Add PostSharpDependencyRestoreProperties to inject MSBuild properties into the generated dependency-restore project #40

Problem

The compiler dependency restore runs on a synthetic project generated under %ProgramData%\PostSharp\DependencyRestore\... (BuildTimeDependencyRestorer.CreateDependencyRestoreProject, Core/PostSharp.MSBuild/NetCore/BuildTimeDependencyRestorer.cs). Because it lives outside the repo, users cannot influence it with Directory.Build.props/nuget.config, and they cannot set restore-project properties (e.g. NuGetAudit, NuGetAuditLevel, NoWarn) without a PostSharp update.

This surfaced with the NU1901 NuGet.Packaging warning (#39): the only user-side levers today are build-wide (a NuGetAudit=false environment variable, which also affects the user's own build) or band-aids (MSBuildWarningsAsMessages). There is no supported way to tweak just the restore project.

Proposal

Add a PostSharpDependencyRestoreProperties MSBuild property — semicolon-separated Name=Value pairs. The generator injects each pair as a child element of the generated restore project's <PropertyGroup>. It is scoped to the synthetic restore project only and does not affect the user's main build (unlike a global environment variable).

<PropertyGroup>
  <PostSharpDependencyRestoreProperties>NuGetAudit=false</PostSharpDependencyRestoreProperties>
</PropertyGroup>

Plumbing (mirror PostSharpDependencyRestoreDisabled)

• Default empty in Core/PostSharp.MSBuild/PostSharp.properties.
• Pass through to the task in Core/PostSharp.MSBuild/PostSharp.targets (the PostSharpCompile invocation).
• Surface on Core/PostSharp.MSBuild/PostSharpCompile.cs and on IBuildClient / BuildClient.
• Consume in BuildTimeDependencyRestorer.CreateDependencyRestoreProject (and CreateReferencePackRestoreProject for consistency).

Details to get right

1. Cache invalidation. Fold the properties into dependencyRestoreId (the hash key used for the .touch / project.assets.json up-to-date check). Otherwise an existing cached restore looks up-to-date and the new property is silently ignored until the cache is cleared.
2. Semicolon escaping. A value such as NoWarn=NU1901;NU1902 collides with the list separator — support %3B for inner semicolons (standard MSBuild escaping).
3. Apply to both generated projects — the dependency restore project and the reference-pack restore project.

Related

• Compiler dependency NuGet.Packaging 6.14.0 triggers NU1901 vulnerability warning in user builds #39 — compiler dependency NuGet.Packaging 6.14.0 triggers NU1901 in user builds (the motivating case).

🤖 Generated with Claude Code