Add ArtifactsPath to SourceRoot for deterministic builds outside repo

[Copilot]

Implementation Plan

• Understand the issue: When ArtifactsPath is outside repo root, generated files (e.g., Project.Version.cs) aren't escaped properly in PDBs
• Find the correct location to add SourceRoot for ArtifactsPath
• Implement the fix: Add ArtifactsPath to SourceRoot items in MSBuild targets
• Create tests to verify the fix works
• Build the SDK to verify no compilation errors
• Run tests to validate the implementation
• Run code review and security checks
• Merge main and resolve conflicts
• Complete the task

Summary

Successfully merged origin/main into the PR branch and resolved conflicts in the test file. The merge preserved:

1. All tests from main that verify SourceRoot using GetValuesCommand
2. The additional test for external ArtifactsPath scenario

The implementation adds ArtifactsPath to SourceRoot items in Microsoft.NET.DefaultOutputPaths.targets, ensuring proper source mapping for deterministic builds when artifacts are outside the repository root.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Custom ArtifactsPath outside repo does not add SourceRoot, making build not reproducible</issue_title>
<issue_description><!--
Please keep in mind that the GitHub issue tracker is not intended as a general support forum, but for reporting non-security bugs and feature requests.

If you believe you have an issue that affects the SECURITY of the platform, please do NOT create an issue and instead email your issue details to secure@microsoft.com. Your report may be eligible for our bug bounty but ONLY if it is reported through email.
For other types of questions, consider using StackOverflow.

-->

Describe the bug

When setting ArtifactsPath to a location outside a repo root, generated files in the obj dir (e.g. Project.Version.cs) are not escaped properly and have the full path in the pdb instead of _1/, _2, etc.

To Reproduce

In an AzDo pipeline, create a package with dotnet pack -p:ArtifactsPath=$(Build.ArtifactStagingDirectory) and examine the result in NuGet Package Explorer. In AzDo, the Build.ArtifactStagingDirectory location lives outside of the source location.

Exceptions (if any)

Further technical details

Tested with .NET SDK 10 RC2

Workaround

Adding this into the Directory.Build.targets solves it:

<SourceRoot Condition="'$(ArtifactsPath)' != '' and !HasTrailingSlash('$(ArtifactsPath)')" Include="$(ArtifactsPath)\" />
<SourceRoot Condition="'$(ArtifactsPath)' != '' and HasTrailingSlash('$(ArtifactsPath)')" Include="$(ArtifactsPath)" />
```</issue_description>

<agent_instructions>When we set ArtifactsPath, let's add it to SourceRoot. Can you add a test as well?</agent_instructions>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes Custom ArtifactsPath outside repo does not add SourceRoot, making build not reproducible #51551

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[marcpopMSFT]

@tmat I believe you know source link well so may know if this is the right solution here. I just had copilot follow what the original issue stated but wanted someone to confirm.

[marcpopMSFT]

@copilot there are merge conflicts with origin/main. Can you merge that in and fix the conflicts?

[baronfel]

@marcpopMSFT I think I actually got this fixed in a separate issue report + PR last week. Yeah, it was in #52640 - there's also a Roslyn PR coming so that Roslyn does path abolutization as part of this effort as well.

[Copilot]

@copilot there are merge conflicts with origin/main. Can you merge that in and fix the conflicts?

Merged origin/main and resolved conflicts in commit 3cef343. The conflict was in the test file where main added two tests (ArtifactsPathIsAddedAsSourceRoot and ArtifactsPathIsAddedAsSourceRootWithRelativePath). I kept all tests from main and added my test as ArtifactsPathOutsideRepoIsAddedAsSourceRoot to specifically test the external artifacts path scenario from the original issue.

[marcpopMSFT]

Looks indeed like you already took care of this, closing.