delivery-sdk-net VS sourcelink

Delivery SDK

AppVeyor offers features such as .csproj files patching and AssemblyInfo patching. These features are not available in GitHub Actions and the easiest way to overcome this is to use parameters that the .NET CLI offers dotnet build -p:Version=1.2.3 and dotnet pack -p:PackageVersion=1.2.3 or dotnet pack -p:NuspecProperties="Version=1.2.3" if you use a .nuspec file.

To see the whole workflow in action, head to some of our SDK repos. You can also explore how we do releases using GitHub Actions. All code is in the workflows folder.

The premise of the tool seems very useful: edit debug symbols and assert messages so that source code can be found by debuggers. But this description does not make it clear how this tool accomplishes the whole task:

> Why not fix the binary coming out of the build cache, so it points to the absolute path of the source files?

What is the absolute path? If you had a virtual file system that allowed you to construct a path to any file at a given commit, this would work great. But who does that other than Google? Or if you agree that every developer will check out the same source code repo at the same path, but the you have to have the right commit checked out.

Ideally you would want your binary to point back to your code repo, like SourceLink does.

https://github.com/dotnet/sourcelink

Reference https://github.com/dotnet/sourcelink/tree/main/src/Microsoft.Build.Tasks.Git

The tooling isn't quite there yet, but between SourceLink and EmbedUntrackedSources, it should be completely reasonable to be able to maintain trust (and eventually, easy, exact reproducibility) for projects that use source generation. Plus, AFAIK, for a package to truly be considered deterministic, all of the sources used for the build either must be tracked by source control, or embedded with the aforementioned flag.

It looks like your NuGet packages is missing symbols (the .pdb files next to .dll files). Symbols let folks map from compiled code back to source code. No symbols make it harder for users to debug your package. I'd recommend using Source Link for your project: https://github.com/dotnet/sourcelink

If you want to enable Source Link for the consumers of your NuGets, make sure you turn on deterministic builds using dotnet build /p:ContinuousIntegrationBuild=true.