Describe the bug

2.8.0:

2.9.0:

This is not only a deployment issue, it also breaks builds.

In PR #890, the migration to Central Package Management moved PrivateAssets="All" from the PackageReference in src/OpenAI.csproj to the PackageVersion in Directory.Packages.props. However, NuGet does not honor PrivateAssets on PackageVersion when generating the nuspec for packing — it must be on the PackageReference itself.

As a result, Microsoft.SourceLink.GitHub 10.0.102 (and its transitive dependencies Microsoft.SourceLink.Common and Microsoft.Build.Tasks.Git) appear as regular dependencies of the OpenAI package. Any project that consumes OpenAI 2.9.0 gets SourceLink's MSBuild targets injected into its build. These targets attempt to generate source link metadata and fail with:

error : Source control information is not available - the generated source link is empty.

cc: @jsquire, @joseharriaga

Steps to reproduce

Use the OpenAI library as a dependency.

Code snippets

OS

All

.NET version

Any

Library version

2.9.0