Make bundled Playwright discoverable by Dependabot via PackageDownload by Evangelink · Pull Request #9449 · microsoft/testfx

Evangelink · 2026-06-26T10:13:01Z

Problem

Dependabot keeps Aspire.Hosting.Testing up to date but has never bumped Microsoft.Playwright.MSTest.v4 (still stuck at 1.60.0, while 1.61.0 has been available on the feeds since 2026-06-24). See #9362.

PR #9446 is the smoking gun: Aspire and Playwright sit in the identical orphan-CPM PackageVersion ItemGroup in Directory.Packages.props, yet that PR bumped only Aspire and left Playwright behind.

Root cause

The earlier "discoverability" workaround (#9365) assumed a literal PackageVersion in Directory.Packages.props was enough for Dependabot to track the package. It is not. Dependabot only proposes updates for packages that have a real consuming reference (PackageReference / PackageDownload). A lone orphan CPM PackageVersion with no consumer is invisible to it.

Aspire was only ever updated because it already had a PackageDownload in MSTest.Acceptance.IntegrationTests.csproj (used to stage the package for test assets). Playwright had no equivalent reference anywhere, so it was never discovered.

Fix

Add a matching PackageDownload for Microsoft.Playwright.MSTest.v4 next to the existing Aspire one in MSTest.Acceptance.IntegrationTests.csproj. This gives Dependabot a real reference to track; it will then bump both the MicrosoftPlaywrightVersion property and the literal PackageVersion, with the existing _ValidateBundledSdkFeatureVersions target keeping them in sync.
Correct the comments in Directory.Packages.props so they no longer credit the orphan PackageVersion alone, and document that any future bundled-but-unreferenced SDK feature package needs a matching PackageDownload.

Validation

MSTest.Acceptance.IntegrationTests restores and builds cleanly (0 warnings, 0 errors) with the new PackageDownload.

Closes #9362.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

The orphan `PackageVersion` for `Microsoft.Playwright.MSTest.v4` in Directory.Packages.props was never enough for Dependabot to discover and bump it: Dependabot only proposes updates for packages that have a real consuming reference (PackageReference / PackageDownload). Aspire.Hosting.Testing sits in the same orphan-CPM ItemGroup but was kept up to date only because it already had a PackageDownload in the acceptance-test project (see #9446, which bumped Aspire but left Playwright stuck at 1.60.0). Add a matching PackageDownload for Microsoft.Playwright.MSTest.v4 and update the surrounding comments so future bundled SDK feature packages follow the same pattern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR addresses Dependabot “discoverability” for bundled MSTest SDK feature packages by adding a real consuming reference for Microsoft.Playwright.MSTest.v4 (via PackageDownload) and clarifying CPM/Dependabot guidance in comments.

Changes:

Add PackageDownload for Microsoft.Playwright.MSTest.v4 in MSTest.Acceptance.IntegrationTests.csproj to give Dependabot a concrete reference to track.
Update Directory.Packages.props comments to document that orphan CPM PackageVersion entries are not sufficient for Dependabot without a real reference.

Show a summary per file

File	Description
test/IntegrationTests/MSTest.Acceptance.IntegrationTests/MSTest.Acceptance.IntegrationTests.csproj	Adds a Playwright `PackageDownload` and expands comments explaining why it’s needed for Dependabot discoverability.
Directory.Packages.props	Updates the “bundled but not directly referenced” section comments to document Dependabot behavior and the need for a matching consuming reference.

Review details

Files reviewed: 2/2 changed files
Comments generated: 3
Review effort level: Low

Evangelink · 2026-06-26T10:42:31Z

+       These PackageDownload items also give Dependabot a real consuming reference for the
+       bundled MSTest.Sdk feature packages (Aspire/Playwright), which is what makes it discover
+       and bump them. A lone orphan PackageVersion in Directory.Packages.props is NOT enough:


Resolved by reverting this code. While this PR was open, main independently landed the same fix for #9362 using inert PackageReference ... ExcludeAssets="all" anchors for both Playwright and Aspire. After merging main, I reverted this branch's PackageDownload approach (and these comments) to match main exactly, so the wording flagged here no longer exists. This PR is now a no-op and will be closed as superseded.

Evangelink · 2026-06-26T10:42:32Z

-  <ItemGroup>
-    <PackageReference Include="Microsoft.Playwright.MSTest.v4" ExcludeAssets="all" />
-    <PackageReference Include="Aspire.Hosting.Testing" ExcludeAssets="all" />
+    <PackageDownload Include="Microsoft.Playwright.MSTest.v4" Version="[$(MicrosoftPlaywrightVersion)]" />


Good catch, but moot now. main already fixed #9362 with an inert PackageReference ... ExcludeAssets="all" anchor for Playwright rather than a PackageDownload. That anchor is purely a Dependabot reference and excludes all assets, so there's no test-asset staging to keep consistent (the Playwright acceptance test restores Microsoft.Playwright.MSTest.v4 from the normal feeds, not from the local-tmp-packages feed). This branch has been reverted to match main, so the misplaced PackageDownload is gone.

Evangelink · 2026-06-26T10:42:34Z

+    MSTest.Acceptance.IntegrationTests.csproj which is what actually triggers the update; Dependabot
+    then bumps both the *Version property and the literal PackageVersion below. If you add another
+    bundled-but-unreferenced SDK feature package here, add a matching PackageDownload too, otherwise
+    it will silently never be updated.


Resolved by reverting to main's wording. main's comment already states the _ValidateBundledSdkFeatureVersions target enforces synchronization between the property and the literal PackageVersion, so the contradiction flagged here no longer exists on this branch.

main independently fixed #9362 via inert PackageReference ExcludeAssets=\"all\" anchors for both Playwright and Aspire. Revert this branch's PackageDownload-based approach and the contradictory comments to match main exactly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot wasn't able to review any files in this pull request.

Copilot

Copilot wasn't able to review any files in this pull request.

Evangelink · 2026-06-26T10:39:22Z

🧪 Test quality grade — PR #9449

No new or modified test methods were identified in the changed regions
of this PR. Nothing to grade.

_{Re-run with /grade-tests.}

🤖 Automated content by GitHub Copilot. Posted via a maintainer's GitHub token, so it appears under their account — the account owner did not write or approve this content personally. Generated by the Grade Tests on PR (on open / sync) workflow. · 194 AIC · ⌖ 12.8 AIC · ⊞ 43.7K · [◷]( · ◷)

Evangelink · 2026-06-26T10:47:06Z

Closing as superseded. While this PR was open, main independently landed the same fix for #9362 — inert PackageReference ... ExcludeAssets="all" Dependabot anchors for both Microsoft.Playwright.MSTest.v4 and Aspire.Hosting.Testing (plus the _ValidateBundledSdkFeatureVersions drift guard). I merged main and reverted this branch's PackageDownload approach so its net diff against main is empty. The 1.61.0 bump will now flow through Dependabot via main's anchors. Review comments have been replied to as resolved.

Copilot AI review requested due to automatic review settings June 26, 2026 10:13

Copilot started reviewing on behalf of Evangelink June 26, 2026 10:13 View session

Merge branch 'main' into evangelink-supreme-lamp

eed7903

Evangelink enabled auto-merge (squash) June 26, 2026 10:14

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 26, 2026 10:17

Copilot started reviewing on behalf of Evangelink June 26, 2026 10:20 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 26, 2026 10:22

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Evangelink closed this Jun 26, 2026

auto-merge was automatically disabled June 26, 2026 10:47
Pull request was closed

Evangelink mentioned this pull request Jun 26, 2026

Fix Dependabot discovery of bundled Playwright via PackageDownload #9452

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Make bundled Playwright discoverable by Dependabot via PackageDownload#9449

Make bundled Playwright discoverable by Dependabot via PackageDownload#9449
Evangelink wants to merge 3 commits into
mainfrom
evangelink-supreme-lamp

Evangelink commented Jun 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Evangelink Jun 26, 2026

Uh oh!

Evangelink Jun 26, 2026

Uh oh!

Evangelink Jun 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Evangelink commented Jun 26, 2026

Uh oh!

Evangelink commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Evangelink commented Jun 26, 2026

Problem

Root cause

Fix

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Evangelink Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

Evangelink Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

Evangelink Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Evangelink commented Jun 26, 2026

🧪 Test quality grade — PR #9449

Uh oh!

Evangelink commented Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants