Fix WASM boot config ContentRoot to use IntermediateOutputPath by lewing · Pull Request #124125 · dotnet/runtime

lewing · 2026-02-07T03:23:05Z

Summary

Fix a .NET 11 regression causing SRI integrity failures during incremental Blazor WASM builds. Changes in Microsoft.NET.Sdk.WebAssembly.Browser.targets:

Boot config ContentRoot: Change the boot config's DefineStaticWebAssets ContentRoot from $(OutDir)wwwroot to $(IntermediateOutputPath)
Preload matching: Replace fragile %(FileName)%(Extension)-based scanning with direct references to the boot config output items
WebCil ContentRoot (build-time): Use per-item ContentRoot="%(RootDir)%(Directory)" on _WebCilAssetsCandidates so each asset's Identity resolves to its actual file path on disk
WebCil ContentRoot (publish-time): Add per-item ContentRoot="%(RootDir)%(Directory)" on both _NewWebCilPublishStaticWebAssetsCandidatesNoMetadata and _PromotedWasmPublishStaticWebAssets — the same fix applied to publish candidates

Regression

This is a regression in .NET 11 (works in 10.0). It was introduced by dotnet/sdk#52283, which fixed an esproj compression bug by flipping the order in AssetToCompress.TryFindInputFilePath to prefer RelatedAsset (Identity) over RelatedAssetOriginalItemSpec. That fix was correct for esproj, but exposed a latent issue in the WASM SDK targets: the boot config and webcil assets' Identity pointed to a wwwroot copy rather than the actual source files.

Before sdk#52283, OriginalItemSpec happened to point to the real file and was checked first, masking the wrong ContentRoot. After the flip, RelatedAsset (Identity) is checked first, and its stale wwwroot path is used — producing incorrect SRI hashes on incremental builds.

Reported in aspnetcore#65271.

Problem

The WASM boot config file (e.g. dotnet.boot.js) is generated at $(IntermediateOutputPath) (the obj/ folder), but its static web asset was defined with ContentRoot="$(OutDir)wwwroot". This caused DefineStaticWebAssets to compute an Identity pointing to the wwwroot copy rather than the actual file in obj/.

The same issue applied to WebCil asset candidates — files from obj/webcil/, the runtime pack, and other directories were all defined with ContentRoot="$(OutputPath)wwwroot", producing synthetic Identities under wwwroot/ that could become stale during incremental builds.

Fix

1. Boot config ContentRoot

Change ContentRoot to $(IntermediateOutputPath) so the asset Identity matches the real file location on disk. The CopyToOutputDirectory="PreserveNewest" attribute still ensures the file is copied to wwwroot for serving.

This follows Javier's suggestion in dotnet/sdk#52847 to "stop defining these assets with an item spec in the wwwroot folder and just define them in their original location on disk".

2. Preload matching simplification

The _AddWasmPreloadBuildProperties and _AddWasmPreloadPublishProperties targets previously scanned all @(StaticWebAsset) items by %(FileName)%(Extension) to find the boot config asset. This relied on the Identity path containing the fingerprint in the filename, which is an implementation detail of how DefineStaticWebAssets computes Identity based on ContentRoot.

The fix replaces the scanning with direct references to @(_WasmBuildBootConfigStaticWebAsset) and @(_WasmPublishBootConfigStaticWebAsset) — the output items already produced by DefineStaticWebAssets. This is both correct and simpler.

3. WebCil per-item ContentRoot (build-time)

Instead of using a single task-level ContentRoot parameter (which forces all candidates through the same ContentRoot path, causing synthesized Identity for files outside that directory), set per-item ContentRoot="%(RootDir)%(Directory)" on each _WebCilAssetsCandidates item. This means:

WebCil-converted files in obj/webcil/ → ContentRoot = their parent dir → FullPath.StartsWith(ContentRoot) = true → Identity = real FullPath ✅
Runtime pack files (e.g. dotnet.native.js, ICU .dat) → ContentRoot = their parent dir in the runtime pack → FullPath.StartsWith(ContentRoot) = true → Identity = real FullPath ✅

No synthesized paths, no CopyCandidate entries — every asset's Identity is its actual file on disk.

4. WebCil per-item ContentRoot (publish-time)

The publish DefineStaticWebAssets call in ProcessPublishFilesForWasm previously had no ContentRoot at all — neither task-level nor per-item. This caused publish candidates (especially promoted build assets with fingerprint placeholders in their RelativePath) to have their fingerprinted filename baked into the item spec as Identity, producing paths like dotnet.native.7z98fd2ohl.wasm that don't exist on disk → MSB3030 "Could not copy file".

The fix adds per-item ContentRoot="%(RootDir)%(Directory)" on both:

_NewWebCilPublishStaticWebAssetsCandidatesNoMetadata (freshly WebCil-converted publish files)
_PromotedWasmPublishStaticWebAssets (build assets promoted to publish)

Why this works: Promoted assets carry AssetKind=Build from the build-time DefineStaticWebAssets. In DefineStaticWebAssets.cs line 252: IsPublish("Build") = false, so contentRoot is NOT nulled for publish. The per-item ContentRoot = each file's parent directory → candidateFullPath.StartsWith(contentRoot) = true → computed=false → Identity = real FullPath on disk.

What's not changed

Publish boot config ContentRoot (ContentRoot="$(PublishDir)wwwroot"): Publish builds are clean and don't have the incremental staleness problem.

Build Progression

#	Approach	Build Result	Why
1-3	Boot config + preload only	✅ Pass	No WebCil changes
4-5	Per-item ContentRoot (build only)	❌ Fail	Build works, but publish has no ContentRoot → MSB3030
6	Task-level IntermediateOutputPath	❌ Fail	Runtime pack files outside IntermediateOutputPath → synthesized Identity → MSB3030
7	Per-item ContentRoot (build + publish)	🔄 Pending	This commit — applies the fix to both build and publish

Fixes dotnet/aspnetcore#65271

Copilot

Pull request overview

Updates the Blazor WASM SDK targets to define the build boot config static web asset from its actual on-disk generation location (obj/) to prevent stale-asset Identity selection during incremental builds (which can lead to incorrect SRI integrity values at runtime).

Changes:

Change DefineStaticWebAssets ContentRoot for the build boot config asset from $(OutDir)wwwroot to $(IntermediateOutputPath).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Canceled AzDO jobs (typically from timeouts) still have pipeline artifacts containing binlogs. The SendToHelix.binlog contains Helix job IDs that can be queried directly to recover actual test results. Discovered while investigating PR #124125 where a 3-hour timeout caused a WasmBuildTests job to be canceled, but all 226 Helix work items had actually passed.

lewing · 2026-02-08T01:29:45Z

Canceled WasmBuildTests actually passed ✅

The browser-wasm windows Release WasmBuildTests job in build 1284169 was canceled after the 3-hour timeout, but all Helix work items completed successfully.

Recovery steps:

Downloaded the Logs_Build_Attempt1_browser_wasm_windows_Release_WasmBuildTests pipeline artifact
Loaded the truncated \SendToHelix.binlog\ and extracted 12 Helix job IDs
Queried each job via Helix API — all 226 work items passed (0 failures)

Scenario	Server2022	Server2025
NoWorkload-ST	✅ 2/2	✅ 2/2
NoWebcil-ST	✅ 53/53 + 2/2	✅ 53/53 + 2/2
Workloads-ST	✅ 53/53	✅ 53/53
NoFingerprint-ST	✅ 2/2 + 2/2	✅ 2/2 + 2/2

The failure was purely the AzDO job wrapper timing out while waiting to collect results, not an actual test failure.

Canceled AzDO jobs (typically from timeouts) still have pipeline artifacts containing binlogs. The \SendToHelix.binlog\ contains Helix job IDs that can be queried directly to recover actual test results. ## What changed - Added **Recovering Results from Canceled Jobs** section to helix skill SKILL.md - Documents the workflow: download artifacts → load binlog → extract Helix job IDs → query Helix API - Includes concrete example from PR #124125 (226 work items all passed despite 3h timeout cancellation) - Added tip about binlog MCP server for structured binlog analysis ## Context Discovered while investigating #124125 where \�rowser-wasm windows Release WasmBuildTests\ was canceled after 3 hours. The script reported no failures (correct — no *failed* jobs) but also couldn't surface that the tests actually passed. With the documented recovery workflow, the Helix results were fully recoverable.

...nuget/Microsoft.NET.Sdk.WebAssembly.Pack/build/Microsoft.NET.Sdk.WebAssembly.Browser.targets

lewing · 2026-02-26T23:17:39Z

Addressed CCA review feedback in latest commit:

Full filename matching (ComputeWasmPublishAssets.cs): UpdateRelatedAssetProperty now matches by full filename with extension (with webcil .wasm to .dll normalization) instead of base name only, preventing ambiguity between .dll/.pdb files.
Absolute path normalization (LinkContentToWwwroot.cs): Added Path.IsPathRooted check with Path.GetFullPath(identity, MSBuildProjectDirectory) fallback for relative paths in ContentRoot computation.
Hard-coded line number: Replaced (line 448) reference with (above).
Fingerprint/Integrity empty strings: Investigated RemoveMetadata approach but it requires Include, and using Include on the same item group duplicates all items. Empty string via Update is intentional - DefineStaticWebAssets treats it as recompute.

Resolve conflict in Microsoft.NET.Sdk.WebAssembly.Browser.targets: - Adopt upstream Webcil casing (lowercase 'c') for property names - Keep PR's removal of _WasmBuildOuputPath - Fix casing in per-item ContentRoot Update lines to match Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/ComputeWasmPublishAssets.cs

The upstream Webcil casing change renamed the property to IsWebcilEnabled (lowercase 'c'), but the conflict resolution left references using the old IsWebCilEnabled casing, causing CS0103 build errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

…PublishAssets.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/ComputeWasmPublishAssets.cs

Canceled AzDO jobs (typically from timeouts) still have pipeline artifacts containing binlogs. The \SendToHelix.binlog\ contains Helix job IDs that can be queried directly to recover actual test results. ## What changed - Added **Recovering Results from Canceled Jobs** section to helix skill SKILL.md - Documents the workflow: download artifacts → load binlog → extract Helix job IDs → query Helix API - Includes concrete example from PR dotnet#124125 (226 work items all passed despite 3h timeout cancellation) - Added tip about binlog MCP server for structured binlog analysis ## Context Discovered while investigating dotnet#124125 where \�rowser-wasm windows Release WasmBuildTests\ was canceled after 3 hours. The script reported no failures (correct — no *failed* jobs) but also couldn't surface that the tests actually passed. With the documented recovery workflow, the Helix results were fully recoverable.

## Summary Work around [dotnet/dnceng#6072](dotnet/dnceng#6072) in the CI analysis skill by using the Helix \ListFiles\ endpoint instead of file URIs from the \Details\ endpoint. ## Problem The Helix work item Details API (\GET .../workitems/{id}\) has two bugs in its \Files[].Uri\ values: 1. **Subdirectory flattening**: Files uploaded from subdirectories (e.g. \xharness-output/logs/test/build.binlog\) get URIs with only the base filename (\.../files/build.binlog\), so multiple distinct files with the same base name collide 2. **Unicode rejection**: The \/files/{name}\ endpoint validates against an ASCII-only regex, rejecting filenames containing unicode characters (e.g. CJK test directory names like \鿀蜒枛遫䡫煉\) The previous workaround reconstructed permalink URIs from the \FileName\ field, but this still routed through the broken \/files/\ endpoint which rejects unicode. ## Fix Use the separate \ListFiles\ endpoint (\GET .../workitems/{id}/files\) which returns direct blob storage URIs. These URIs: - Preserve full subdirectory paths - Have properly percent-encoded unicode - Don't route through the permalink/regex validation layer Verified against PR dotnet#124125 CI artifacts: 53 files with unicode paths all return HTTP 200 via ListFiles blob URIs, vs broken/colliding URIs from the Details endpoint.

…on guides (dotnet#124240) ## ci-analysis: structured output, MCP integration, and deep investigation guides ### Changes to `Get-CIStatus.ps1` (+216/-132) - **Add `[CI_ANALYSIS_SUMMARY]` JSON block** — structured summary emitted at end of script with all key facts (builds, failed jobs, known issues, PR correlation, recommendation hint) - **Replace 47-line if/elseif recommendation chain** with a single `recommendationHint` field in JSON (one of: `BUILD_SUCCESSFUL`, `KNOWN_ISSUES_DETECTED`, `LIKELY_PR_RELATED`, `POSSIBLY_TRANSIENT`, `REVIEW_REQUIRED`, `MERGE_CONFLICTS`, `NO_BUILDS`) - **Add `failedJobDetails` to JSON** — per-job `errorCategory` (test-failure, build-error, test-timeout, crash, tests-passed-reporter-failed, unclassified), `errorSnippet`, and `helixWorkItems` - **Add `failedJobDetailsTruncated`** — boolean flag indicating when `-MaxJobs` cap means `failedJobDetails` is incomplete vs `failedJobNames` - **Add top-level `knownIssues`** from Build Analysis (not per-job — Build Analysis reports at the PR level, not per-job) - **Add timeout pattern** to `Format-TestFailure` — catches `Timed Out (timeout` that was previously invisible - **Show log tail in PR mode** when no failure pattern matches (Helix Job mode already did this) - **Add accumulation variables** for cross-build aggregation (`totalFailedJobs`, `totalLocalFailures`, `lastBuildJobSummary`) - **Fix early-continue scoping bug** — job summary computation was at end of build loop, after 3 `continue` paths that skipped it - **Fix empty array falsy check** — `if ($listFiles)` → proper count check - **Fix `mergeable_state` trimming** — `gh api --jq` output trimmed to prevent whitespace comparison failures - **Remove interpretive prose** — "These failures are likely PR-related" moved from script to agent reasoning - **Fix empty catch** — merge state error now logged via `Write-Verbose` ### Changes to `SKILL.md` (+97/-144, net reduction) - **Add Step 0: Gather Context** — PR type classification table (code, flow, backport, merge, dependency update) - **Add Step 3: Verify before claiming** — systematic checklist - **Add build progression analysis** (Step 2, item 4) — comparing pass/fail across PR builds to narrow down which commit introduced a failure - **Add prior-build mismatch detection** (Step 2, item 6) — ask user when they reference jobs not in current results - **Document `failedJobDetails`** — per-failure error categories in Interpreting Results - **Add Build Analysis check status enforcement** — red check means unaccounted failures exist, never claim "all known" when it's red - **Add timeout recovery workflow** — explicit guidance for verifying timed-out builds have passing Helix results via `hlx_status` - **Add crash/canceled job recovery procedure** — step-by-step using `hlx_batch_status`, `hlx_files`, `hlx_download_url` to recover results from crashed Helix work items - **Fix MCP tool references** — use canonical short-form tool names consistently - **Condense anti-patterns** — tighter, more targeted, near relevant steps - **Net token reduction** — despite adding new content, SKILL.md shrank from ~4.6K to ~3.5K tokens ### New reference files - `references/azure-cli.md` — Azure CLI deep investigation guide - `references/binlog-comparison.md` — binlog comparison workflow - `references/delegation-patterns.md` — subagent delegation patterns (5 patterns including parallel artifact extraction and canceled job recovery) - `references/build-progression-analysis.md` — commit-to-build correlation using `triggerInfo.pr.sourceSha`, SQL-based progression tracking, MCP-first with AzDO MCP tools as primary ### Updated reference files - `references/manual-investigation.md` — fix nonexistent `msbuild-mcp analyze` tool refs, use real `mcp-binlog-tool-*` tools ### Design principles - **Data/reasoning boundary**: Script emits structured JSON facts → agent synthesizes recommendations. No more canned prose from the script. - **MCP-first**: AzDO MCP tools (`get_builds`, `get_build_log_by_id`) and Helix MCP tools (`hlx_status`, `hlx_logs`) positioned as primary, CLI/script as fallback. - **Token budget**: Orchestrating SKILL.md kept within 2K-4K token budget by extracting depth to `references/`. - **SQL for structured investigations**: Build progression tracking uses SQL tables to persist SHAs across context, enabling queries for pass→fail transitions and target branch movement. ### Testing - Multi-model subagent testing (Sonnet 4 + GPT-5 + Opus 4.5) — two review rounds with findings addressed - Live MCP integration test confirmed `hlx_status`, `hlx_logs`, `get_builds`, `get_build_log_by_id` all work - Real-world validation against PRs dotnet#123245, dotnet#123883, dotnet#124125, dotnet#124232

PR dotnet#124905 renamed IsWebCilEnabled to IsWebcilEnabled on main. The merge auto-resolved the parameter name but the error message string interpolation still referenced the old casing. Also improved the error message to include asset details and used 'is null' pattern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

lewing · 2026-03-02T23:36:48Z

/ba-g failure is an OOM we see without this PR too

Copilot AI review requested due to automatic review settings February 7, 2026 03:23

dotnet-policy-service bot assigned lewing Feb 7, 2026

github-actions bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Feb 7, 2026

Copilot started reviewing on behalf of lewing February 7, 2026 03:23 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

lewing requested a review from javiercn February 7, 2026 03:33

lewing marked this pull request as ready for review February 7, 2026 03:33

lewing requested a review from akoeplinger as a code owner February 7, 2026 03:33

lewing mentioned this pull request Feb 7, 2026

Fix SRI integrity failures in Blazor WASM incremental builds dotnet/sdk#52847

Closed

lewing assigned javiercn Feb 7, 2026

lewing requested a review from maraf February 7, 2026 03:49

lewing assigned javiercn and unassigned javiercn and lewing Feb 7, 2026

lewing added arch-wasm WebAssembly architecture area-Meta os-browser Browser variant of arch-wasm and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Feb 7, 2026

Copilot AI review requested due to automatic review settings February 7, 2026 16:43

Copilot started reviewing on behalf of lewing February 7, 2026 16:44 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

This was referenced Feb 7, 2026

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

[android-arm64] The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#6408

Open

lewing mentioned this pull request Feb 8, 2026

Document canceled job recovery in helix Copilot skill #124135

Merged

javiercn reviewed Feb 9, 2026

View reviewed changes

...nuget/Microsoft.NET.Sdk.WebAssembly.Pack/build/Microsoft.NET.Sdk.WebAssembly.Browser.targets Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 9, 2026 15:10

build-analysis bot mentioned this pull request Feb 27, 2026

[wasm] OpenQA.Selenium.WebDriverTimeoutException: timeout: Timed out receiving message from renderer #117486

Open

Copilot AI review requested due to automatic review settings February 27, 2026 23:21

Copilot AI reviewed Feb 27, 2026

View reviewed changes

src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/ComputeWasmPublishAssets.cs Outdated Show resolved Hide resolved

lewing and others added 2 commits February 27, 2026 21:47

Merge branch 'main' into fix/wasm-compression-stale-files

c181cdc

Copilot AI review requested due to automatic review settings February 28, 2026 17:40

Copilot started reviewing on behalf of lewing February 28, 2026 17:42 View session

Copilot AI reviewed Feb 28, 2026

View reviewed changes

build-analysis bot mentioned this pull request Feb 28, 2026

[mono] The type initializer for System.Drawing.DrawingCom threw an exception: Operation is not supported on this platform #110150

Open

lewing mentioned this pull request Mar 1, 2026

CharClassSubtraction_DeepNesting_DoesNotStackOverflow fails with PlatformNotSupportedException on browser-wasm (NonBacktracking) #125020

Closed

lewing and others added 2 commits March 1, 2026 12:04

Merge branch 'main' into fix/wasm-compression-stale-files

05984d9

Update src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/ComputeWasm…

eaac3d1

…PublishAssets.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 2, 2026 01:14

lewing enabled auto-merge (squash) March 2, 2026 01:14

Copilot started reviewing on behalf of lewing March 2, 2026 01:15 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/ComputeWasmPublishAssets.cs Outdated Show resolved Hide resolved

build-analysis bot mentioned this pull request Mar 2, 2026

[android][arm64] System.Net.Sockets.Tests.SendTo_SyncForceNonBlocking.Datagram_UDP_ShouldImplicitlyBindLocalEndpoint fails with NetworkUnreachable #120526

Open

lewing disabled auto-merge March 2, 2026 23:37

lewing enabled auto-merge (squash) March 2, 2026 23:37

lewing disabled auto-merge March 2, 2026 23:37

lewing merged commit 264cff6 into dotnet:main Mar 2, 2026
37 of 39 checks passed

lewing deleted the fix/wasm-compression-stale-files branch March 2, 2026 23:41

dotnet-maestro bot mentioned this pull request Mar 3, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#5186

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix WASM boot config ContentRoot to use IntermediateOutputPath#124125

Fix WASM boot config ContentRoot to use IntermediateOutputPath#124125
lewing merged 18 commits intodotnet:mainfrom
lewing:fix/wasm-compression-stale-files

lewing commented Feb 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

lewing commented Feb 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

lewing commented Feb 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

lewing commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

lewing commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Regression

Problem

Fix

1. Boot config ContentRoot

2. Preload matching simplification

3. WebCil per-item ContentRoot (build-time)

4. WebCil per-item ContentRoot (publish-time)

What's not changed

Build Progression

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

lewing commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Canceled WasmBuildTests actually passed ✅

Uh oh!

Uh oh!

lewing commented Feb 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

lewing commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lewing commented Feb 7, 2026 •

edited

Loading

lewing commented Feb 8, 2026 •

edited

Loading