Validate build-only container references in the pipeline

[Eric Erhardt (eerhardt)]

Description

Adds a built-in publish/deploy validation that throws when a build-only container is not consumed through container-files annotations.

This change also:

• switches the app-wide opt-out to a pipeline configuration callback that clears the validate-build-only-container-references step's RequiredBySteps instead of using a PipelineOptions flag,
• adds dedicated hosting tests for the validation and opt-out behavior,
• updates the Azure deploy scenario that intentionally disables the validation.

Validation:

• dotnet test --project tests\Aspire.Hosting.Tests\Aspire.Hosting.Tests.csproj /p:ConfigurationSchemaExists=false --no-launch-profile -- --filter-class "*.DistributedApplicationBuilderTests" --filter-class "*.DistributedApplicationPipelineTests" --filter-class "*.BuildOnlyContainerValidationTests" --filter-class "*.ComputeEnvironmentValidationTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"
• dotnet test --project tests\Aspire.Hosting.Azure.Tests\Aspire.Hosting.Azure.Tests.csproj /p:ConfigurationSchemaExists=false --no-launch-profile -- --filter-method "*.DeployAsync_WithBuildOnlyContainers" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"

cc David Fowler (@davidfowl)

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire.dev issue:
      • New issue
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16541

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16541"

[Copilot]

Pull request overview

Adds a publish/deploy-time pipeline validation to ensure “build-only” container resources are referenced via container-files annotations, preventing scenarios where build-only containers are built but never consumed in the publish/deploy graph. It also introduces an application-wide opt-out implemented as a pipeline configuration callback, and adds/updates tests and scenarios accordingly.

Changes:

• Added a new built-in pipeline step (validate-build-only-container-references) that throws when unconsumed build-only containers are present.
• Introduced IDistributedApplicationBuilder.DisableBuildOnlyContainerValidation() which disables the validation by clearing the step’s RequiredBySteps.
• Added hosting tests for the validation and opt-out behavior, and updated an Azure deploy test scenario to opt out.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/Aspire.Hosting.Tests/Pipelines/DistributedApplicationPipelineTests.cs	Updates expectations for the additional default pipeline step and asserts it is present.
tests/Aspire.Hosting.Tests/BuildOnlyContainerValidationTests.cs	Adds dedicated unit tests covering throw/non-throw behavior and the opt-out wiring.
tests/Aspire.Hosting.Azure.Tests/AzureDeployerTests.cs	Disables the new validation in a deploy scenario that intentionally uses build-only containers.
src/Aspire.Hosting/Pipelines/DistributedApplicationPipeline.cs	Adds the new validation step and implements the model scan/exception behavior.
src/Aspire.Hosting/DistributedApplicationBuilderExtensions.cs	Adds the public opt-out extension method that clears the validation step’s requirements.

[Eric Erhardt (eerhardt)]

/backport to release/13.3

[github-actions]

Started backporting to release/13.3 (link to workflow run)