Fix trimmed publish test restore coupling (#3573) (#3638)

Author: Widthdom

TESTING_GUIDE.md

@@ -51,9 +51,9 @@ The test project mirrors the production areas closely.
 - `SymbolExtractorTests.Extract_CSharp_InstallScriptFixture_CompletesWithinPracticalBudget`
   is a coarse runaway guard for the real `InstallScriptTests.cs` C# extraction fixture. Its wall-clock budget is intentionally broader than a benchmark so slower or noisy CI hosts do not fail the suite for ordinary variance.
 - `IndexCommandRunnerTests.RunBackfillFold_PublishedTrimmedBinary_SerializesSuccessAndErrorJson`
-  publishes a trimmed RID-specific CLI and runs whichever entry point the SDK emits (`cdidx.dll` through `dotnet` or the native `cdidx`/`cdidx.exe` apphost). It is reported as skipped on macOS arm64 while SDK/ILLink can crash before exercising `cdidx` (#2586). Do not assume every SDK/runtime pair writes a `cdidx.dll` into self-contained publish output.
+  publishes a trimmed RID-specific CLI and runs whichever entry point the SDK emits (`cdidx.dll` through `dotnet` or the native `cdidx`/`cdidx.exe` apphost). Its publish smoke disables NuGet vulnerability auditing because package advisory validation is covered by the normal build/test workflow's package vulnerability check, not by this runtime serialization test. It is reported as skipped on macOS arm64 while SDK/ILLink can crash before exercising `cdidx` (#2586). Do not assume every SDK/runtime pair writes a `cdidx.dll` into self-contained publish output.
 - `QueryCommandRunnerTests.RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson`
-  uses the same trimmed RID-specific publish path to verify query JSON success and error payloads. If `dotnet publish` reaches an SDK/ILLink tool that requires an unavailable `Microsoft.NETCore.App` runtime, the test is reported as skipped with that missing-runtime diagnostic instead of failing before it can exercise `cdidx` (#3571).
+  uses the trimmed RID-specific publish path for query JSON coverage, writes publish-specific lock files under the test's temporary intermediate directory, disables NuGet vulnerability auditing for the publish smoke, and runs whichever `cdidx` entry point the SDK emits so the test does not depend on source-tree lock-file mutation, advisory-feed availability, or a DLL-only publish layout. If `dotnet publish` reaches an SDK/ILLink tool that requires an unavailable `Microsoft.NETCore.App` runtime, the test is reported as skipped with that missing-runtime diagnostic instead of failing before it can exercise `cdidx` (#3571). It is also reported as skipped on macOS arm64 because the SDK/ILLink crash happens before the test reaches `cdidx` (#2586).
 - `QueryCommandRunnerTests.RunPublishedTrimmedCli_SearchSupportsCSharpRazorAliases`
   uses the same trimmed RID-specific publish path to verify C# Razor language aliases. It is also reported as skipped on macOS arm64 because the SDK/ILLink crash happens before the test reaches `cdidx`.
 - `McpServerTests.cs`
@@ -259,9 +259,9 @@ dotnet test --filter "FullyQualifiedName~GitHelperTests"
 - `SymbolExtractorTests.Extract_CSharp_InstallScriptFixture_CompletesWithinPracticalBudget`
   は実ファイル `InstallScriptTests.cs` を C# 抽出に通す coarse な runaway guard です。wall-clock の予算は benchmark より意図的に広く取り、遅い / 混雑した CI host で通常の揺れだけにより suite が失敗しないようにしています。
 - `IndexCommandRunnerTests.RunBackfillFold_PublishedTrimmedBinary_SerializesSuccessAndErrorJson`
-  は trimmed な RID 固有 CLI を publish し、SDK が生成した entry point（`dotnet` 経由の `cdidx.dll`、または native の `cdidx`/`cdidx.exe` apphost）を実行します。macOS arm64 では SDK/ILLink が `cdidx` に到達する前にクラッシュし得るため、このテストは skipped として報告されます（#2586）。self-contained publish output に常に `cdidx.dll` が出るとは仮定しないでください。
+  は trimmed な RID 固有 CLI を publish し、SDK が生成した entry point（`dotnet` 経由の `cdidx.dll`、または native の `cdidx`/`cdidx.exe` apphost）を実行します。この publish smoke は NuGet 脆弱性監査を無効化します。package advisory の検証は通常の build/test workflow の package vulnerability check が担い、この runtime serialization テストの責務ではないためです。macOS arm64 では SDK/ILLink が `cdidx` に到達する前にクラッシュし得るため、このテストは skipped として報告されます（#2586）。self-contained publish output に常に `cdidx.dll` が出るとは仮定しないでください。
 - `QueryCommandRunnerTests.RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson`
-  は同じ trimmed RID 固有 publish 経路で query JSON の成功 payload と error payload を検証します。`dotnet publish` が、利用できない `Microsoft.NETCore.App` runtime を必要とする SDK/ILLink tool に到達した場合は、`cdidx` を実行する前に失敗させるのではなく、その missing-runtime diagnostic を付けて skipped として報告します（#3571）。
+  は query JSON coverage のために trimmed な RID 固有 publish 経路を使い、publish 専用の lock file をテストの一時 intermediate directory 配下に書き、publish smoke の NuGet 脆弱性監査を無効化し、SDK が生成した `cdidx` entry point を実行します。source tree の lock file 変更、advisory feed の可用性、DLL 固定の publish layout には依存しません。`dotnet publish` が、利用できない `Microsoft.NETCore.App` runtime を必要とする SDK/ILLink tool に到達した場合は、`cdidx` を実行する前に失敗させるのではなく、その missing-runtime diagnostic を付けて skipped として報告します（#3571）。このテストも macOS arm64 では、`cdidx` に到達する前に SDK/ILLink がクラッシュし得るため skipped として報告されます（#2586）。
 - `QueryCommandRunnerTests.RunPublishedTrimmedCli_SearchSupportsCSharpRazorAliases`
   は同じ trimmed RID 固有 publish 経路で C# Razor の言語 alias を検証します。このテストも macOS arm64 では、`cdidx` に到達する前に SDK/ILLink がクラッシュし得るため skipped として報告されます。
 - `McpServerTests.cs`

changelog.d/unreleased/3573.fixed.md

@@ -0,0 +1,17 @@
+---
+category: fixed
+issues:
+  - 3573
+affected:
+  - tests/CodeIndex.Tests/IndexCommandRunnerTests.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerTests.cs
+  - TESTING_GUIDE.md
+---
+
+## English
+
+- **Published trimmed CLI tests no longer assume live restore advisory state (#3573)** — the trimmed-publish smoke tests now use publish-specific lock files, disable NuGet vulnerability auditing for the smoke publish, run whichever `cdidx` entry point the SDK emits, and apply the existing macOS arm64 SDK/ILLink skip to the query JSON smoke test.
+
+## 日本語
+
+- **公開済み trimmed CLI テストが live restore advisory 状態を仮定しないようになりました (#3573)** — trimmed-publish smoke テストは publish 専用の lock file を使い、smoke publish の NuGet 脆弱性監査を無効化し、SDK が生成した `cdidx` entry point を実行し、既存の macOS arm64 SDK/ILLink skip を query JSON smoke test にも適用するようになりました。

tests/CodeIndex.Tests/IndexCommandRunnerTests.cs

@@ -11290,6 +11290,7 @@ private static string PublishTrimmedCli(string outputDir, bool publishSingleFile
         psi.ArgumentList.Add($"-p:OutputPath={buildOutputDir}");
         psi.ArgumentList.Add($"-p:IntermediateOutputPath={intermediateDir}");
         psi.ArgumentList.Add($"-p:NuGetLockFilePath={lockFilePath}");
+        psi.ArgumentList.Add("-p:NuGetAudit=false");
         psi.ArgumentList.Add("-p:UseSharedCompilation=false");
 
         using var process = System.Diagnostics.Process.Start(psi)

tests/CodeIndex.Tests/QueryCommandRunnerTests.cs

@@ -1373,7 +1373,7 @@ public void RunSearchAndSymbols_AcceptPythonPyLangAlias()
 
 
 
-    [Fact]
+    [SkipOnMacOsArm64Fact]
     public void RunPublishedTrimmedCli_SerializesQueryJsonAndErrorJson()
     {
         var projectRoot = TestProjectHelper.CreateTempProject("cdidx_query_trimmed_publish");
@@ -5334,9 +5334,9 @@ private static (int ExitCode, string StdOut, string StdErr) RunBuiltCli(string[]
         return (process.ExitCode, stdOut, stdErr);
     }
 
-    private static (int ExitCode, string StdOut, string StdErr) RunPublishedCli(string publishedDll, string workingDirectory, params string[] args)
+    private static (int ExitCode, string StdOut, string StdErr) RunPublishedCli(string publishedCli, string workingDirectory, params string[] args)
     {
-        var psi = new System.Diagnostics.ProcessStartInfo("dotnet")
+        var psi = new System.Diagnostics.ProcessStartInfo
         {
             WorkingDirectory = workingDirectory,
             RedirectStandardInput = true,
@@ -5345,7 +5345,16 @@ private static (int ExitCode, string StdOut, string StdErr) RunPublishedCli(stri
             UseShellExecute = false,
             CreateNoWindow = true,
         };
-        psi.ArgumentList.Add(publishedDll);
+        if (Path.GetExtension(publishedCli).Equals(".dll", StringComparison.OrdinalIgnoreCase))
+        {
+            psi.FileName = "dotnet";
+            psi.ArgumentList.Add(publishedCli);
+        }
+        else
+        {
+            psi.FileName = publishedCli;
+        }
+
         foreach (var arg in args)
             psi.ArgumentList.Add(arg);
         SanitizeChildCliEnvironment(psi);
@@ -5389,6 +5398,7 @@ private static string PublishTrimmedCli(string outputDir)
         psi.ArgumentList.Add($"-p:OutputPath={buildOutputDir}");
         psi.ArgumentList.Add($"-p:IntermediateOutputPath={intermediateDir}");
         psi.ArgumentList.Add($"-p:NuGetLockFilePath={lockFilePath}");
+        psi.ArgumentList.Add("-p:NuGetAudit=false");
         psi.ArgumentList.Add("-p:UseSharedCompilation=false");
 
         using var process = System.Diagnostics.Process.Start(psi)
@@ -5405,11 +5415,16 @@ private static string PublishTrimmedCli(string outputDir)
             throw new InvalidOperationException($"dotnet publish failed: {output}");
         }
 
+        var publishedAppHost = Path.Combine(outputDir, OperatingSystem.IsWindows() ? "cdidx.exe" : "cdidx");
+        if (File.Exists(publishedAppHost))
+            return publishedAppHost;
+
         var publishedDll = Path.Combine(outputDir, "cdidx.dll");
-        if (!File.Exists(publishedDll))
-            throw new InvalidOperationException($"Published cdidx.dll not found at {publishedDll}");
+        if (File.Exists(publishedDll))
+            return publishedDll;
 
-        return publishedDll;
+        throw new InvalidOperationException(
+            $"Published cdidx entry point not found. Expected {publishedDll} or {publishedAppHost}");
     }
 
     private static bool IsMissingDotNetRuntimeFailure(string output)