Revert to treating PackageDownload as Development Dependency (#1320)

* Revert to treating PackageDownload as Development Dependency

Author: ericstj

src/Microsoft.ComponentDetection.Detectors/nuget/NuGetPackageReferenceFrameworkAwareDetector.cs

@@ -192,13 +192,12 @@ private void RegisterPackageDownloads(ISingleFileComponentRecorder singleFileCom
 
                 var libraryComponent = new DetectedComponent(new NuGetComponent(packageDownload.Name, packageDownload.VersionRange.MinVersion.ToNormalizedString()));
 
-                // Conservatively assume that PackageDownloads are not develeopment dependencies even though usage will not effect any runtime behavior.
-                // Most often they are used for some runtime deployment -- runtime packs, host packs, AOT infrastructure, etc, so opt in treating them as non-development-dependencies.
+                // PackageDownload is always a development dependency since it's usage does not make it part of the application
                 singleFileComponentRecorder.RegisterUsage(
                     libraryComponent,
                     isExplicitReferencedDependency: true,
                     parentComponentId: null,
-                    isDevelopmentDependency: false,
+                    isDevelopmentDependency: true,
                     targetFramework: framework.FrameworkName?.GetShortFolderName());
             }
         }

test/Microsoft.ComponentDetection.Detectors.Tests/nuget/NuGetPackageReferenceFrameworkAwareDetectorTests.cs

@@ -276,7 +276,7 @@ public async Task ScanDirectoryAsync_ExcludedFrameworkComponent_8_0_web_Verifica
             .ExecuteDetectorAsync();
 
         var detectedComponents = componentRecorder.GetDetectedComponents();
-        detectedComponents.Should().AllSatisfy(c => componentRecorder.GetEffectiveDevDependencyValue(c.Component.Id).GetValueOrDefault(), "All should be development dependencies");
+        detectedComponents.Should().AllSatisfy(c => componentRecorder.GetEffectiveDevDependencyValue(c.Component.Id).Should().BeTrue(), "All should be development dependencies");
     }
 
     [TestMethod]
@@ -289,7 +289,7 @@ public async Task ScanDirectoryAsync_ExcludedFrameworkComponent_42_15_web_Verifi
 
         // net42.15 is not a known framework, but it can import framework packages from the closest known framework.
         var detectedComponents = componentRecorder.GetDetectedComponents();
-        detectedComponents.Should().AllSatisfy(c => componentRecorder.GetEffectiveDevDependencyValue(c.Component.Id).GetValueOrDefault(), "All should be development dependencies");
+        detectedComponents.Should().AllSatisfy(c => componentRecorder.GetEffectiveDevDependencyValue(c.Component.Id).Should().BeTrue(), "All should be development dependencies");
     }
 
     [TestMethod]
@@ -329,6 +329,7 @@ public async Task ScanDirectoryAsync_PackageDownload_VerificationAsync()
 
         var dependencies = componentRecorder.GetDetectedComponents();
         dependencies.Should().HaveCount(3, "PackageDownload dependencies should exist.");
+        dependencies.Should().AllSatisfy(c => componentRecorder.GetEffectiveDevDependencyValue(c.Component.Id).Should().BeTrue(), "All PackageDownloads should be development dependencies");
         dependencies.Select(c => c.Component).Should().AllBeOfType<NuGetComponent>();
         dependencies.Select(c => c.TargetFrameworks).Should().AllSatisfy(tfms => tfms.Should().BeEquivalentTo(["net8.0"]));
     }