Fix WASM boot config ContentRoot to use IntermediateOutputPath #124125

lewing · 2026-02-07T03:23:05Z

Summary

Fix a .NET 11 regression causing SRI integrity failures during incremental Blazor WASM builds. Three changes in Microsoft.NET.Sdk.WebAssembly.Browser.targets:

Boot config ContentRoot: Change the boot config's DefineStaticWebAssets ContentRoot from $(OutDir)wwwroot to $(IntermediateOutputPath)
Preload matching: Replace fragile %(FileName)%(Extension)-based scanning with direct references to the boot config output items
WebCil ContentRoot: Change the WebCil DefineStaticWebAssets ContentRoot from $(_WasmBuildOuputPath) ($(OutputPath)wwwroot) to $(IntermediateOutputPath)

Regression

This is a regression in .NET 11 (works in 10.0). It was introduced by dotnet/sdk#52283, which fixed an esproj compression bug by flipping the order in AssetToCompress.TryFindInputFilePath to prefer RelatedAsset (Identity) over RelatedAssetOriginalItemSpec. That fix was correct for esproj, but exposed a latent issue in the WASM SDK targets: the boot config and webcil assets' Identity pointed to a wwwroot copy rather than the actual source files.

Before sdk#52283, OriginalItemSpec happened to point to the real file and was checked first, masking the wrong ContentRoot. After the flip, RelatedAsset (Identity) is checked first, and its stale wwwroot path is used — producing incorrect SRI hashes on incremental builds.

Reported in aspnetcore#65271.

Problem

The WASM boot config file (e.g. dotnet.boot.js) is generated at $(IntermediateOutputPath) (the obj/ folder), but its static web asset was defined with ContentRoot="$(OutDir)wwwroot". This caused DefineStaticWebAssets to compute an Identity pointing to the wwwroot copy rather than the actual file in obj/.

The same issue applied to WebCil asset candidates — files from obj/webcil/, the runtime pack, and other directories were all defined with ContentRoot="$(OutputPath)wwwroot", producing synthetic Identities under wwwroot/ that could become stale during incremental builds.

Fix

1. Boot config ContentRoot

Change ContentRoot to $(IntermediateOutputPath) so the asset Identity matches the real file location on disk. The CopyToOutputDirectory="PreserveNewest" attribute still ensures the file is copied to wwwroot for serving.

This follows Javier's suggestion in dotnet/sdk#52847 to "stop defining these assets with an item spec in the wwwroot folder and just define them in their original location on disk".

2. Preload matching simplification

The _AddWasmPreloadBuildProperties and _AddWasmPreloadPublishProperties targets previously scanned all @(StaticWebAsset) items by %(FileName)%(Extension) to find the boot config asset. This relied on the Identity path containing the fingerprint in the filename, which is an implementation detail of how DefineStaticWebAssets computes Identity based on ContentRoot.

The fix replaces the scanning with direct references to @(_WasmBuildBootConfigStaticWebAsset) and @(_WasmPublishBootConfigStaticWebAsset) — the output items already produced by DefineStaticWebAssets. This is both correct and simpler.

3. WebCil ContentRoot

Change the WebCil DefineStaticWebAssets ContentRoot from $(_WasmBuildOuputPath) to $(IntermediateOutputPath). This means:

WebCil-converted files in obj/webcil/ are under $(IntermediateOutputPath), so Identity = physical path (no synthesis needed)
Runtime pack files (e.g. dotnet.native.js, ICU .dat files) are outside $(IntermediateOutputPath), so ComputeCandidateIdentity synthesizes Identity under obj/ and creates CopyCandidate entries to materialize the fingerprinted copies

This avoids the stale wwwroot Identity problem while maintaining correct publish behavior through CopyCandidate materialization.

What's not changed

Publish boot config ContentRoot (ContentRoot="$(PublishDir)wwwroot"): Publish builds are clean and don't have the incremental staleness problem.

Fixes dotnet/aspnetcore#65271

Copilot

Pull request overview

Updates the Blazor WASM SDK targets to define the build boot config static web asset from its actual on-disk generation location (obj/) to prevent stale-asset Identity selection during incremental builds (which can lead to incorrect SRI integrity values at runtime).

Changes:

Change DefineStaticWebAssets ContentRoot for the build boot config asset from $(OutDir)wwwroot to $(IntermediateOutputPath).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Canceled AzDO jobs (typically from timeouts) still have pipeline artifacts containing binlogs. The SendToHelix.binlog contains Helix job IDs that can be queried directly to recover actual test results. Discovered while investigating PR #124125 where a 3-hour timeout caused a WasmBuildTests job to be canceled, but all 226 Helix work items had actually passed.

lewing · 2026-02-08T01:29:45Z

Canceled WasmBuildTests actually passed ✅

The browser-wasm windows Release WasmBuildTests job in build 1284169 was canceled after the 3-hour timeout, but all Helix work items completed successfully.

Recovery steps:

Downloaded the Logs_Build_Attempt1_browser_wasm_windows_Release_WasmBuildTests pipeline artifact
Loaded the truncated \SendToHelix.binlog\ and extracted 12 Helix job IDs
Queried each job via Helix API — all 226 work items passed (0 failures)

Scenario	Server2022	Server2025
NoWorkload-ST	✅ 2/2	✅ 2/2
NoWebcil-ST	✅ 53/53 + 2/2	✅ 53/53 + 2/2
Workloads-ST	✅ 53/53	✅ 53/53
NoFingerprint-ST	✅ 2/2 + 2/2	✅ 2/2 + 2/2

The failure was purely the AzDO job wrapper timing out while waiting to collect results, not an actual test failure.

Canceled AzDO jobs (typically from timeouts) still have pipeline artifacts containing binlogs. The \SendToHelix.binlog\ contains Helix job IDs that can be queried directly to recover actual test results. ## What changed - Added **Recovering Results from Canceled Jobs** section to helix skill SKILL.md - Documents the workflow: download artifacts → load binlog → extract Helix job IDs → query Helix API - Includes concrete example from PR #124125 (226 work items all passed despite 3h timeout cancellation) - Added tip about binlog MCP server for structured binlog analysis ## Context Discovered while investigating #124125 where \�rowser-wasm windows Release WasmBuildTests\ was canceled after 3 hours. The script reported no failures (correct — no *failed* jobs) but also couldn't surface that the tests actually passed. With the documented recovery workflow, the Helix results were fully recoverable.

javiercn · 2026-02-09T11:08:50Z

...nuget/Microsoft.NET.Sdk.WebAssembly.Pack/build/Microsoft.NET.Sdk.WebAssembly.Browser.targets

      CopyToOutputDirectory="PreserveNewest"
      CopyToPublishDirectory="Never"
-      ContentRoot="$(OutDir)wwwroot"
+      ContentRoot="$(IntermediateOutputPath)"


I believe this needs to happen in other places like the definition of the .wasm files as assets (after webcil conversion).

I believe the important bit here is that ContentRoot + RelativePath must exist for all assets

Done. Added a commit that sets per-item ContentRoot metadata on each _WebCilAssetsCandidates item to %(RootDir)%(Directory) (its own directory). This ensures candidateFullPath.StartsWith(normalizedContentRoot) is always true in DefineStaticWebAssets.ComputeCandidateIdentity, so Identity equals the physical file path for all candidates — webcil-converted files in obj/webcil/, runtime pack files in packs/, PDBs from obj/, etc.

The task-level ContentRoot parameter is kept as a fallback but the per-item metadata takes precedence via ComputePropertyValue.

kg · 2026-02-09T16:41:18Z

Bad base commit?

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

lewing · 2026-02-09T19:05:52Z

Bad base commit?

yup, and then github stopped responding

## Summary Work around [dotnet/dnceng#6072](dotnet/dnceng#6072) in the CI analysis skill by using the Helix \ListFiles\ endpoint instead of file URIs from the \Details\ endpoint. ## Problem The Helix work item Details API (\GET .../workitems/{id}\) has two bugs in its \Files[].Uri\ values: 1. **Subdirectory flattening**: Files uploaded from subdirectories (e.g. \xharness-output/logs/test/build.binlog\) get URIs with only the base filename (\.../files/build.binlog\), so multiple distinct files with the same base name collide 2. **Unicode rejection**: The \/files/{name}\ endpoint validates against an ASCII-only regex, rejecting filenames containing unicode characters (e.g. CJK test directory names like \鿀蜒枛遫䡫煉\) The previous workaround reconstructed permalink URIs from the \FileName\ field, but this still routed through the broken \/files/\ endpoint which rejects unicode. ## Fix Use the separate \ListFiles\ endpoint (\GET .../workitems/{id}/files\) which returns direct blob storage URIs. These URIs: - Preserve full subdirectory paths - Have properly percent-encoded unicode - Don't route through the permalink/regex validation layer Verified against PR #124125 CI artifacts: 53 files with unicode paths all return HTTP 200 via ListFiles blob URIs, vs broken/colliding URIs from the Details endpoint.

Change the boot config's DefineStaticWebAssets ContentRoot from wwwroot to so the asset Identity points to the actual file location on disk rather than a stale copy in the output wwwroot folder. This fixes SRI integrity failures during incremental Blazor WASM builds where the compressed boot config used a stale fingerprint from the wwwroot copy instead of the fresh file in obj/. Fixes aspnetcore#65271

Replace the fragile FileName-based scanning of all StaticWebAsset items with direct references to _WasmBuildBootConfigStaticWebAsset and _WasmPublishBootConfigStaticWebAsset. These items are already produced by the DefineStaticWebAssets task in _GenerateBuildWasmBootJson and _AddPublishWasmBootJsonToStaticWebAssets respectively. The previous approach relied on FileName containing the fingerprint (e.g. dotnet.FINGERPRINT.js), which is an implementation detail of how DefineStaticWebAssets computes Identity. Using the pipeline's own output items is correct regardless of ContentRoot or Identity format.

WebCil candidates come from multiple source directories (obj/webcil/ for converted DLLs, runtime pack for native files, etc.) but were all defined with ContentRoot pointing to OutputPath/wwwroot. Use IntermediateOutputPath as ContentRoot instead. Files outside obj/ (e.g., runtime pack native files) get synthesized Identities with CopyCandidates to materialize the fingerprinted copies. Files already under obj/ (webcil-converted DLLs) use their physical path directly. This avoids the stale wwwroot Identity problem that caused SRI integrity failures during incremental builds, while maintaining correct publish behavior through CopyCandidate materialization.

Copilot AI review requested due to automatic review settings February 7, 2026 03:23

dotnet-policy-service bot assigned lewing Feb 7, 2026

github-actions bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Feb 7, 2026

Copilot started reviewing on behalf of lewing February 7, 2026 03:23 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

lewing requested a review from javiercn February 7, 2026 03:33

lewing marked this pull request as ready for review February 7, 2026 03:33

lewing requested a review from akoeplinger as a code owner February 7, 2026 03:33

lewing mentioned this pull request Feb 7, 2026

Fix SRI integrity failures in Blazor WASM incremental builds dotnet/sdk#52847

Closed

lewing assigned javiercn Feb 7, 2026

lewing requested a review from maraf February 7, 2026 03:49

lewing assigned javiercn and unassigned javiercn and lewing Feb 7, 2026

lewing added arch-wasm WebAssembly architecture area-Meta os-browser Browser variant of arch-wasm and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Feb 7, 2026

Copilot AI review requested due to automatic review settings February 7, 2026 16:43

Copilot started reviewing on behalf of lewing February 7, 2026 16:44 View session

Copilot AI reviewed Feb 7, 2026

View reviewed changes

This was referenced Feb 7, 2026

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

[android-arm64] The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#6408

Open

lewing mentioned this pull request Feb 8, 2026

Document canceled job recovery in helix Copilot skill #124135

Merged

javiercn reviewed Feb 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 9, 2026 15:10

lewing requested review from BrzVlad, MichalStrehovsky, janvorli, kg, lateralusX, mdh1418, steveisok, thaystg and vitek-karas as code owners February 9, 2026 15:30

dotnet-policy-service bot added the linkable-framework Issues associated with delivering a linker friendly framework label Feb 9, 2026

lewing force-pushed the fix/wasm-compression-stale-files branch from b649bd9 to dc5c351 Compare February 9, 2026 18:46

Copilot AI review requested due to automatic review settings February 9, 2026 18:46

Copilot started reviewing on behalf of lewing February 9, 2026 18:47 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

This was referenced Feb 9, 2026

Unable to pull image from mcr.microsoft.com #117164

Open

Checkout failure: "Git fetch failed with exit code 128" dotnet/arcade#9009

Open

Unable to checkout dotnet/dnceng#4115

Open

lewing removed the linkable-framework Issues associated with delivering a linker friendly framework label Feb 9, 2026

lewing requested a review from javiercn February 9, 2026 20:41

lewing added this to the 11.0.0 milestone Feb 9, 2026

This was referenced Feb 9, 2026

Use Helix ListFiles endpoint to work around dnceng#6072 #124199

Merged

Helix work item details API doesn't correctly handle subdirectories in the Files key dotnet/dnceng#6072

Open

lewing added 3 commits February 9, 2026 18:26

lewing force-pushed the fix/wasm-compression-stale-files branch from dc5c351 to 2e74845 Compare February 10, 2026 00:28

build-analysis bot mentioned this pull request Feb 10, 2026

[browser] Wasm.Build.Tests timeout - Timed out after 10s waiting for 'WASM EXIT' #116697

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix WASM boot config ContentRoot to use IntermediateOutputPath #124125

Fix WASM boot config ContentRoot to use IntermediateOutputPath #124125

Uh oh!

lewing commented Feb 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

lewing commented Feb 8, 2026 •

edited

Loading

Uh oh!

javiercn Feb 9, 2026

Uh oh!

lewing Feb 9, 2026

Uh oh!

kg commented Feb 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

lewing commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix WASM boot config ContentRoot to use IntermediateOutputPath #124125

Are you sure you want to change the base?

Fix WASM boot config ContentRoot to use IntermediateOutputPath #124125

Uh oh!

Conversation

lewing commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Regression

Problem

Fix

1. Boot config ContentRoot

2. Preload matching simplification

3. WebCil ContentRoot

What's not changed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

lewing commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Canceled WasmBuildTests actually passed ✅

Uh oh!

javiercn Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

lewing Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

kg commented Feb 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

lewing commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lewing commented Feb 7, 2026 •

edited

Loading

lewing commented Feb 8, 2026 •

edited

Loading