PublishTrimmed with --no-restore silently skips trimming if not previously restored

[sbomer]

From @LXGaming in dotnet/linker#3168 (comment):

Documenting an issue I encountered with GitHub Actions Runner ubuntu22/20231115.7 (includes .NET 8) when building a .NET 7 project.

I use GitHub Actions for publishing trimmed .NET binaries, my workflow consists of a restore step and all subsequent steps use --no-restore, I found that builds were no longer being trimmed due to ILLink having disappeared. I eventually stumbled upon this issue and its linked PRs which noted that a restore would be required for ILLink to be downloaded, because I use /p:PublishTrimmed=true and --no-restore on the publish command ILLink is never downloaded.

The solution is to add /p:PublishTrimmed=true to the restore command or alternatively avoid using --no-restore to ensure that ILLink is present.

I believe there should be a warning or error when PublishTrimmed is specified but ILLink isn't present.

@dotnet/illink-contrib a new issue has been filed in the ILLink area, please triage

[sbomer]

PublishAot has the same issue. Putting PublishTrimmed or PublishAot in the project file solves the problem. Note that we recommend putting these settings in the project file anyway, because they also influence dotnet build - they enable analyzer warnings and set some runtimeconfig settings.

I agree this should be a warning during publish. The issue is the use of implicit package references. PublishTrimmed pretty much just tells the SDK to add a PackageReference to the ILLink package, and all of the downstream logic is handled by NuGet. But if PublishTrimmed is specified on the command-line during publish only, there will be a PackageReference that does nothing during publish because NuGet never got a chance to restore it.

We should add logic to the SDK to detect this during publish and warn if the package hasn't already been restored.