Fix Dependabot discovery of bundled Playwright via PackageDownload

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)

[Amaury Levé (Evangelink)]

Problem

Microsoft.Playwright.MSTest.v4 is still stuck at 1.60.0 even though 1.61.0 has been on the feeds since 2026-06-24 and the anchor fix#9422 has merged. Dependabot keeps updating Aspire.Hosting.Testing but never bumps Playwright (#9362).

Root cause: the #9422 anchor mechanism doesn't work

#9422 added inert anchors as PackageReference ... ExcludeAssets="all". But ExcludeAssets="all" removes the reference from the dependency graph that Dependabot reads, so the package stays invisible to Dependabot and is never proposed for an update — the opposite of the anchor's intent.

The in-repo evidence is a clean A/B from today's Dependabot run (06:47 UTC — after #9422 landed, after 1.61.0 shipped, with 0 open Dependabot PRs so the limit of 15 is irrelevant):

On main	Reference	Result
Aspire.Hosting.Testing	PackageDownload+ExcludeAssets="all" anchor	✅ bumped 13.2.1 → 13.4.6
Microsoft.Playwright.MSTest.v4	ExcludeAssets="all" anchor only	❌ stuck at 1.60.0

Same run, same config, same feeds. The only difference is the PackageDownload: Aspire updates via that, not via the ExcludeAssets anchor. Playwright, having only the anchor, is invisible.

Fix

• Replace the inert ExcludeAssets="all"PackageReference anchors with PackageDownload items for both packages. PackageDownload keeps the package in the restore graph (so Dependabot proposes bumps) without flowing any of its assets (compile/runtime/build — e.g. Playwright's browser install) into the test project. This is the mechanism already proven by Aspire.
• Correct the now-misleading "condition 2" guidance in Directory.Packages.props and the anchor comment in the acceptance csproj to document that the anchor must be a PackageDownload, not a PackageReference with ExcludeAssets="all".

The _ValidateBundledSdkFeatureVersions drift guard is unchanged and still keeps MicrosoftPlaywrightVersion / AspireHostingTestingVersion in sync with the literal PackageVersion entries.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors).

Notes

This effectively re-applies the PackageDownload approach from the earlier #9449 (which I had closed as "superseded" by #9422 — but #9422's anchor turned out not to work). Supersedes the Playwright-relevant part of #9422.

Closes#9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

Updates the repo’s “Dependabot anchor” mechanism for SDK-bundled feature packages (Playwright + Aspire) so Dependabot can consistently discover and propose version bumps without flowing package assets into the acceptance test project.

Changes:

• Replaced ExcludeAssets="all"PackageReference anchors with PackageDownload anchors for Aspire.Hosting.Testing and Microsoft.Playwright.MSTest.v4.
• Consolidated and expanded documentation in the acceptance csproj explaining why PackageDownload is required for Dependabot discovery.
• Updated Directory.Packages.props guidance to reflect the PackageDownload-based anchoring approach.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Swaps Dependabot anchors to PackageDownload for both bundled feature packages and updates the explanatory comment.
Directory.Packages.props	Updates documentation explaining Dependabot prerequisites and clarifies that anchors must be PackageDownload.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[Amaury Levé (Evangelink)]

Note

🤖 Automated review by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Expert Code Review workflow. To request a follow-up action, reply by tagging @copilot directly.

Review: PR #9452 — Fix Dependabot discovery of bundled Playwright via PackageDownload

#	Dimension	Severity	Result
1	Algorithmic Correctness	MAJOR	✅ N/A — no algorithmic changes
2	Threading & Concurrency	BLOCKING	✅ N/A — no C# code
3	Security	BLOCKING	✅ No concerns — only NuGet infrastructure touching well-known packages
4	Error Handling	MAJOR	✅ _ValidateBundledSdkFeatureVersions guard intact and still fires after a Dependabot bump
5	Nullability / Null Safety	MAJOR	✅ N/A
6	Resource Management	MAJOR	✅ N/A
7	API Design & Contracts	MAJOR	✅ N/A — no public API surface touched
8	Test Coverage	MINOR	i️ No automated test can exercise Dependabot's bump behavior; the fix relies on empirical evidence (Aspire kept updating because it had a PackageDownload; Playwright did not because it only had ExcludeAssets="all") — acceptable given the nature of the change
9	Performance	MINOR	✅ PackageDownload downloads the nupkg to the global cache during restore — marginally more work than the old PackageReference ExcludeAssets="all", but negligible and intentional
10	Logging & Observability	MINOR	✅ N/A
11	Configuration & Compatibility	MAJOR	✅ PackageDownload always requires an explicit version even under CPM — [$(MicrosoftPlaywrightVersion)] and [$(AspireHostingTestingVersion)] are correct: MSBuild evaluates the property first, so NuGet sees [1.60.0] / [13.4.6], both valid exact-version bracket constraints
12	Code Clarity & Maintainability	MINOR	✅ Consolidating two separate ItemGroup blocks into one with a unified, well-explained comment is cleaner than the previous split
13	Documentation Accuracy	MINOR	i️ See inline comment on line 46 of the .csproj: "also used to stage nupkgs for test assets" is accurate only for the Aspire entry; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Also, both files use the phrase "restore graph" for PackageDownload items — technically these appear under packageDownloads in project.assets.json, not in the dependency/restore graph proper; functionally accurate for Dependabot purposes
14	Dependency Management	MAJOR	✅ Core fix is correct. Empirical evidence: Aspire was getting Dependabot bumps (it had a PackageDownload); Playwright was not (it only had PackageReference ExcludeAssets="all"). Switching Playwright to PackageDownload aligns both packages on the working pattern. The Aspire duplicate PackageReference ExcludeAssets="all" is correctly removed as it was redundant
15	MSBuild / NuGet Correctness	MAJOR	✅ PackageDownload item type, bracket-notation exact-version requirement, and MSBuild property expansion all used correctly. test/Directory.Build.targets adds GeneratePathProperty="True" for Microsoft.Testing.Extensions.CodeCoverage, so $(PkgMicrosoft_Testing_Extensions_CodeCoverage) in CopyNuGetPackagesForTestAssets is unaffected by this change
16	Public API Surface	BLOCKING	✅ N/A — build infrastructure only
17	CI / CD Pipeline	MAJOR	✅ Dependabot config (directory: "/") scans the entire repo; MSTest.Acceptance.IntegrationTests.csproj is picked up. After this change both Aspire and Playwright entries should receive daily bump proposals
18	Layering & Architecture	MINOR	✅ Correct layer to host Dependabot anchors — the acceptance test project participates in the full NuGet restore and is already the canonical home for such anchors (see #9362)
19	Dead Code	MINOR	✅ The ineffective PackageReference ExcludeAssets="all" anchors are cleanly removed for both packages — no dead items remain
20	Breaking Changes	BLOCKING	✅ N/A — internal build plumbing; no shipped API surface changes
21	Cross-Platform	MINOR	✅ PackageDownload is NuGet-native and platform-agnostic
22	Code Style & Formatting	MINOR	✅ Alphabetical ordering (Aspire before Playwright) is consistent with existing conventions; comment indentation and line-wrapping match surrounding style

---

Overall Assessment

The root-cause diagnosis is accurate and the fix is minimal and correct. The decision to replace PackageReference ... ExcludeAssets="all" with PackageDownload is well-supported by empirical evidence and by how Dependabot processes NuGet manifests. All supporting machinery (_ValidateBundledSdkFeatureVersions, CopyNuGetPackagesForTestAssets, CPM version literals) continues to work correctly without modification.

One non-blocking inline comment is filed: the parenthetical "also used to stage nupkgs for test assets" in the .csproj comment applies to the Aspire entry only; the Playwright PackageDownload never feeds CopyNuGetPackagesForTestAssets. Worth tightening in a follow-up if desired, but not a blocker.

[Amaury Levé (Evangelink)]

🧪 Test quality grade — PR #9452

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 90.5 AIC · ⌖ 12.9 AIC · ⊞ 43.8K · [◷]( · ◷)