
     {
-        var jobFileContent = await File.ReadAllTextAsync(jobFilePath);
+        var experimentsManager = new ExperimentsManager();
+        JobErrorBase? error = null;
+        var jobFileContent = string.Empty;
         try
         {
+            jobFileContent = await File.ReadAllTextAsync(jobFilePath);
             var jobWrapper = RunWorker.Deserialize(jobFileContent);
-            return GetExperimentsManager(jobWrapper.Job.Experiments);
+            experimentsManager = GetExperimentsManager(jobWrapper.Job.Experiments);
         }
         catch (JsonException ex)
         {
-            logger.Info($"Error deserializing job file: {ex.ToString()}: {jobFileContent}");
-            return new ExperimentsManager();
+            // this is a very specific case where we want to log the JSON contents for easier debugging
+            error = JobErrorBase.ErrorFromException(new NotSupportedException($"Error deserializing job file contents: {jobFileContent}", ex), jobId, Environment.CurrentDirectory); // TODO
         }
+        catch (Exception ex)
+        {
+            error = JobErrorBase.ErrorFromException(ex, jobId, Environment.CurrentDirectory); // TODO
+        }
+
+        return (experimentsManager, error);
     }
 
     private static bool IsEnabled(Dictionary<string, object>? experiments, string experimentName)

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/Files/PackagesConfigBuildFile.cs

@@ -13,12 +13,16 @@ internal sealed class PackagesConfigBuildFile : XmlBuildFile
     public PackagesConfigBuildFile(string basePath, string path, XmlDocumentSyntax contents)
         : base(basePath, path, contents)
     {
+        var invalidPackageElements = Packages.Where(p => p.GetAttribute("id") is null || p.GetAttribute("version") is null).ToList();
+        if (invalidPackageElements.Any())
+        {
+            throw new UnparseableFileException("`package` element missing `id` or `version` attributes", path);
+        }
     }
 
     public IEnumerable<IXmlElementSyntax> Packages => Contents.RootSyntax.GetElements("package", StringComparison.OrdinalIgnoreCase);
 
     public IEnumerable<Dependency> GetDependencies() => Packages
-        .Where(p => p.GetAttribute("id") is not null && p.GetAttribute("version") is not null)
         .Select(p => new Dependency(
             p.GetAttributeValue("id", StringComparison.OrdinalIgnoreCase),
             p.GetAttributeValue("version", StringComparison.OrdinalIgnoreCase),

data/helpers/lib/NuGetUpdater/NuGetUpdater.Core/MissingFileException.cs

@@ -4,7 +4,8 @@ internal class MissingFileException : Exception
 {
     public string FilePath { get; }
 
-    public MissingFileException(string filePath)
+    public MissingFileException(string filePath, string? message = null)
+        : base(message)
     {
         FilePath = filePath;
     }