Botbuilder-dotnet: NuGet packages reference SourceLink as a runtime dependency rather than dev dependency

[drub0y]

Version

4.2.x

Describe the bug

The libraries that produce NuGet packages have a reference to the SourceLink.Create.CommandLine package, but they lack the PrivateAssets="All" attribute which ultimately results in there being a transitive dependency to the package for consumers of the SDK.

To Reproduce

Steps to reproduce the behavior:

1. Install any SDK package (e.g. Microsoft.BotBuilder.Schema) from NuGet
2. Notice that SourceLink.Create.CommandLine is installed as a transitive dependency to your application's project

Expected behavior

Since SourceLink is a tool used during the development of the SDK packages, I would not expect there to be a transitive dependency to it from the published packages.

Additional Context

One fix is to simply manually add PrivateAssets="All" to the PackageReference for SourceLink.Create.CommandLine across all the projects.

Another, simpler fix is to just update the package to 2.8.3 (latest as of right now) which will has the proper metadata to trigger PrivateAssets to be set automatically (along with some other properties).

[bug]

[james-novino]

As of version 4.2.2 this is still an issue. Is there an open PR to change the proejcts to use PrivateAssets=All?

[blrchen]

Still see this issue on 4.3.2. Why it's closed? @cleemullins

[volthezz]

@cleemullins, this bug should be reopened, because #1324
did not fix the bug, it only updated the version number, but updating the package should have also added the PrivateAssets="All" attribute.