From 4d5751f2fd53b9e0c9c456fb9a22b1f7df690025 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 29 Jun 2026 05:01:23 +0000 Subject: [PATCH 1/8] Update dependencies from https://github.com/dotnet/arcade build 20260625.1 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26325.1 --- eng/Version.Details.xml | 4 +-- eng/common/build.ps1 | 6 ++++- eng/common/build.sh | 6 ++++- .../core-templates/steps/send-to-helix.yml | 22 ++++++++++++++-- eng/common/cross/build-rootfs.sh | 3 ++- eng/common/cross/install-debs.py | 8 ++++-- eng/common/cross/toolchain.cmake | 16 +++++------- eng/common/dotnet.ps1 | 1 + eng/common/msbuild.ps1 | 6 ++++- eng/common/msbuild.sh | 6 ++++- eng/common/native/NativeAotSupported.props | 26 +++++++++++++++++++ eng/common/tools.ps1 | 4 ++- eng/common/tools.sh | 7 +++-- global.json | 2 +- 14 files changed, 93 insertions(+), 24 deletions(-) create mode 100644 eng/common/native/NativeAotSupported.props diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 7cbd1219a9..7decfe20dd 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - 0a80b038bcc0d76b2f26c7f22062942de75779e6 + b076228a542025c4f879f254d38adb5cf34a2475 diff --git a/eng/common/build.ps1 b/eng/common/build.ps1 index 4b4f6b0923..2cbb725323 100644 --- a/eng/common/build.ps1 +++ b/eng/common/build.ps1 @@ -173,7 +173,11 @@ try { if (-not $excludeCIBinarylog) { $binaryLog = $true } - $nodeReuse = $false + # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") { + $nodeReuse = $false + } } if (-not [string]::IsNullOrEmpty($binaryLogName)) { diff --git a/eng/common/build.sh b/eng/common/build.sh index 719ee4b587..3a9fdcfd0f 100755 --- a/eng/common/build.sh +++ b/eng/common/build.sh @@ -213,7 +213,11 @@ if [[ -z "$configuration" ]]; then fi if [[ "$ci" == true ]]; then - node_reuse=false + # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then + node_reuse=false + fi if [[ "$exclude_ci_binary_log" == false ]]; then binary_log=true fi diff --git a/eng/common/core-templates/steps/send-to-helix.yml b/eng/common/core-templates/steps/send-to-helix.yml index 68fa739c4a..ec7a200039 100644 --- a/eng/common/core-templates/steps/send-to-helix.yml +++ b/eng/common/core-templates/steps/send-to-helix.yml @@ -10,6 +10,7 @@ parameters: HelixConfiguration: '' # optional -- additional property attached to a job HelixPreCommands: '' # optional -- commands to run before Helix work item execution HelixPostCommands: '' # optional -- commands to run after Helix work item execution + UseHelixMonitor: false # optional -- true will submit Helix jobs configured for the standalone Helix Job Monitor (results are reported/waited on out-of-band; this step will not wait, and WaitForWorkItemCompletion will be overridden) WorkItemDirectory: '' # optional -- a payload directory to zip up and send to Helix; requires WorkItemCommand; incompatible with XUnitProjects WorkItemCommand: '' # optional -- a command to execute on the payload; requires WorkItemDirectory; incompatible with XUnitProjects WorkItemTimeout: '' # optional -- a timeout in TimeSpan.Parse-ready value (e.g. 00:02:00) for the work item command; requires WorkItemDirectory; incompatible with XUnitProjects @@ -31,7 +32,15 @@ parameters: continueOnError: false # optional -- determines whether to continue the build if the step errors; defaults to false steps: - - powershell: 'powershell "$env:BUILD_SOURCESDIRECTORY\eng\common\msbuild.ps1 $env:BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$env:BUILD_SOURCESDIRECTORY\artifacts\log\$env:BuildConfig\SendToHelix.binlog"' + - powershell: > + $(Build.SourcesDirectory)\eng\common\msbuild.ps1 + $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }} + /restore + /p:TreatWarningsAsErrors=false + /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }} + ${{ parameters.HelixProjectArguments }} + /t:Test + /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog displayName: ${{ parameters.DisplayNamePrefix }} (Windows) env: BuildConfig: $(_BuildConfig) @@ -61,7 +70,15 @@ steps: SYSTEM_ACCESSTOKEN: $(System.AccessToken) condition: and(${{ parameters.condition }}, eq(variables['Agent.Os'], 'Windows_NT')) continueOnError: ${{ parameters.continueOnError }} - - script: $BUILD_SOURCESDIRECTORY/eng/common/msbuild.sh $BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$BUILD_SOURCESDIRECTORY/artifacts/log/$BuildConfig/SendToHelix.binlog + - script: > + $(Build.SourcesDirectory)/eng/common/msbuild.sh + $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }} + /restore + /p:TreatWarningsAsErrors=false + /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }} + ${{ parameters.HelixProjectArguments }} + /t:Test + /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog displayName: ${{ parameters.DisplayNamePrefix }} (Unix) env: BuildConfig: $(_BuildConfig) @@ -91,3 +108,4 @@ steps: SYSTEM_ACCESSTOKEN: $(System.AccessToken) condition: and(${{ parameters.condition }}, ne(variables['Agent.Os'], 'Windows_NT')) continueOnError: ${{ parameters.continueOnError }} + diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh index 273cae651a..3150ccac6f 100644 --- a/eng/common/cross/build-rootfs.sh +++ b/eng/common/cross/build-rootfs.sh @@ -88,8 +88,9 @@ __FreeBSDPackages+=" terminfo-db" __OpenBSDVersion="7.8" __OpenBSDPackages="heimdal-libs" __OpenBSDPackages+=" icu4c" -__OpenBSDPackages+=" inotify-tools" +__OpenBSDPackages+=" libinotify" __OpenBSDPackages+=" openssl" +__OpenBSDPackages+=" e2fsprogs" __IllumosPackages="icu" __IllumosPackages+=" mit-krb5" diff --git a/eng/common/cross/install-debs.py b/eng/common/cross/install-debs.py index 20ca770a1e..1d1dfabf7d 100644 --- a/eng/common/cross/install-debs.py +++ b/eng/common/cross/install-debs.py @@ -121,10 +121,14 @@ async def fetch_release_file(session, mirror, suite, keyring): await download_file(session, release_gpg_url, release_gpg_file.name) print("Verifying signature of Release with Release.gpg.") - verify_command = ["gpg"] + # Use gpgv rather than gpg for verification. gpgv verifies a detached + # signature against a fixed keyring without involving gpg-agent or + # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure + # Linux) where "gpg --keyring" routes through keyboxd and can fail. + verify_command = ["gpgv"] if keyring: verify_command += ["--keyring", keyring] - verify_command += ["--verify", release_gpg_file.name, release_file.name] + verify_command += [release_gpg_file.name, release_file.name] result = subprocess.run(verify_command, stdout=subprocess.PIPE, stderr=subprocess.PIPE) if result.returncode != 0: diff --git a/eng/common/cross/toolchain.cmake b/eng/common/cross/toolchain.cmake index 99d6dfe82d..ead7fe3ef2 100644 --- a/eng/common/cross/toolchain.cmake +++ b/eng/common/cross/toolchain.cmake @@ -59,9 +59,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "arm64") set(TIZEN_TOOLCHAIN "aarch64-tizen-linux-gnu") endif() elseif(FREEBSD) - set(triple "aarch64-unknown-freebsd12") + set(TOOLCHAIN "aarch64-unknown-freebsd14") elseif(OPENBSD) - set(triple "aarch64-unknown-openbsd") + set(TOOLCHAIN "aarch64-unknown-openbsd") endif() elseif(TARGET_ARCH_NAME STREQUAL "armel") set(CMAKE_SYSTEM_PROCESSOR armv7l) @@ -117,9 +117,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "x64") set(TIZEN_TOOLCHAIN "x86_64-tizen-linux-gnu") endif() elseif(FREEBSD) - set(triple "x86_64-unknown-freebsd12") + set(TOOLCHAIN "x86_64-unknown-freebsd14") elseif(OPENBSD) - set(triple "x86_64-unknown-openbsd") + set(TOOLCHAIN "x86_64-unknown-openbsd") elseif(ILLUMOS) set(TOOLCHAIN "x86_64-illumos") elseif(HAIKU) @@ -160,8 +160,6 @@ if(TIZEN) find_toolchain_dir("${CROSS_ROOTFS}/usr/lib64/gcc/${TIZEN_TOOLCHAIN}") endif() - message(STATUS "TIZEN_TOOLCHAIN_PATH set to: ${TIZEN_TOOLCHAIN_PATH}") - include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++) include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++/${TIZEN_TOOLCHAIN}) endif() @@ -206,9 +204,9 @@ if(ANDROID) include(${CROSS_ROOTFS}/../build/cmake/android.toolchain.cmake) elseif(FREEBSD OR OPENBSD) # we cross-compile by instructing clang - set(CMAKE_C_COMPILER_TARGET ${triple}) - set(CMAKE_CXX_COMPILER_TARGET ${triple}) - set(CMAKE_ASM_COMPILER_TARGET ${triple}) + set(CMAKE_C_COMPILER_TARGET ${TOOLCHAIN}) + set(CMAKE_CXX_COMPILER_TARGET ${TOOLCHAIN}) + set(CMAKE_ASM_COMPILER_TARGET ${TOOLCHAIN}) set(CMAKE_SYSROOT "${CROSS_ROOTFS}") set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=lld") set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -fuse-ld=lld") diff --git a/eng/common/dotnet.ps1 b/eng/common/dotnet.ps1 index 45e5676c9e..ce4ea40730 100644 --- a/eng/common/dotnet.ps1 +++ b/eng/common/dotnet.ps1 @@ -8,4 +8,5 @@ $dotnetRoot = InitializeDotNetCli -install:$true if ($args.count -gt 0) { $env:DOTNET_NOLOGO=1 & "$dotnetRoot\dotnet.exe" $args + ExitWithExitCode $LASTEXITCODE } diff --git a/eng/common/msbuild.ps1 b/eng/common/msbuild.ps1 index f041e5ddd9..495d533a90 100644 --- a/eng/common/msbuild.ps1 +++ b/eng/common/msbuild.ps1 @@ -14,7 +14,11 @@ Param( try { if ($ci) { - $nodeReuse = $false + # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") { + $nodeReuse = $false + } } MSBuild @extraArgs diff --git a/eng/common/msbuild.sh b/eng/common/msbuild.sh index 20d3dad543..333be3232f 100755 --- a/eng/common/msbuild.sh +++ b/eng/common/msbuild.sh @@ -51,7 +51,11 @@ done . "$scriptroot/tools.sh" if [[ "$ci" == true ]]; then - node_reuse=false + # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then + node_reuse=false + fi fi MSBuild $extra_args diff --git a/eng/common/native/NativeAotSupported.props b/eng/common/native/NativeAotSupported.props new file mode 100644 index 0000000000..559a666392 --- /dev/null +++ b/eng/common/native/NativeAotSupported.props @@ -0,0 +1,26 @@ + + + + + <_NativeAotSupportedOS Condition=" + '$(TargetOS)' != 'browser' and + '$(TargetOS)' != 'haiku' and + '$(TargetOS)' != 'illumos' and + '$(TargetOS)' != 'netbsd' and + '$(TargetOS)' != 'solaris' + ">true + + + <_NativeAotSupportedArch Condition=" + '$(TargetArchitecture)' != 'wasm' and + ('$(TargetArchitecture)' != 'x86' or '$(TargetOS)' == 'windows') + ">true + + true + + + diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index fc72fe6304..de32a6da37 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -742,7 +742,9 @@ function MSBuild() { ExitWithExitCode 1 } - if ($nodeReuse) { + # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if ($nodeReuse -and $env:MSBUILD_NODEREUSE_ENABLED -ne "1") { Write-PipelineTelemetryError -Category 'Build' -Message 'Node reuse must be disabled in CI build.' ExitWithExitCode 1 } diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 48cab70ebf..69ca926a6a 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -466,7 +466,8 @@ function ExitWithExitCode { function StopProcesses { echo "Killing running build processes..." pkill -9 "dotnet" || true - pkill -9 "vbcscompiler" || true + pkill -9 -i -x VBCSCompiler || true + pkill -9 -i -x MSBuild || true return 0 } @@ -497,7 +498,9 @@ function MSBuild { ExitWithExitCode 1 fi - if [[ "$node_reuse" == true ]]; then + # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. + # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. + if [[ "$node_reuse" == true && "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then Write-PipelineTelemetryError -category 'Build' "Node reuse must be disabled in CI build." ExitWithExitCode 1 fi diff --git a/global.json b/global.json index 68b114e5c9..553505fb14 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.5.26227.104" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26310.1" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26325.1" } } From 320aa3379c34c1cf8c35e3eb330ac0238626ebf0 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 6 Jul 2026 05:01:43 +0000 Subject: [PATCH 2/8] Update dependencies from https://github.com/dotnet/arcade build 20260630.1 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26330.1 --- eng/Version.Details.xml | 4 ++-- eng/common/core-templates/job/helix-job-monitor.yml | 9 +++++++++ eng/common/tools.sh | 2 +- global.json | 4 ++-- 4 files changed, 14 insertions(+), 5 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 7decfe20dd..0b6b6e611e 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - b076228a542025c4f879f254d38adb5cf34a2475 + f87bce1e0d389d515282c5f74466d629ef653026 diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index a8162c5116..96287e55a1 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -57,6 +57,14 @@ parameters: type: number default: 30 +# When 'true' (the default), Helix work items that exit 0 but have failed AzDO test results +# are treated as failed: they count toward the monitor's exit code and are resubmitted by a +# later invocation's retry pass. Set to 'false' to fall back to exit-code-only outcomes. +# Forwarded as --fail-on-failed-tests. +- name: failWorkItemsWithFailedTests + type: boolean + default: true + # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is @@ -170,6 +178,7 @@ jobs: toolArgs=( --helix-base-uri '${{ parameters.helixBaseUri }}' --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' + --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. --stage-name '$(System.StageName)' ) diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 69ca926a6a..3164fff333 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -423,7 +423,7 @@ function InitializeToolset { if [[ -z "$nuget_config" ]]; then # Search for any variation of nuget.config in the RepoRoot local found_config - found_config=$(find "$repo_root" -maxdepth 1 -type f -iname "nuget.config" -print -quit) + found_config=$(find "$repo_root" -maxdepth 1 -type f -iname nuget.config | head -n 1) if [[ -n "$found_config" ]]; then nuget_config="$found_config" diff --git a/global.json b/global.json index 553505fb14..dce1073ff7 100644 --- a/global.json +++ b/global.json @@ -1,8 +1,8 @@ { "tools": { - "dotnet": "11.0.100-preview.5.26227.104" + "dotnet": "11.0.100-preview.5.26302.115" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26325.1" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26330.1" } } From 737978de2329bf8a33ef355e798f72a7043e5b17 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 13 Jul 2026 05:01:38 +0000 Subject: [PATCH 3/8] Update dependencies from https://github.com/dotnet/arcade build 20260710.7 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26360.7 --- eng/Version.Details.xml | 4 +- eng/common/SetupNugetSources.ps1 | 6 +- .../job/publish-build-assets.yml | 3 - .../core-templates/post-build/post-build.yml | 2 - eng/common/cross/build-rootfs.sh | 52 +++++++++++-- eng/common/dotnet-install.ps1 | 5 +- eng/common/dotnet-install.sh | 9 ++- eng/common/native/NativeAotSupported.props | 2 + eng/common/tools.ps1 | 75 ++++++++++--------- eng/common/tools.sh | 20 ++--- global.json | 2 +- 11 files changed, 116 insertions(+), 64 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 0b6b6e611e..f16821861c 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - f87bce1e0d389d515282c5f74466d629ef653026 + 3169db01948537e61a9102477fab4a39663ba79d diff --git a/eng/common/SetupNugetSources.ps1 b/eng/common/SetupNugetSources.ps1 index 58002808bc..b3bddff355 100644 --- a/eng/common/SetupNugetSources.ps1 +++ b/eng/common/SetupNugetSources.ps1 @@ -13,7 +13,11 @@ # filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.ps1 # arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $Env:Token # env: -# Token: $(dn-bot-dnceng-artifact-feeds-rw) +# Token: $(InternalFeedToken) +# +# Note: This logic is abstracted into enable-internal-sources.yml, which uses +# NuGetAuthenticate or a WIF-backed service connection. Prefer that template +# over calling this script directly. # # Note that the NuGetAuthenticate task should be called after SetupNugetSources. # This ensures that: diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml index 700f771146..4229288d3d 100644 --- a/eng/common/core-templates/job/publish-build-assets.yml +++ b/eng/common/core-templates/job/publish-build-assets.yml @@ -122,9 +122,6 @@ jobs: # Populate internal runtime variables. - template: /eng/common/templates/steps/enable-internal-sources.yml - ${{ if eq(variables['System.TeamProject'], 'DevDiv') }}: - parameters: - legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw) - template: /eng/common/templates/steps/enable-internal-runtimes.yml diff --git a/eng/common/core-templates/post-build/post-build.yml b/eng/common/core-templates/post-build/post-build.yml index 8aa86e3049..9d95135269 100644 --- a/eng/common/core-templates/post-build/post-build.yml +++ b/eng/common/core-templates/post-build/post-build.yml @@ -295,8 +295,6 @@ stages: # Populate internal runtime variables. - template: /eng/common/templates/steps/enable-internal-sources.yml - parameters: - legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw) - template: /eng/common/templates/steps/enable-internal-runtimes.yml diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh index 3150ccac6f..453bb1ba5b 100644 --- a/eng/common/cross/build-rootfs.sh +++ b/eng/common/cross/build-rootfs.sh @@ -18,7 +18,10 @@ usage() echo "--skipsigcheck - optional, will skip package signature checks (allowing untrusted packages)." echo "--skipemulation - optional, will skip qemu and debootstrap requirement when building environment for debian based systems." echo "--use-mirror - optional, use mirror URL to fetch resources, when available." - echo "--jobs N - optional, restrict to N jobs." + echo "--ubuntu-repo - optional, override the Ubuntu apt repository base URL." + echo "--debian-repo - optional, override the Debian apt repository base URL." + echo "--alpine-repo - optional, override the Alpine Linux repository base URL." + echo "--jobs N (or --use-jobs N) - optional, restrict to N jobs." exit 1 } @@ -144,6 +147,9 @@ __KeyringFile="/usr/share/keyrings/ubuntu-archive-keyring.gpg" __SkipSigCheck=0 __SkipEmulation=0 __UseMirror=0 +__UbuntuRepoOverride= +__DebianRepoOverride= +__AlpineRepoOverride= __UnprocessedBuildArgs= while :; do @@ -397,6 +403,31 @@ while :; do --use-mirror) __UseMirror=1 ;; + --ubuntu-repo|-ubuntu-repo) + shift + if [[ "$#" -le 0 ]]; then + echo "ERROR: --ubuntu-repo requires a URL argument." + usage + fi + __UbuntuRepoOverride="$1" + ;; + --debian-repo|-debian-repo) + shift + if [[ "$#" -le 0 ]]; then + echo "ERROR: --debian-repo requires a URL argument." + usage + fi + __DebianRepoOverride="$1" + ;; + --alpine-repo|-alpine-repo) + shift + if [[ "$#" -le 0 ]]; then + echo "ERROR: --alpine-repo requires a URL argument." + usage + fi + __AlpineRepoOverride="$1" + ;; + # Removed duplicate/invalid option handling block (was breaking case statement parsing). --use-jobs) shift MAXJOBS=$1 @@ -446,6 +477,12 @@ if [[ -z "$__UbuntuRepo" ]]; then __UbuntuRepo="https://ports.ubuntu.com/" fi +if [[ -n "$__UbuntuRepoOverride" && "$__KeyringFile" == *ubuntu* ]]; then + __UbuntuRepo="$__UbuntuRepoOverride" +elif [[ -n "$__DebianRepoOverride" && "$__KeyringFile" == *debian* ]]; then + __UbuntuRepo="$__DebianRepoOverride" +fi + if [[ -n "$__LLVM_MajorVersion" ]]; then __UbuntuPackages+=" libclang-common-${__LLVM_MajorVersion}${__LLVM_MinorVersion:+.$__LLVM_MinorVersion}-dev" fi @@ -486,6 +523,7 @@ if [[ "$__CodeName" == "alpine" ]]; then __ApkToolsDir="$(mktemp -d)" __ApkKeysDir="$(mktemp -d)" arch="$(uname -m)" + __AlpineRepo="${__AlpineRepoOverride:-https://dl-cdn.alpinelinux.org/alpine}" ensureDownloadTool @@ -530,15 +568,15 @@ if [[ "$__CodeName" == "alpine" ]]; then # initialize DB # shellcheck disable=SC2086 "$__ApkToolsDir/apk.static" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \ + -X "$__AlpineRepo/$version/main" \ + -X "$__AlpineRepo/$version/community" \ -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" --initdb add if [[ "$__AlpineLlvmLibsLookup" == 1 ]]; then # shellcheck disable=SC2086 __AlpinePackages+=" $("$__ApkToolsDir/apk.static" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \ + -X "$__AlpineRepo/$version/main" \ + -X "$__AlpineRepo/$version/community" \ -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" \ search 'llvm*-libs' | grep -E '^llvm' | sort | tail -1 | sed 's/-[^-]*//2g')" fi @@ -546,8 +584,8 @@ if [[ "$__CodeName" == "alpine" ]]; then # install all packages in one go # shellcheck disable=SC2086 "$__ApkToolsDir/apk.static" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \ - -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \ + -X "$__AlpineRepo/$version/main" \ + -X "$__AlpineRepo/$version/community" \ -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" $__NoEmulationArg \ add $__AlpinePackages diff --git a/eng/common/dotnet-install.ps1 b/eng/common/dotnet-install.ps1 index 50ae627376..b6d45f2bdc 100644 --- a/eng/common/dotnet-install.ps1 +++ b/eng/common/dotnet-install.ps1 @@ -4,13 +4,16 @@ Param( [string] $architecture = '', [string] $version = 'Latest', [string] $runtime = 'dotnet', + [string] $dotnetPath = '', [string] $RuntimeSourceFeed = '', [string] $RuntimeSourceFeedKey = '' ) . $PSScriptRoot\tools.ps1 -if (-not [string]::IsNullOrEmpty($env:DOTNET_GLOBAL_INSTALL_DIR)) { +if (-not [string]::IsNullOrEmpty($dotnetPath)) { + $dotnetRoot = $dotnetPath +} elseif (-not [string]::IsNullOrEmpty($env:DOTNET_GLOBAL_INSTALL_DIR)) { $dotnetRoot = $env:DOTNET_GLOBAL_INSTALL_DIR } else { $dotnetRoot = Join-Path $RepoRoot '.dotnet' diff --git a/eng/common/dotnet-install.sh b/eng/common/dotnet-install.sh index 1cb3f5abac..58a7e6f384 100644 --- a/eng/common/dotnet-install.sh +++ b/eng/common/dotnet-install.sh @@ -16,6 +16,7 @@ scriptroot="$( cd -P "$( dirname "$source" )" && pwd )" version='Latest' architecture='' runtime='dotnet' +dotnetPath='' runtimeSourceFeed='' runtimeSourceFeedKey='' while [[ $# -gt 0 ]]; do @@ -33,6 +34,10 @@ while [[ $# -gt 0 ]]; do shift runtime="$1" ;; + -dotnetpath) + shift + dotnetPath="$1" + ;; -runtimesourcefeed) shift runtimeSourceFeed="$1" @@ -80,7 +85,9 @@ case $cpuname in ;; esac -if [[ -n "${DOTNET_GLOBAL_INSTALL_DIR:-}" ]]; then +if [[ -n "${dotnetPath:-}" ]]; then + dotnetRoot="$dotnetPath" +elif [[ -n "${DOTNET_GLOBAL_INSTALL_DIR:-}" ]]; then dotnetRoot="$DOTNET_GLOBAL_INSTALL_DIR" else dotnetRoot="${repo_root}.dotnet" diff --git a/eng/common/native/NativeAotSupported.props b/eng/common/native/NativeAotSupported.props index 559a666392..cdff9ef036 100644 --- a/eng/common/native/NativeAotSupported.props +++ b/eng/common/native/NativeAotSupported.props @@ -13,6 +13,8 @@ <_NativeAotSupportedArch Condition=" '$(TargetArchitecture)' != 'wasm' and + '$(TargetArchitecture)' != 's390x' and + '$(TargetArchitecture)' != 'ppc64le' and ('$(TargetArchitecture)' != 'x86' or '$(TargetOS)' == 'windows') ">true diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index de32a6da37..6f664ad890 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -432,11 +432,31 @@ function InitializeVisualStudioMSBuild([object]$vsRequirements = $null) { $msbuildVersionDir = if ([int]$vsMajorVersion -lt 16) { "$vsMajorVersion.0" } else { "Current" } $local:BinFolder = Join-Path $vsInstallDir "MSBuild\$msbuildVersionDir\Bin" - $local:Prefer64bit = if (Get-Member -InputObject $vsRequirements -Name 'Prefer64bit') { $vsRequirements.Prefer64bit } else { $false } - if ($local:Prefer64bit -and (Test-Path(Join-Path $local:BinFolder "amd64"))) { - $global:_MSBuildExe = Join-Path $local:BinFolder "amd64\msbuild.exe" - } else { - $global:_MSBuildExe = Join-Path $local:BinFolder "msbuild.exe" + + # Use the MSBuild matching the host's process architecture (e.g. amd64 or arm64), + # falling back to the 32-bit MSBuild in the root Bin folder when no matching subfolder exists. + + # Determine the architecture of the current process, accounting for a 32-bit process + # running on a 64-bit OS (PROCESSOR_ARCHITEW6432 holds the real machine architecture). + $local:ProcessArchitecture = $env:PROCESSOR_ARCHITECTURE + if (($local:ProcessArchitecture -eq 'x86') -and ($env:PROCESSOR_ARCHITEW6432)) { + $local:ProcessArchitecture = $env:PROCESSOR_ARCHITEW6432 + } + + # Map the architecture to the corresponding MSBuild subfolder. The 32-bit MSBuild lives in the + # root Bin folder, so x86 maps to an empty subfolder. + $local:MSBuildArchSubFolder = switch ($local:ProcessArchitecture) { + 'AMD64' { 'amd64' } + 'ARM64' { 'arm64' } + default { '' } + } + + $global:_MSBuildExe = Join-Path $local:BinFolder "msbuild.exe" + if ($local:MSBuildArchSubFolder) { + $local:ArchMSBuildExe = Join-Path $local:BinFolder (Join-Path $local:MSBuildArchSubFolder "msbuild.exe") + if (Test-Path $local:ArchMSBuildExe) { + $global:_MSBuildExe = $local:ArchMSBuildExe + } } return $global:_MSBuildExe @@ -531,6 +551,16 @@ function LocateVisualStudio([object]$vsRequirements = $null){ } function InitializeBuildTool() { + # Allow a caller (e.g. a bootstrap script running out-of-proc) to inject the build tool via + # environment variables instead of the in-proc $global:_BuildTool variable. Only Path and + # Command are consumed by the MSBuild function below, so those are all that's needed. + if ($env:_BuildToolPath) { + return $global:_BuildTool = @{ + Path = $env:_BuildToolPath + Command = $env:_BuildToolCommand + } + } + if (Test-Path variable:global:_BuildTool) { # If the requested msbuild parameters do not match, clear the cached variables. if($global:_BuildTool.Contains('ExcludePrereleaseVS') -and $global:_BuildTool.ExcludePrereleaseVS -ne $excludePrereleaseVS) { @@ -558,7 +588,7 @@ function InitializeBuildTool() { } $dotnetPath = Join-Path $dotnetRoot (GetExecutableFileName 'dotnet') - $buildTool = @{ Path = $dotnetPath; Command = 'msbuild'; Tool = 'dotnet'; Framework = 'net' } + $buildTool = @{ Path = $dotnetPath; Command = 'msbuild' } } elseif ($msbuildEngine -eq "vs") { try { $msbuildPath = InitializeVisualStudioMSBuild @@ -567,7 +597,7 @@ function InitializeBuildTool() { ExitWithExitCode 1 } - $buildTool = @{ Path = $msbuildPath; Command = ""; Tool = "vs"; Framework = "netframework"; ExcludePrereleaseVS = $excludePrereleaseVS } + $buildTool = @{ Path = $msbuildPath; Command = ""; ExcludePrereleaseVS = $excludePrereleaseVS } } else { Write-PipelineTelemetryError -Category 'InitializeToolset' -Message "Unexpected value of -msbuildEngine: '$msbuildEngine'." ExitWithExitCode 1 @@ -706,7 +736,7 @@ function InitializeToolset() { } function ExitWithExitCode([int] $exitCode) { - if ($ci -and $prepareMachine) { + if ($prepareMachine) { Stop-Processes } exit $exitCode @@ -741,13 +771,6 @@ function MSBuild() { Write-PipelineTelemetryError -Category 'Build' -Message 'Binary log must be enabled in CI build, or explicitly opted-out from with the -excludeCIBinarylog switch.' ExitWithExitCode 1 } - - # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if ($nodeReuse -and $env:MSBUILD_NODEREUSE_ENABLED -ne "1") { - Write-PipelineTelemetryError -Category 'Build' -Message 'Node reuse must be disabled in CI build.' - ExitWithExitCode 1 - } } $buildTool = InitializeBuildTool @@ -789,11 +812,6 @@ function MSBuild() { # The build already logged an error, that's the reason it failed. Producing an error here only adds noise. Write-Host "Build failed with exit code $exitCode. Check errors above." -ForegroundColor Red - $buildLog = GetMSBuildBinaryLogCommandLineArgument $args - if ($null -ne $buildLog) { - Write-Host "See log: $buildLog" -ForegroundColor DarkGray - } - # When running on Azure Pipelines, override the returned exit code to avoid double logging. # Skip this when the build is a child of the VMR build. if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) { @@ -841,23 +859,6 @@ function DotNet() { } } -function GetMSBuildBinaryLogCommandLineArgument($arguments) { - foreach ($argument in $arguments) { - if ($argument -ne $null) { - $arg = $argument.Trim() - if ($arg.StartsWith('/bl:', "OrdinalIgnoreCase")) { - return $arg.Substring('/bl:'.Length) - } - - if ($arg.StartsWith('/binaryLogger:', 'OrdinalIgnoreCase')) { - return $arg.Substring('/binaryLogger:'.Length) - } - } - } - - return $null -} - function GetExecutableFileName($baseName) { if (IsWindowsPlatform) { return "$baseName.exe" diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 3164fff333..347a29b888 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -353,6 +353,15 @@ function GetDotNetInstallScript { } function InitializeBuildTool { + # Allow a caller (e.g. a bootstrap script running out-of-proc) to inject the build tool via + # environment variables instead of the in-proc _InitializeBuildTool variable. Only the tool path and + # command are consumed by the MSBuild function below, so those are all that's needed. + if [[ -n "${_BuildToolPath:-}" ]]; then + _InitializeBuildTool="$_BuildToolPath" + _InitializeBuildToolCommand="$_BuildToolCommand" + return + fi + if [[ -n "${_InitializeBuildTool:-}" ]]; then return fi @@ -457,7 +466,7 @@ function InitializeToolset { } function ExitWithExitCode { - if [[ "$ci" == true && "$prepare_machine" == true ]]; then + if [[ "$prepare_machine" == true ]]; then StopProcesses fi exit $1 @@ -494,14 +503,7 @@ function DotNet { function MSBuild { if [[ "$ci" == true ]]; then if [[ "$binary_log" != true && "$exclude_ci_binary_log" != true ]]; then - Write-PipelineTelemetryError -category 'Build' "Binary log must be enabled in CI build, or explicitly opted-out from with the -noBinaryLog switch." - ExitWithExitCode 1 - fi - - # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if [[ "$node_reuse" == true && "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then - Write-PipelineTelemetryError -category 'Build' "Node reuse must be disabled in CI build." + Write-PipelineTelemetryError -category 'Build' "Binary log must be enabled in CI build, or explicitly opted-out from with the --excludeCIBinarylog switch." ExitWithExitCode 1 fi fi diff --git a/global.json b/global.json index dce1073ff7..a8567dacab 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.5.26302.115" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26330.1" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26360.7" } } From 318a609360ba0bad10d954955594d0c96953da74 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 20 Jul 2026 05:01:39 +0000 Subject: [PATCH 4/8] Update dependencies from https://github.com/dotnet/arcade build 20260719.1 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26369.1 --- eng/Version.Details.xml | 4 +- eng/common/build.ps1 | 2 + eng/common/build.sh | 11 ++++ .../core-templates/job/helix-job-monitor.yml | 19 ++++-- eng/common/core-templates/job/onelocbuild.yml | 20 ++++++- eng/common/cross/build-rootfs.sh | 5 +- eng/common/cross/toolchain.cmake | 2 + eng/common/native/init-os-and-arch.sh | 6 +- eng/common/sdk-task.ps1 | 17 +++++- eng/common/sdk-task.sh | 22 +++++-- eng/common/tools.ps1 | 47 +++++++++++++-- eng/common/tools.sh | 60 +++++++++++++++++-- global.json | 2 +- 13 files changed, 188 insertions(+), 29 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index f16821861c..4ea6ceacd1 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - 3169db01948537e61a9102477fab4a39663ba79d + 09bc8c946f4c4ae5d031c8875b85a6b8f1876b93 diff --git a/eng/common/build.ps1 b/eng/common/build.ps1 index 2cbb725323..dd84699f50 100644 --- a/eng/common/build.ps1 +++ b/eng/common/build.ps1 @@ -23,6 +23,7 @@ Param( [switch] $clean, [switch][Alias('pb')]$productBuild, [switch]$fromVMR, + [switch]$disablePipelineSetResult, [switch][Alias('bl')]$binaryLog, [string][Alias('bln')]$binaryLogName = '', [switch][Alias('nobl')]$excludeCIBinarylog, @@ -80,6 +81,7 @@ function Print-Usage() { Write-Host " -nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" Write-Host " -buildCheck Sets /check msbuild parameter" Write-Host " -fromVMR Set when building from within the VMR" + Write-Host " -disablePipelineSetResult Set to disable masking the actual exit code in the pipeline when the build fails" Write-Host "" Write-Host "Command line arguments not listed above are passed thru to msbuild." diff --git a/eng/common/build.sh b/eng/common/build.sh index 3a9fdcfd0f..e37edd6cff 100755 --- a/eng/common/build.sh +++ b/eng/common/build.sh @@ -40,12 +40,14 @@ usage() echo " --projects Project or solution file(s) to build" echo " --ci Set when running on CI server" echo " --excludeCIBinarylog Don't output binary log (short: -nobl)" + echo " --pipelinesLog Promote msbuild errors/warnings to Azure Pipelines timeline issues; defaults to on in CI (short: -pl)" echo " --prepareMachine Prepare machine for CI run, clean up processes after build" echo " --nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" echo " --warnAsError Sets warnaserror msbuild parameter ('true' or 'false')" echo " --warnNotAsError Sets a semi-colon delimited list of warning codes that should not be treated as errors" echo " --buildCheck Sets /check msbuild parameter" echo " --fromVMR Set when building from within the VMR" + echo " --disablePipelineSetResult Set to disable masking the actual exit code in the pipeline when the build fails" echo "" echo "Command line arguments not listed above are passed thru to msbuild." echo "Arguments can also be passed in with a single hyphen." @@ -68,6 +70,7 @@ build=false source_build=false product_build=false from_vmr=false +disable_pipeline_set_result=false rebuild=false test=false integration_test=false @@ -86,6 +89,7 @@ build_check=false binary_log=false binary_log_name='' exclude_ci_binary_log=false +pipelines_log=false projects='' configuration='' @@ -124,6 +128,9 @@ while [[ $# -gt 0 ]]; do -excludecibinarylog|-nobl) exclude_ci_binary_log=true ;; + -pipelineslog|-pl) + pipelines_log=true + ;; -restore|-r) restore=true ;; @@ -152,6 +159,9 @@ while [[ $# -gt 0 ]]; do -fromvmr|-from-vmr) from_vmr=true ;; + -disablepipelinesetresult|-disable-pipeline-set-result) + disable_pipeline_set_result=true + ;; -test|-t) test=true ;; @@ -213,6 +223,7 @@ if [[ -z "$configuration" ]]; then fi if [[ "$ci" == true ]]; then + pipelines_log=true # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 96287e55a1..0da13cf69d 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -65,6 +65,14 @@ parameters: type: boolean default: true +# When true, test results are reported to Azure DevOps using the fully qualified test name +# (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as +# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display; +# primarily useful for frameworks like MSTest whose display name is only the method name. +- name: useFullyQualifiedTestName + type: boolean + default: false + # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is @@ -176,11 +184,12 @@ jobs: set -euo pipefail toolArgs=( - --helix-base-uri '${{ parameters.helixBaseUri }}' - --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' - --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' - --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. - --stage-name '$(System.StageName)' + --helix-base-uri '${{ parameters.helixBaseUri }}' + --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' + --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' + --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}' + --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. + --stage-name '$(System.StageName)' ) organization='${{ parameters.organization }}' diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 86ea9f6350..2816d2905a 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -8,6 +8,12 @@ parameters: CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex GithubPat: $(BotAccount-dotnet-bot-repo-PAT) + # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). + # When set, dnceng/internal builds acquire a federated Entra token instead of using a PAT. + # All other projects (e.g. DevDiv, public), where this dnceng-scoped service connection does not + # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. + CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -74,6 +80,15 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} + # Acquire an Entra token for ceapex feed access via WIF (dnceng/internal only). + # All other projects use PAT-based auth, since the ceapex service connection is scoped to dnceng/internal. + - ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/templates/steps/get-federated-access-token.yml + parameters: + federatedServiceConnection: ${{ parameters.CeapexServiceConnection }} + outputVariableName: 'CeapexEntraToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -89,7 +104,10 @@ jobs: isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - patVariable: ${{ parameters.CeapexPat }} + ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + patVariable: $(CeapexEntraToken) + ${{ if or(eq(parameters.CeapexServiceConnection, ''), ne(variables['System.TeamProject'], 'internal')) }}: + patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} gitHubPatVariable: "${{ parameters.GithubPat }}" diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh index 453bb1ba5b..38a3512f14 100644 --- a/eng/common/cross/build-rootfs.sh +++ b/eng/common/cross/build-rootfs.sh @@ -453,9 +453,12 @@ case "$__AlpineVersion" in elif [[ "$__AlpineArch" == "x86" ]]; then __AlpineVersion=3.17 # minimum version that supports lldb-dev __AlpinePackages+=" llvm15-libs" - elif [[ "$__AlpineArch" == "riscv64" || "$__AlpineArch" == "loongarch64" ]]; then + elif [[ "$__AlpineArch" == "loongarch64" ]]; then __AlpineVersion=3.21 # minimum version that supports lldb-dev __AlpinePackages+=" llvm19-libs" + elif [[ "$__AlpineArch" == "riscv64" ]]; then + __AlpineVersion=3.22 # lldb-dev requires 3.21+, but 3.22+ provides the newer linux-headers needed for RISC-V extension probes + __AlpinePackages+=" llvm20-libs" elif [[ -n "$__AlpineMajorVersion" ]]; then # use whichever alpine version is provided and select the latest toolchain libs __AlpineLlvmLibsLookup=1 diff --git a/eng/common/cross/toolchain.cmake b/eng/common/cross/toolchain.cmake index ead7fe3ef2..70b71395e3 100644 --- a/eng/common/cross/toolchain.cmake +++ b/eng/common/cross/toolchain.cmake @@ -87,6 +87,8 @@ elseif(TARGET_ARCH_NAME STREQUAL "ppc64le") set(CMAKE_SYSTEM_PROCESSOR ppc64le) if(EXISTS ${CROSS_ROOTFS}/usr/lib/gcc/powerpc64le-alpine-linux-musl) set(TOOLCHAIN "powerpc64le-alpine-linux-musl") + elseif(FREEBSD) + set(TOOLCHAIN "powerpc64le-unknown-freebsd14") else() set(TOOLCHAIN "powerpc64le-linux-gnu") endif() diff --git a/eng/common/native/init-os-and-arch.sh b/eng/common/native/init-os-and-arch.sh index 38921d4338..62d62fed52 100644 --- a/eng/common/native/init-os-and-arch.sh +++ b/eng/common/native/init-os-and-arch.sh @@ -27,6 +27,10 @@ if [ "$os" = "sunos" ]; then os="solaris" fi CPUName=$(isainfo -n) +elif [ "$os" = "freebsd" ]; then + # FreeBSD's `uname -m` is the machine class ("powerpc" for every PowerPC + # variant); `uname -p` gives the specific processor (e.g. powerpc64le). + CPUName=$(uname -p) else # For the rest of the operating systems, use uname(1) to determine what the CPU is. CPUName=$(uname -m) @@ -75,7 +79,7 @@ case "$CPUName" in arch=s390x ;; - ppc64le) + ppc64le|powerpc64le) arch=ppc64le ;; *) diff --git a/eng/common/sdk-task.ps1 b/eng/common/sdk-task.ps1 index 68119de603..8d72d803dd 100644 --- a/eng/common/sdk-task.ps1 +++ b/eng/common/sdk-task.ps1 @@ -4,7 +4,9 @@ Param( [string] $task, [string] $verbosity = 'minimal', [string] $msbuildEngine = $null, - [switch] $restore, + # Restore defaults to on; -restore is retained only so existing consumers that pass it don't break. Use -norestore to opt out. + [switch] $restore = $true, + [switch] $norestore, [switch] $prepareMachine, [switch][Alias('nobl')]$excludeCIBinaryLog, [switch]$noWarnAsError, @@ -18,12 +20,23 @@ $ci = $true $binaryLog = if ($excludeCIBinaryLog) { $false } else { $true } $warnAsError = if ($noWarnAsError) { $false } else { $true } +# Reconcile the restore state before importing tools.ps1: it reads $restore at import time to +# decide whether toolset/SDK acquisition installs. -norestore must win so that skipping restore +# also skips toolset initialization, not just the explicit Restore build below. +if ($norestore) { $restore = $false } + +# sdk-task runs a standalone Arcade SDK task and does not need repo-specific toolset setup. +# Skip importing configure-toolset.ps1 so its side effects (e.g. a repo's configure-toolset.ps1 +# calling exit) don't terminate this script before the task runs. +$disableConfigureToolsetImport = $true + . $PSScriptRoot\tools.ps1 function Print-Usage() { Write-Host "Common settings:" Write-Host " -task Name of Arcade task (name of a project in toolset directory of the Arcade SDK package)" - Write-Host " -restore Restore dependencies" + Write-Host " -restore (Legacy) Restore runs by default; retained for backward compatibility. Use -norestore to skip" + Write-Host " -norestore Skip restoring dependencies" Write-Host " -verbosity Msbuild verbosity: q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]" Write-Host " -help Print help and exit" Write-Host "" diff --git a/eng/common/sdk-task.sh b/eng/common/sdk-task.sh index 1cf71bb2ae..a7f1ba060d 100644 --- a/eng/common/sdk-task.sh +++ b/eng/common/sdk-task.sh @@ -3,7 +3,8 @@ show_usage() { echo "Common settings:" echo " --task Name of Arcade task (name of a project in toolset directory of the Arcade SDK package)" - echo " --restore Restore dependencies" + echo " --restore (Legacy) Restore runs by default; retained for backward compatibility. Use --norestore to skip" + echo " --norestore Skip restoring dependencies" echo " --verbosity Msbuild verbosity: q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]" echo " --help Print help and exit" echo "" @@ -50,10 +51,11 @@ binary_log=true configuration="Debug" verbosity="minimal" exclude_ci_binary_log=false -restore=false +# restore defaults to on; --restore is retained only so existing consumers that pass it don't break. Use --norestore to opt out. +restore=true help=false properties='' -warnAsError=true +warn_as_error=true while (($# > 0)); do lowerI="$(echo $1 | tr "[:upper:]" "[:lower:]")" @@ -63,7 +65,10 @@ while (($# > 0)); do shift 2 ;; --restore) - restore=true + shift 1 + ;; + --norestore) + restore=false shift 1 ;; --verbosity) @@ -75,8 +80,8 @@ while (($# > 0)); do exclude_ci_binary_log=true shift 1 ;; - --noWarnAsError) - warnAsError=false + --nowarnaserror) + warn_as_error=false shift 1 ;; --help) @@ -97,6 +102,11 @@ if $help; then exit 0 fi +# sdk-task runs a standalone Arcade SDK task and does not need repo-specific toolset setup. +# Skip importing configure-toolset.sh so its side effects (e.g. a repo's configure-toolset.sh +# calling exit) don't terminate this script before the task runs. +disable_configure_toolset_import=1 + . "$scriptroot/tools.sh" InitializeToolset diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index 6f664ad890..ebc31f7ecd 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -13,6 +13,12 @@ # Set to true to output binary log from msbuild. Note that emitting binary log slows down the build. [bool]$binaryLog = if (Test-Path variable:binaryLog) { $binaryLog } else { $ci -and !$excludeCIBinarylog } +# Set to true to use the pipelines logger which will enable Azure logging output. +# https://github.com/Microsoft/azure-pipelines-tasks/blob/master/docs/authoring/commands.md +# This flag is meant as a temporary opt-in for the feature while validating it across +# our consumers. It will be deleted in the future. +[bool]$pipelinesLog = if (Test-Path variable:pipelinesLog) { $pipelinesLog } else { $ci } + # Turns on machine preparation/clean up code that changes the machine state (e.g. kills build processes). [bool]$prepareMachine = if (Test-Path variable:prepareMachine) { $prepareMachine } else { $false } @@ -65,6 +71,8 @@ $ErrorActionPreference = 'Stop' # True when the build is running within the VMR. [bool]$fromVMR = if (Test-Path variable:fromVMR) { $fromVMR } else { $false } +[bool]$disablePipelineSetResult = if (Test-Path variable:disablePipelineSetResult) { $disablePipelineSetResult } else { $false } + function Create-Directory ([string[]] $path) { New-Item -Path $path -Force -ItemType 'Directory' | Out-Null } @@ -713,7 +721,17 @@ function InitializeToolset() { $downloadArgs += "--configfile" $downloadArgs += $nugetConfig } - DotNet @downloadArgs + + # 'dotnet package download' fails outright if any source in the repo's NuGet.config is + # unavailable (for example a transport feed that was decommissioned after a release). The + # Arcade SDK is always published to the public dotnet-eng feed, so if the config-driven + # download fails, retry once against that feed directly (which ignores the other sources) + # before giving up, so a single dead source doesn't block the build. + $downloadExitCode = DotNet -ignoreFailure @downloadArgs + if ($downloadExitCode) { + Write-Host "Restoring the Arcade SDK from the configured sources failed; retrying from the public dotnet-eng feed." + DotNet @downloadArgs --source "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" + } $packageDir = Join-Path $nugetPackageCachePath (Join-Path 'microsoft.dotnet.arcade.sdk' $toolsetVersion) $packageToolsetDir = Join-Path $packageDir 'toolset' @@ -775,6 +793,19 @@ function MSBuild() { $buildTool = InitializeBuildTool + if ($pipelinesLog) { + $toolsetBuildProject = InitializeToolset + $basePath = Split-Path -parent $toolsetBuildProject + $selectedPath = Join-Path $basePath (Join-Path 'net' 'Microsoft.DotNet.ArcadeLogging.dll') + + # Only inject the logger when it's present. A last-known-good Arcade used to bootstrap + # the build may not ship the logger yet, so its absence must not be a hard error. + # Specify the logger type explicitly so loading is deterministic. + if (Test-Path $selectedPath) { + $args += "/logger:Microsoft.DotNet.ArcadeLogging.PipelinesLogger,$selectedPath" + } + } + $cmdArgs = "$($buildTool.Command) /m /nologo /clp:Summary /v:$verbosity /nr:$nodeReuse /p:ContinuousIntegrationBuild=$ci" # Add -mt flag for MSBuild multithreaded mode if enabled via environment variable @@ -813,8 +844,8 @@ function MSBuild() { Write-Host "Build failed with exit code $exitCode. Check errors above." -ForegroundColor Red # When running on Azure Pipelines, override the returned exit code to avoid double logging. - # Skip this when the build is a child of the VMR build. - if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) { + # Skip this when the build is a child of the VMR build, or when -disablePipelineSetResult is set so the real exit code propagates. + if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR -and !$disablePipelineSetResult) { Write-PipelineSetResult -Result "Failed" -Message "msbuild execution failed." # Exiting with an exit code causes the azure pipelines task to log yet another "noise" error # The above Write-PipelineSetResult will cause the task to be marked as failure without adding yet another error @@ -829,7 +860,7 @@ function MSBuild() { # Executes a dotnet command with arguments passed to the function. # Terminates the script if the command fails. # -function DotNet() { +function DotNet([switch]$ignoreFailure) { $dotnetRoot = InitializeDotNetCli -install:$restore $dotnetPath = Join-Path $dotnetRoot (GetExecutableFileName 'dotnet') @@ -848,9 +879,15 @@ function DotNet() { $exitCode = Exec-Process $dotnetPath $cmdArgs if ($exitCode -ne 0) { + # When -ignoreFailure is set, return the exit code to the caller so it can implement + # its own fallback logic instead of terminating the script. + if ($ignoreFailure) { + return $exitCode + } + Write-Host "dotnet command failed with exit code $exitCode. Check errors above." -ForegroundColor Red - if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) { + if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR -and !$disablePipelineSetResult) { Write-PipelineSetResult -Result "Failed" -Message "dotnet command execution failed." ExitWithExitCode 0 } else { diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 347a29b888..cd31d8a0a0 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -8,6 +8,16 @@ ci=${ci:-false} # Build mode source_build=${source_build:-false} +# Set to true to use the pipelines logger which will enable Azure logging output. +# https://github.com/Microsoft/azure-pipelines-tasks/blob/master/docs/authoring/commands.md +# This flag is meant as a temporary opt-in for the feature while validating it across +# our consumers. It will be deleted in the future. +if [[ "$ci" == true ]]; then + pipelines_log=${pipelines_log:-true} +else + pipelines_log=${pipelines_log:-false} +fi + # Build configuration. Common values include 'Debug' and 'Release', but the repository may use other names. configuration=${configuration:-'Debug'} @@ -68,6 +78,8 @@ runtime_source_feed_key=${runtime_source_feed_key:-''} # True when the build is running within the VMR. from_vmr=${from_vmr:-false} +disable_pipeline_set_result=${disable_pipeline_set_result:-false} + # Resolve any symlinks in the given path. function ResolvePath { local path=$1 @@ -442,7 +454,16 @@ function InitializeToolset { if [[ -n "$nuget_config" ]]; then download_args+=("--configfile" "$nuget_config") fi - DotNet "${download_args[@]}" + + # 'dotnet package download' fails outright if any source in the repo's NuGet.config is + # unavailable (for example a transport feed that was decommissioned after a release). The + # Arcade SDK is always published to the public dotnet-eng feed, so if the config-driven + # download fails, retry once against that feed directly (which ignores the other sources) + # before giving up, so a single dead source doesn't block the build. + if ! DotNet true "${download_args[@]}"; then + echo "Restoring the Arcade SDK from the configured sources failed; retrying from the public dotnet-eng feed." + DotNet "${download_args[@]}" --source "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" + fi local package_dir="$_InitializeNuGetPackageCachePath/microsoft.dotnet.arcade.sdk/$toolset_version" @@ -481,6 +502,15 @@ function StopProcesses { } function DotNet { + # When the first argument is 'true' or 'false' it controls the exit behavior on failure: + # 'true' returns the dotnet exit code to the caller (so it can implement its own fallback), + # while the default terminates the script. Any other first argument is treated as a dotnet argument. + local ignore_failure=false + if [[ "$1" == 'true' || "$1" == 'false' ]]; then + ignore_failure="$1" + shift + fi + InitializeDotNetCli $restore local dotnet_path="$_InitializeDotNetCli/dotnet" @@ -489,9 +519,14 @@ function DotNet { "$dotnet_path" "$@" || { local exit_code=$? + + if [[ "$ignore_failure" == true ]]; then + return $exit_code + fi + echo "dotnet command failed with exit code $exit_code. Check errors above." - if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true ]]; then + if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true && "$disable_pipeline_set_result" != true ]]; then Write-PipelineSetResult -result "Failed" -message "dotnet command execution failed." ExitWithExitCode 0 else @@ -510,6 +545,21 @@ function MSBuild { InitializeBuildTool + local logger_switch=() + if [[ "$pipelines_log" == true ]]; then + InitializeToolset + + local toolset_dir="${_InitializeToolset%/*}" + local selectedPath="$toolset_dir/net/Microsoft.DotNet.ArcadeLogging.dll" + + # Only inject the logger when it's present. A last-known-good Arcade used to bootstrap + # the build may not ship the logger yet, so its absence must not be a hard error. + # Specify the logger type explicitly so loading is deterministic. + if [[ -f "$selectedPath" ]]; then + logger_switch=("-logger:Microsoft.DotNet.ArcadeLogging.PipelinesLogger,$selectedPath") + fi + fi + local warnaserror_switch="" if [[ $warn_as_error == true ]]; then warnaserror_switch="/warnaserror" @@ -525,8 +575,8 @@ function MSBuild { echo "Build failed with exit code $exit_code. Check errors above." # When running on Azure Pipelines, override the returned exit code to avoid double logging. - # Skip this when the build is a child of the VMR build. - if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true ]]; then + # Skip this when the build is a child of the VMR build, or when -disablePipelineSetResult is set so the real exit code propagates. + if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true && "$disable_pipeline_set_result" != true ]]; then Write-PipelineSetResult -result "Failed" -message "msbuild execution failed." # Exiting with an exit code causes the azure pipelines task to log yet another "noise" error # The above Write-PipelineSetResult will cause the task to be marked as failure without adding yet another error @@ -548,7 +598,7 @@ function MSBuild { warnnotaserror_switch="/warnnotaserror:$warn_not_as_error /p:AdditionalWarningsNotAsErrors=$warn_not_as_error" fi - RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" + RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch "${logger_switch[@]}" /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" } function GetDarc { diff --git a/global.json b/global.json index a8567dacab..7b9b73fc82 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.5.26302.115" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26360.7" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26369.1" } } From 470abb8a441ce484a9127997f013a28914b344e2 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 27 Jul 2026 05:01:41 +0000 Subject: [PATCH 5/8] Update dependencies from https://github.com/dotnet/arcade build 20260724.3 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26374.3 --- eng/Version.Details.xml | 4 +- .../core-templates/job/helix-job-monitor.yml | 1 + eng/common/cross/build-rootfs.sh | 38 ++++++++++++------- global.json | 2 +- 4 files changed, 28 insertions(+), 17 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 4ea6ceacd1..236d36fd7e 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - 09bc8c946f4c4ae5d031c8875b85a6b8f1876b93 + de2fe253005235b3ffee14aca0e61d989bb8787e diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 0da13cf69d..4247a4f30b 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -190,6 +190,7 @@ jobs: --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}' --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. --stage-name '$(System.StageName)' + --stage-attempt '$(System.StageAttempt)' ) organization='${{ parameters.organization }}' diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh index 38a3512f14..f58abbd2d1 100644 --- a/eng/common/cross/build-rootfs.sh +++ b/eng/common/cross/build-rootfs.sh @@ -8,8 +8,8 @@ usage() echo "BuildArch can be: arm(default), arm64, loongarch64, ppc64le, riscv64, s390x, x64, x86" echo "CodeName - optional, Code name for Linux, can be: xenial(default), zesty, bionic, alpine" echo " for alpine can be specified with version: alpineX.YY or alpineedge" - echo " for FreeBSD can be: freebsd13, freebsd14" - echo " for OpenBSD can be: openbsd" + echo " for FreeBSD can be: freebsd14, freebsd15" + echo " for OpenBSD can be: openbsd7.8, openbsd7.9" echo " for illumos can be: illumos" echo " for Haiku can be: haiku." echo "lldbx.y - optional, LLDB version, can be: lldb3.9(default), lldb4.0, lldb5.0, lldb6.0 no-lldb. Ignored for alpine and FreeBSD" @@ -78,9 +78,9 @@ __AlpinePackages+=" krb5-dev" __AlpinePackages+=" openssl-dev" __AlpinePackages+=" zlib-dev" -__FreeBSDBase="13.5-RELEASE" -__FreeBSDPkg="2.7.5" -__FreeBSDABI="13" +__FreeBSDBase="14.4-RELEASE" +__FreeBSDPkg="2.8.0" +__FreeBSDABI="14" __FreeBSDPackages="libunwind" __FreeBSDPackages+=" icu" __FreeBSDPackages+=" libinotify" @@ -187,17 +187,14 @@ while :; do __AlpineArch=loongarch64 __QEMUArch=loongarch64 __UbuntuArch=loong64 - __UbuntuSuites=unreleased __LLDB_Package="liblldb-19-dev" ;; riscv64) __BuildArch=riscv64 __AlpineArch=riscv64 - __AlpinePackages="${__AlpinePackages// lldb-dev/}" __QEMUArch=riscv64 __UbuntuArch=riscv64 - __UbuntuPackages="${__UbuntuPackages// libunwind8-dev/}" - unset __LLDB_Package + __LLDB_Package="liblldb-19-dev" ;; ppc64le) __BuildArch=ppc64le @@ -291,6 +288,10 @@ while :; do __CodeName=noble __LLDB_Package="liblldb-19-dev" ;; + resolute) # Ubuntu 26.04 + __CodeName=resolute + __LLDB_Package="liblldb-21-dev" + ;; stretch) # Debian 9 __CodeName=stretch __LLDB_Package="liblldb-6.0-dev" @@ -331,7 +332,7 @@ while :; do # Debian-Ports architectures need different values case "$__UbuntuArch" in - amd64|arm64|armhf|i386|mips64el|ppc64el|riscv64|s390x) + amd64|arm64|armhf|i386|mips64el|ppc64el|riscv64|loong64|s390x) __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg" if [[ -z "$__UbuntuRepo" ]]; then @@ -365,20 +366,29 @@ while :; do __AlpineVersion="$__AlpineMajorVersion.$__AlpineMinorVersion" fi ;; - freebsd13) + freebsd14) __CodeName=freebsd __SkipUnmount=1 ;; - freebsd14) + freebsd15) __CodeName=freebsd - __FreeBSDBase="14.3-RELEASE" - __FreeBSDABI="14" + __FreeBSDBase="15.1-RELEASE" + __FreeBSDABI="15" __SkipUnmount=1 ;; openbsd) __CodeName=openbsd __SkipUnmount=1 ;; + openbsd7.8) + __CodeName=openbsd + __SkipUnmount=1 + ;; + openbsd7.9) + __CodeName=openbsd + __OpenBSDVersion="7.9" + __SkipUnmount=1 + ;; illumos) __CodeName=illumos __SkipUnmount=1 diff --git a/global.json b/global.json index 7b9b73fc82..6f0d62f495 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.5.26302.115" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26369.1" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26374.3" } } From 0d87c2cf402cc27e440c46e770e0746fc654fbdf Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 3 Aug 2026 05:01:05 +0000 Subject: [PATCH 6/8] Update dependencies from https://github.com/dotnet/arcade build 20260731.1 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26381.1 --- eng/Version.Details.xml | 4 ++-- .../core-templates/job/helix-job-monitor.yml | 17 ++++++++++++++++- .../core-templates/steps/publish-logs.yml | 1 - eng/common/tools.ps1 | 3 ++- eng/common/tools.sh | 4 ++-- global.json | 4 ++-- 6 files changed, 24 insertions(+), 9 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 236d36fd7e..013e054da3 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - de2fe253005235b3ffee14aca0e61d989bb8787e + 93eebf1a31a5eaafd44326f1a81ca107913e098c diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 4247a4f30b..0e92fb1f47 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -65,6 +65,12 @@ parameters: type: boolean default: true +# When true, allow the monitor to succeed when this stage produces no Helix jobs in any attempt. +# Forwarded as --allow-no-helix-jobs. +- name: allowNoHelixJobs + type: boolean + default: false + # When true, test results are reported to Azure DevOps using the fully qualified test name # (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as # well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display; @@ -104,9 +110,11 @@ jobs: pool: ${{ if eq(variables['System.TeamProject'], 'public') }}: name: $(DncEngPublicBuildPool) + os: linux demands: ImageOverride -equals build.azurelinux.3.amd64.open ${{ else }}: name: $(DncEngInternalBuildPool) + os: linux demands: ImageOverride -equals build.azurelinux.3.amd64 steps: - checkout: self @@ -187,6 +195,7 @@ jobs: --helix-base-uri '${{ parameters.helixBaseUri }}' --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' + --allow-no-helix-jobs '${{ parameters.allowNoHelixJobs }}' --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}' --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. --stage-name '$(System.StageName)' @@ -198,12 +207,18 @@ jobs: # Fall back to Azure DevOps-provided environment variables when the caller did not # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically - # 'owner/repo' for GitHub-backed builds. + # 'owner/repo' for GitHub-backed builds and 'owner-repo' for internal builds. if [ -z "$organization" ] || [ -z "$repository" ]; then buildRepoName="${BUILD_REPOSITORY_NAME:-}" if [ -n "$buildRepoName" ] && [[ "$buildRepoName" == */* ]]; then repoOwner="${buildRepoName%%/*}" repoName="${buildRepoName#*/}" + elif [ -n "$buildRepoName" ] && [[ "$buildRepoName" == *-* ]]; then + repoOwner="${buildRepoName%%-*}" + repoName="${buildRepoName#*-}" + fi + + if [ -n "${repoOwner:-}" ] && [ -n "${repoName:-}" ]; then if [ -z "$organization" ]; then organization="$repoOwner"; fi if [ -z "$repository" ]; then repository="$repoName"; fi fi diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml index 2731e48cce..c496f3d0dc 100644 --- a/eng/common/core-templates/steps/publish-logs.yml +++ b/eng/common/core-templates/steps/publish-logs.yml @@ -31,7 +31,6 @@ steps: -runtimeSourceFeed https://ci.dot.net/internal -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' '$(publishing-dnceng-devdiv-code-r-build-re)' - '$(dn-bot-all-orgs-artifact-feeds-rw)' '$(akams-client-id)' '$(System.AccessToken)' ${{parameters.CustomSensitiveDataList}} diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index ebc31f7ecd..da07386ff1 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -821,7 +821,8 @@ function MSBuild() { } if ($warnAsError -and $warnNotAsError) { - $cmdArgs += " /warnnotaserror:$warnNotAsError /p:AdditionalWarningsNotAsErrors=$warnNotAsError" + $escapedWarnNotAsError = $warnNotAsError -replace ';', '%3B' + $cmdArgs += " /warnnotaserror:$warnNotAsError /p:AdditionalWarningsNotAsErrors=$escapedWarnNotAsError" } foreach ($arg in $args) { diff --git a/eng/common/tools.sh b/eng/common/tools.sh index cd31d8a0a0..20f791c11d 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -595,10 +595,10 @@ function MSBuild { local warnnotaserror_switch="" if [[ -n "$warn_not_as_error" && "$warn_as_error" == true ]]; then - warnnotaserror_switch="/warnnotaserror:$warn_not_as_error /p:AdditionalWarningsNotAsErrors=$warn_not_as_error" + warnnotaserror_switch="/warnnotaserror:$warn_not_as_error /p:AdditionalWarningsNotAsErrors=${warn_not_as_error//;/%3B}" fi - RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch "${logger_switch[@]}" /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" + RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch ${logger_switch[@]+"${logger_switch[@]}"} /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" } function GetDarc { diff --git a/global.json b/global.json index 6f0d62f495..f470cf30c7 100644 --- a/global.json +++ b/global.json @@ -1,8 +1,8 @@ { "tools": { - "dotnet": "11.0.100-preview.5.26302.115" + "dotnet": "11.0.100-preview.6.26359.118" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26374.3" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26381.1" } } From 63dbf4d4c5bf794c09c1db08c1bd540ad91bec1d Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 10 Aug 2026 05:01:23 +0000 Subject: [PATCH 7/8] Update dependencies from https://github.com/dotnet/arcade build 20260807.8 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26407.8 --- eng/Version.Details.xml | 4 +- eng/common/Get-GitHubAppToken.ps1 | 154 ++++++++++++++++++ eng/common/SetupNugetSources.ps1 | 38 +++-- eng/common/SetupNugetSources.sh | 4 +- .../core-templates/job/helix-job-monitor.yml | 6 + eng/common/core-templates/job/onelocbuild.yml | 28 +++- .../job/publish-build-assets.yml | 2 - .../post-build/common-variables.yml | 2 - eng/common/core-templates/stages/renovate.yml | 2 + .../steps/enable-internal-sources.yml | 12 +- .../steps/get-github-app-token.yml | 79 +++++++++ .../core-templates/steps/publish-logs.yml | 3 - .../steps/get-github-app-token.yml | 7 + .../templates/steps/get-github-app-token.yml | 7 + global.json | 2 +- 15 files changed, 316 insertions(+), 34 deletions(-) create mode 100644 eng/common/Get-GitHubAppToken.ps1 create mode 100644 eng/common/core-templates/steps/get-github-app-token.yml create mode 100644 eng/common/templates-official/steps/get-github-app-token.yml create mode 100644 eng/common/templates/steps/get-github-app-token.yml diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 013e054da3..48fe79065d 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - 93eebf1a31a5eaafd44326f1a81ca107913e098c + 212960245c74330fbfb71776563638061e35446c diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1 new file mode 100644 index 0000000000..6b5899d7a2 --- /dev/null +++ b/eng/common/Get-GitHubAppToken.ps1 @@ -0,0 +1,154 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The signed JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements: +# - A GitHub App whose private key has been uploaded into Key Vault as an RSA +# key (the PEM converted to a Key Vault *key*, NOT stored as a secret). +# - The caller (the federated Azure service connection used to run this script) +# must have the `Key Vault Crypto User` role (or at minimum the `Sign` +# action) on that key. +# - The App must be installed on the target organization/account +# (`InstallationOwner`) with the permissions/repositories it needs. +# +# Installation tokens (ghs_*) are exempt from the enterprise classic-PAT +# lifetime policy, which is why this replaces the long-lived PAT. + +[CmdletBinding()] +param( + # Name of the Key Vault that holds the GitHub App's RSA signing key. + [Parameter(Mandatory = $true)] + [string] $KeyVaultName, + + # Name of the RSA key inside the Key Vault (the App's private key). + [Parameter(Mandatory = $true)] + [string] $KeyName, + + # The GitHub App's Client ID (the value to put in the `iss` JWT claim). + [Parameter(Mandatory = $true)] + [string] $AppClientId, + + # Login of the organization or user account whose installation we should + # mint the token for (e.g. `dotnet`, `microsoft`). + [Parameter(Mandatory = $true)] + [string] $InstallationOwner, + + # Optional Azure DevOps pipeline variable name to set with the installation + # token (marked as a secret). When not specified, the token is written to + # stdout instead. + [Parameter(Mandatory = $false)] + [string] $OutputVariableName +) + +$ErrorActionPreference = 'Stop' +$PSNativeCommandUseErrorActionPreference = $true + +. $PSScriptRoot\pipeline-logging-functions.ps1 + +function ConvertTo-Base64Url([byte[]] $bytes) { + return [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_') +} + +# Build JWT header and payload. Use [ordered] hashtables so JSON +# serialization is deterministic. +$jwtHeader = [ordered]@{ + alg = 'RS256' + typ = 'JWT' +} +$now = [System.DateTimeOffset]::UtcNow +$jwtPayload = [ordered]@{ + iat = $now.AddMinutes(-1).ToUnixTimeSeconds() + exp = $now.AddMinutes(5).ToUnixTimeSeconds() + iss = $AppClientId +} + +$headerEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtHeader | ConvertTo-Json -Compress))) +$payloadEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtPayload | ConvertTo-Json -Compress))) +$signingInput = "$headerEncoded.$payloadEncoded" + +# Key Vault `sign` expects the *digest* (base64), not the raw bytes. +$sha256 = [System.Security.Cryptography.SHA256]::Create() +$digestBytes = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($signingInput)) +$digestBase64 = [Convert]::ToBase64String($digestBytes) + +Write-Host "Signing JWT with key '$KeyName' in vault '$KeyVaultName'..." +$previousNativeCommandErrorPreference = $PSNativeCommandUseErrorActionPreference +try { + # Azure CLI can emit non-fatal Python warnings to stderr even when signing succeeds. + # Use the exit code to determine success for this invocation. + $PSNativeCommandUseErrorActionPreference = $false + $signatureBase64 = az keyvault key sign ` + --vault-name $KeyVaultName ` + --name $KeyName ` + --algorithm RS256 ` + --digest $digestBase64 ` + --query signature ` + --output tsv ` + --only-show-errors + $signExitCode = $LASTEXITCODE +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to sign the JWT via Key Vault (key '$KeyName', vault '$KeyVaultName'): $_. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +finally { + $PSNativeCommandUseErrorActionPreference = $previousNativeCommandErrorPreference +} +if ($signExitCode -ne 0 -or [string]::IsNullOrWhiteSpace($signatureBase64)) { + Write-PipelineTelemetryError -Category 'Build' -Message "'az keyvault key sign' exited with code $signExitCode for key '$KeyName' in vault '$KeyVaultName'. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +$signatureUrl = $signatureBase64.Trim().TrimEnd('=').Replace('+', '-').Replace('/', '_') +$jwt = "$signingInput.$signatureUrl" + +$headers = @{ + Authorization = "Bearer $jwt" + 'X-GitHub-Api-Version' = '2022-11-28' + Accept = 'application/vnd.github+json' + 'User-Agent' = 'dotnet-arcade-onelocbuild' +} + +Write-Host "Looking up installation for '$InstallationOwner'..." +try { + $installations = @() + $page = 1 + do { + $pageInstallations = @(Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations?per_page=100&page=$page" ` + -Headers $headers ` + -Method Get) + $installations += $pageInstallations + $page++ + } while ($pageInstallations.Count -eq 100) +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect." + exit 1 +} +$installation = $installations | Where-Object { $_.account.login -ieq $InstallationOwner } | Select-Object -First 1 +if (-not $installation) { + $found = ($installations | ForEach-Object { $_.account.login }) -join ', ' + Write-PipelineTelemetryError -Category 'Build' -Message "No installation found for '$InstallationOwner'. App is installed on: $found" + exit 1 +} + +try { + $tokenResponse = Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations/$($installation.id)/access_tokens" ` + -Headers $headers ` + -Method Post ` + -ContentType 'application/json' +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to mint an installation access token for '$InstallationOwner' (installation $($installation.id)): $_" + exit 1 +} + +Write-Host "Got installation token for '$InstallationOwner' (expires $($tokenResponse.expires_at))." +if ($OutputVariableName) { + Write-Host "Setting pipeline variable '$OutputVariableName'." + Write-Host "##vso[task.setvariable variable=$OutputVariableName;issecret=true]$($tokenResponse.token)" +} +else { + Write-Host $tokenResponse.token -ForegroundColor Green +} diff --git a/eng/common/SetupNugetSources.ps1 b/eng/common/SetupNugetSources.ps1 index b3bddff355..b7a3769364 100644 --- a/eng/common/SetupNugetSources.ps1 +++ b/eng/common/SetupNugetSources.ps1 @@ -11,7 +11,7 @@ # condition: eq(variables['Agent.OS'], 'Windows_NT') # inputs: # filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.ps1 -# arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $Env:Token +# arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config # env: # Token: $(InternalFeedToken) # @@ -29,12 +29,14 @@ [CmdletBinding()] param ( [Parameter(Mandatory = $true)][string]$ConfigFile, - $Password + # Keep the legacy name as an alias while callers migrate secrets to the Token environment variable. + [Alias("Password")]$Credential ) $ErrorActionPreference = "Stop" Set-StrictMode -Version 2.0 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 +$feedCredential = if ($env:Token) { $env:Token } else { $Credential } # This script only consumes helper functions from tools.ps1 to configure NuGet feeds. # Skip importing configure-toolset.ps1 so that repo-specific toolset setup (e.g. acquiring @@ -44,14 +46,14 @@ $disableConfigureToolsetImport = $true . $PSScriptRoot\tools.ps1 # Adds or enables the package source with the given name -function AddOrEnablePackageSource($sources, $disabledPackageSources, $SourceName, $SourceEndPoint, $creds, $Username, $pwd) { - if ($disabledPackageSources -eq $null -or -not (EnableInternalPackageSource -DisabledPackageSources $disabledPackageSources -Creds $creds -PackageSourceName $SourceName)) { - AddPackageSource -Sources $sources -SourceName $SourceName -SourceEndPoint $SourceEndPoint -Creds $creds -Username $userName -pwd $Password +function AddOrEnablePackageSource($sources, $disabledPackageSources, $SourceName, $SourceEndPoint, $creds, $Username, $credential) { + if ($disabledPackageSources -eq $null -or -not (EnableInternalPackageSource -DisabledPackageSources $disabledPackageSources -Creds $creds -PackageSourceName $SourceName -Credential $credential)) { + AddPackageSource -Sources $sources -SourceName $SourceName -SourceEndPoint $SourceEndPoint -Creds $creds -Username $Username -credential $credential } } # Add source entry to PackageSources -function AddPackageSource($sources, $SourceName, $SourceEndPoint, $creds, $Username, $pwd) { +function AddPackageSource($sources, $SourceName, $SourceEndPoint, $creds, $Username, $credential) { $packageSource = $sources.SelectSingleNode("add[@key='$SourceName']") if ($packageSource -eq $null) @@ -67,13 +69,13 @@ function AddPackageSource($sources, $SourceName, $SourceEndPoint, $creds, $Usern Write-Host "Package source $SourceName already present and enabled." } - AddCredential -Creds $creds -Source $SourceName -Username $Username -pwd $pwd + AddCredential -Creds $creds -Source $SourceName -Username $Username -credential $credential } # Add a credential node for the specified source -function AddCredential($creds, $source, $username, $pwd) { +function AddCredential($creds, $source, $username, $credential) { # If no cred supplied, don't do anything. - if (!$pwd) { + if (!$credential) { return; } @@ -108,19 +110,19 @@ function AddCredential($creds, $source, $username, $pwd) { $sourceElement.AppendChild($passwordElement) | Out-Null } - $passwordElement.SetAttribute("value", $pwd) + $passwordElement.SetAttribute("value", $credential) } # Enable all darc-int package sources. -function EnableMaestroInternalPackageSources($DisabledPackageSources, $Creds) { +function EnableMaestroInternalPackageSources($DisabledPackageSources, $Creds, $Credential) { $maestroInternalSources = $DisabledPackageSources.SelectNodes("add[contains(@key,'darc-int')]") ForEach ($DisabledPackageSource in $maestroInternalSources) { - EnableInternalPackageSource -DisabledPackageSources $DisabledPackageSources -Creds $Creds -PackageSourceName $DisabledPackageSource.key + EnableInternalPackageSource -DisabledPackageSources $DisabledPackageSources -Creds $Creds -PackageSourceName $DisabledPackageSource.key -Credential $Credential } } # Enables an internal package source by name, if found. Returns true if the package source was found and enabled, false otherwise. -function EnableInternalPackageSource($DisabledPackageSources, $Creds, $PackageSourceName) { +function EnableInternalPackageSource($DisabledPackageSources, $Creds, $PackageSourceName, $Credential) { $DisabledPackageSource = $DisabledPackageSources.SelectSingleNode("add[@key='$PackageSourceName']") if ($DisabledPackageSource) { Write-Host "Enabling internal source '$($DisabledPackageSource.key)'." @@ -128,7 +130,7 @@ function EnableInternalPackageSource($DisabledPackageSources, $Creds, $PackageSo # Due to https://github.com/NuGet/Home/issues/10291, we must actually remove the disabled entries $DisabledPackageSources.RemoveChild($DisabledPackageSource) - AddCredential -Creds $creds -Source $DisabledPackageSource.Key -Username $userName -pwd $Password + AddCredential -Creds $creds -Source $DisabledPackageSource.Key -Username $userName -credential $credential return $true } return $false @@ -153,7 +155,7 @@ if ($sources -eq $null) { $creds = $null $feedSuffix = "v3/index.json" -if ($Password) { +if ($feedCredential) { $feedSuffix = "v2" # Looks for a node. Create it if none is found. $creds = $doc.DocumentElement.SelectSingleNode("packageSourceCredentials") @@ -169,7 +171,7 @@ $userName = "dn-bot" $disabledSources = $doc.DocumentElement.SelectSingleNode("disabledPackageSources") if ($disabledSources -ne $null) { Write-Host "Checking for any darc-int disabled package sources in the disabledPackageSources node" - EnableMaestroInternalPackageSources -DisabledPackageSources $disabledSources -Creds $creds + EnableMaestroInternalPackageSources -DisabledPackageSources $disabledSources -Creds $creds -Credential $feedCredential } $dotnetVersions = @('5','6','7','8','9','10') @@ -177,8 +179,8 @@ foreach ($dotnetVersion in $dotnetVersions) { $feedPrefix = "dotnet" + $dotnetVersion; $dotnetSource = $sources.SelectSingleNode("add[@key='$feedPrefix']") if ($dotnetSource -ne $null) { - AddOrEnablePackageSource -Sources $sources -DisabledPackageSources $disabledSources -SourceName "$feedPrefix-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal/nuget/$feedSuffix" -Creds $creds -Username $userName -pwd $Password - AddOrEnablePackageSource -Sources $sources -DisabledPackageSources $disabledSources -SourceName "$feedPrefix-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal-transport/nuget/$feedSuffix" -Creds $creds -Username $userName -pwd $Password + AddOrEnablePackageSource -Sources $sources -DisabledPackageSources $disabledSources -SourceName "$feedPrefix-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal/nuget/$feedSuffix" -Creds $creds -Username $userName -credential $feedCredential + AddOrEnablePackageSource -Sources $sources -DisabledPackageSources $disabledSources -SourceName "$feedPrefix-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal-transport/nuget/$feedSuffix" -Creds $creds -Username $userName -credential $feedCredential } } diff --git a/eng/common/SetupNugetSources.sh b/eng/common/SetupNugetSources.sh index 67e7e0942c..c3ae8ac054 100644 --- a/eng/common/SetupNugetSources.sh +++ b/eng/common/SetupNugetSources.sh @@ -24,7 +24,9 @@ # This logic is also abstracted into enable-internal-sources.yml. ConfigFile=$1 -CredToken=$2 +# Prefer the environment variable so credentials do not appear in process arguments. +# Retain the positional argument as a compatibility fallback for existing callers. +CredToken=${Token:-$2} NL='\n' TB=' ' diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 0e92fb1f47..a65b50d0a7 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -26,6 +26,11 @@ parameters: type: string default: '' +# Whether failures in the monitor job should allow the pipeline to continue. +- name: continueOnError + type: boolean + default: false + # NuGet package id of the Helix job monitor tool. - name: toolPackageId type: string @@ -103,6 +108,7 @@ jobs: - job: HelixJobMonitor displayName: Monitor Helix Jobs timeoutInMinutes: ${{ parameters.timeoutInMinutes }} + continueOnError: ${{ parameters.continueOnError }} ${{ if ne(length(parameters.dependsOn), 0) }}: dependsOn: ${{ parameters.dependsOn }} ${{ if ne(parameters.condition, '') }}: diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 2816d2905a..4f5653d73a 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -14,6 +14,15 @@ parameters: # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + # GitHub App authentication for the OneLoc check-in PR (dnceng/internal only). + # The infrastructure identifiers are centralized here and the App path is enabled by default. + # DevDiv requires its own project-scoped service connection before this path can be enabled there. + UseGitHubAppAuthentication: true + GitHubAppServiceConnection: 'dnceng-oneloc-githubapp' + GitHubAppClientId: 'Iv23lijBU8x3gc9lDOc9' + GitHubAppKeyVaultName: 'EngKeyVault' + GitHubAppKeyName: 'oneloc-localization-app-key' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -89,6 +98,20 @@ jobs: outputVariableName: 'CeapexEntraToken' condition: ${{ parameters.condition }} + # Mint a short-lived GitHub App installation token for the loc check-in PR (dnceng/internal only). + # All other projects fall back to PAT-based auth, since the app service connection is scoped to dnceng/internal. + - ${{ if and(eq(parameters.RepoType, 'gitHub'), eq(parameters.UseGitHubAppAuthentication, true), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: ${{ parameters.is1ESPipeline }} + azureSubscription: ${{ parameters.GitHubAppServiceConnection }} + keyVaultName: ${{ parameters.GitHubAppKeyVaultName }} + keyName: ${{ parameters.GitHubAppKeyName }} + appClientId: ${{ parameters.GitHubAppClientId }} + installationOwner: ${{ parameters.GitHubOrg }} + outputVariableName: 'GitHubAppInstallationToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -110,7 +133,10 @@ jobs: patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} - gitHubPatVariable: "${{ parameters.GithubPat }}" + ${{ if and(eq(parameters.UseGitHubAppAuthentication, true), eq(variables['System.TeamProject'], 'internal')) }}: + gitHubPatVariable: "$(GitHubAppInstallationToken)" + ${{ if or(eq(parameters.UseGitHubAppAuthentication, false), ne(variables['System.TeamProject'], 'internal')) }}: + gitHubPatVariable: "${{ parameters.GithubPat }}" ${{ if ne(parameters.MirrorRepo, '') }}: isMirrorRepoSelected: true gitHubOrganization: ${{ parameters.GitHubOrg }} diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml index 4229288d3d..330225ae09 100644 --- a/eng/common/core-templates/job/publish-build-assets.yml +++ b/eng/common/core-templates/job/publish-build-assets.yml @@ -58,8 +58,6 @@ jobs: parameters: is1ESPipeline: ${{ parameters.is1ESPipeline }} - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false # unconditional - needed for logs publishing (redactor tool version) diff --git a/eng/common/core-templates/post-build/common-variables.yml b/eng/common/core-templates/post-build/common-variables.yml index db298ae16b..a3a8480e25 100644 --- a/eng/common/core-templates/post-build/common-variables.yml +++ b/eng/common/core-templates/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/eng/common/core-templates/stages/renovate.yml b/eng/common/core-templates/stages/renovate.yml index edab281825..cfa9683794 100644 --- a/eng/common/core-templates/stages/renovate.yml +++ b/eng/common/core-templates/stages/renovate.yml @@ -81,6 +81,8 @@ resources: extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: + settings: + networkIsolationPolicy: Permissive pool: ${{ parameters.pool }} sdl: sourceAnalysisPool: ${{ parameters.sdlPool }} diff --git a/eng/common/core-templates/steps/enable-internal-sources.yml b/eng/common/core-templates/steps/enable-internal-sources.yml index 51af9a0170..843cdff782 100644 --- a/eng/common/core-templates/steps/enable-internal-sources.yml +++ b/eng/common/core-templates/steps/enable-internal-sources.yml @@ -19,7 +19,7 @@ steps: displayName: Setup Internal Feeds inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.ps1 - arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $Env:Token + arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config env: Token: ${{ parameters.legacyCredential }} - task: Bash@3 @@ -28,7 +28,7 @@ steps: inputs: targetType: inline script: | - "$(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh" "$(System.DefaultWorkingDirectory)/NuGet.config" "$Token" + "$(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh" "$(System.DefaultWorkingDirectory)/NuGet.config" env: Token: ${{ parameters.legacyCredential }} # If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate. @@ -58,13 +58,17 @@ steps: displayName: Setup Internal Feeds inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.ps1 - arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $(dnceng-artifacts-feeds-read-access-token) + arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config + env: + Token: $(dnceng-artifacts-feeds-read-access-token) - task: Bash@3 condition: and(succeeded(), ne(variables['Agent.Os'], 'Windows_NT')) displayName: Setup Internal Feeds inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh - arguments: $(System.DefaultWorkingDirectory)/NuGet.config $(dnceng-artifacts-feeds-read-access-token) + arguments: $(System.DefaultWorkingDirectory)/NuGet.config + env: + Token: $(dnceng-artifacts-feeds-read-access-token) # This is required in certain scenarios to install the ADO credential provider. # It installed by default in some msbuild invocations (e.g. VS msbuild), but needs to be installed for others # (e.g. dotnet msbuild). diff --git a/eng/common/core-templates/steps/get-github-app-token.yml b/eng/common/core-templates/steps/get-github-app-token.yml new file mode 100644 index 0000000000..6d42a48d3c --- /dev/null +++ b/eng/common/core-templates/steps/get-github-app-token.yml @@ -0,0 +1,79 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements (per GitHub App you want to authenticate as): +# - A GitHub App with its private key uploaded into Key Vault as an RSA key +# (PEM converted to a key, NOT stored as a secret). +# - The Azure service connection passed via `azureSubscription` must be +# granted the `Key Vault Crypto User` role (or at minimum `Sign` action) +# on that key. +# - The App must be installed on the target organization/account +# (`installationOwner`) with the permissions/repositories you need. +# +# Output: a secret pipeline variable named ${{ parameters.outputVariableName }} +# containing the installation access token. Token lifetime is ~1 hour and is +# automatically scrubbed from logs. Installation tokens are exempt from the +# enterprise classic-PAT lifetime policy. + +parameters: +# Azure DevOps service connection (federated) that can call +# `az keyvault key sign` on the App's signing key. +- name: azureSubscription + type: string + +# Name of the Key Vault that holds the GitHub App's RSA signing key. +- name: keyVaultName + type: string + +# Name of the RSA key inside the Key Vault (the App's private key). +- name: keyName + type: string + +# The GitHub App's Client ID (the value to put in the `iss` JWT claim). +# Prefer this over the numeric App ID; GitHub accepts either, but Client ID +# is the documented form going forward. +- name: appClientId + type: string + +# Login of the organization or user account whose installation we should +# mint the token for (e.g. `dotnet`, `microsoft`). +- name: installationOwner + type: string + +# Name of the pipeline variable that will receive the installation token. +- name: outputVariableName + type: string + +- name: is1ESPipeline + type: boolean + +- name: stepName + type: string + default: getGitHubAppInstallationToken + +- name: condition + type: string + default: '' + +- name: displayName + type: string + default: Get GitHub App installation token + +steps: +- task: AzureCLI@2 + displayName: ${{ parameters.displayName }} + name: ${{ parameters.stepName }} + ${{ if ne(parameters.condition, '') }}: + condition: ${{ parameters.condition }} + inputs: + azureSubscription: ${{ parameters.azureSubscription }} + scriptType: pscore + scriptLocation: inlineScript + inlineScript: | + & "$(System.DefaultWorkingDirectory)/eng/common/Get-GitHubAppToken.ps1" ` + -KeyVaultName '${{ parameters.keyVaultName }}' ` + -KeyName '${{ parameters.keyName }}' ` + -AppClientId '${{ parameters.appClientId }}' ` + -InstallationOwner '${{ parameters.installationOwner }}' ` + -OutputVariableName '${{ parameters.outputVariableName }}' diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml index c496f3d0dc..2c1e0ab116 100644 --- a/eng/common/core-templates/steps/publish-logs.yml +++ b/eng/common/core-templates/steps/publish-logs.yml @@ -30,8 +30,6 @@ steps: -TokensFilePath '$(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' -runtimeSourceFeed https://ci.dot.net/internal -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' - '$(publishing-dnceng-devdiv-code-r-build-re)' - '$(akams-client-id)' '$(System.AccessToken)' ${{parameters.CustomSensitiveDataList}} continueOnError: true @@ -56,4 +54,3 @@ steps: condition: always() retryCountOnTaskFailure: 10 # for any files being locked isProduction: false # logs are non-production artifacts - diff --git a/eng/common/templates-official/steps/get-github-app-token.yml b/eng/common/templates-official/steps/get-github-app-token.yml new file mode 100644 index 0000000000..c89f3641a4 --- /dev/null +++ b/eng/common/templates-official/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: true + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/eng/common/templates/steps/get-github-app-token.yml b/eng/common/templates/steps/get-github-app-token.yml new file mode 100644 index 0000000000..79e182c641 --- /dev/null +++ b/eng/common/templates/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: false + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/global.json b/global.json index f470cf30c7..da9d2e2709 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.6.26359.118" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26381.1" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26407.8" } } From 10fbcac4dc7f47898d4808b57bd4ce3b8726edac Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 17 Aug 2026 05:01:23 +0000 Subject: [PATCH 8/8] Update dependencies from https://github.com/dotnet/arcade build 20260814.2 On relative base path root Microsoft.DotNet.Arcade.Sdk From Version 11.0.0-beta.26310.1 -> To Version 11.0.0-beta.26414.2 --- eng/Version.Details.xml | 4 ++-- eng/common/Get-GitHubAppToken.ps1 | 18 ++++++++++---- eng/common/build.ps1 | 7 +++--- eng/common/build.sh | 14 ++++++----- .../core-templates/job/helix-job-monitor.yml | 13 ++++++++++ .../core-templates/post-build/post-build.yml | 1 + .../core-templates/steps/publish-logs.yml | 22 +++++++++++------ eng/common/msbuild.ps1 | 10 ++++---- eng/common/msbuild.sh | 16 ++++++------- eng/common/tools.ps1 | 11 ++++++--- eng/common/tools.sh | 24 ++++++++++++++++--- global.json | 2 +- 12 files changed, 98 insertions(+), 44 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 48fe79065d..4c558cd76d 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -3,9 +3,9 @@ - + https://github.com/dotnet/arcade - 212960245c74330fbfb71776563638061e35446c + 09a0bcffb8286738e8679282171cd1ba548c8c52 diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1 index 6b5899d7a2..9c7e3dcd6a 100644 --- a/eng/common/Get-GitHubAppToken.ps1 +++ b/eng/common/Get-GitHubAppToken.ps1 @@ -113,10 +113,13 @@ try { $installations = @() $page = 1 do { - $pageInstallations = @(Invoke-RestMethod ` + # Assign the response before wrapping it in @(). PowerShell otherwise + # preserves a top-level JSON array as one nested pipeline object. + $pageResponse = Invoke-RestMethod ` -Uri "https://api.github.com/app/installations?per_page=100&page=$page" ` -Headers $headers ` - -Method Get) + -Method Get + $pageInstallations = @($pageResponse) $installations += $pageInstallations $page++ } while ($pageInstallations.Count -eq 100) @@ -125,12 +128,19 @@ catch { Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect." exit 1 } -$installation = $installations | Where-Object { $_.account.login -ieq $InstallationOwner } | Select-Object -First 1 -if (-not $installation) { +$matchingInstallations = @($installations | Where-Object { $_.account.login -ieq $InstallationOwner }) +if ($matchingInstallations.Count -eq 0) { $found = ($installations | ForEach-Object { $_.account.login }) -join ', ' Write-PipelineTelemetryError -Category 'Build' -Message "No installation found for '$InstallationOwner'. App is installed on: $found" exit 1 } +if ($matchingInstallations.Count -ne 1) { + $matchingIds = ($matchingInstallations | ForEach-Object { $_.id }) -join ', ' + Write-PipelineTelemetryError -Category 'Build' -Message "Found multiple installations for '$InstallationOwner': $matchingIds" + exit 1 +} +$installation = $matchingInstallations[0] +Write-Host "Using installation $($installation.id) for '$($installation.account.login)'." try { $tokenResponse = Invoke-RestMethod ` diff --git a/eng/common/build.ps1 b/eng/common/build.ps1 index dd84699f50..fee2f83991 100644 --- a/eng/common/build.ps1 +++ b/eng/common/build.ps1 @@ -8,6 +8,7 @@ Param( [bool] $warnAsError = $true, [string] $warnNotAsError = '', [bool] $nodeReuse = $true, + [bool][Alias('mt')]$msbuildMultiThreaded = $false, [switch] $buildCheck = $false, [switch][Alias('r')]$restore, [switch] $deployDeps, @@ -79,6 +80,7 @@ function Print-Usage() { Write-Host " -excludePrereleaseVS Set to exclude build engines in prerelease versions of Visual Studio" Write-Host " -nativeToolsOnMachine Sets the native tools on machine environment variable (indicating that the script should use native tools on machine)" Write-Host " -nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" + Write-Host " -msbuildMultiThreaded Sets MSBuild's multi-threaded mode, i.e. the -mt switch ('1' or '0') (short: -mt)" Write-Host " -buildCheck Sets /check msbuild parameter" Write-Host " -fromVMR Set when building from within the VMR" Write-Host " -disablePipelineSetResult Set to disable masking the actual exit code in the pipeline when the build fails" @@ -175,9 +177,8 @@ try { if (-not $excludeCIBinarylog) { $binaryLog = $true } - # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") { + # Node reuse isn't used on CI unless it was explicitly requested via -nodeReuse. + if (-not $PSBoundParameters.ContainsKey('nodeReuse')) { $nodeReuse = $false } } diff --git a/eng/common/build.sh b/eng/common/build.sh index e37edd6cff..109d83ff73 100755 --- a/eng/common/build.sh +++ b/eng/common/build.sh @@ -43,6 +43,7 @@ usage() echo " --pipelinesLog Promote msbuild errors/warnings to Azure Pipelines timeline issues; defaults to on in CI (short: -pl)" echo " --prepareMachine Prepare machine for CI run, clean up processes after build" echo " --nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" + echo " --msbuildMultiThreaded Sets MSBuild's multi-threaded mode, i.e. the -mt switch ('true' or 'false') (short: --mt)" echo " --warnAsError Sets warnaserror msbuild parameter ('true' or 'false')" echo " --warnNotAsError Sets a semi-colon delimited list of warning codes that should not be treated as errors" echo " --buildCheck Sets /check msbuild parameter" @@ -84,7 +85,9 @@ clean=false warn_as_error=true warn_not_as_error='' -node_reuse=true +# Empty means "not specified"; tools.sh defaults these to on for local builds and off on CI. +node_reuse='' +msbuild_multi_threaded='' build_check=false binary_log=false binary_log_name='' @@ -199,6 +202,10 @@ while [[ $# -gt 0 ]]; do node_reuse=$2 shift ;; + -msbuildmultithreaded|-mt) + msbuild_multi_threaded=$2 + shift + ;; -buildcheck) build_check=true ;; @@ -224,11 +231,6 @@ fi if [[ "$ci" == true ]]; then pipelines_log=true - # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then - node_reuse=false - fi if [[ "$exclude_ci_binary_log" == false ]]; then binary_log=true fi diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index a65b50d0a7..81ecccdd17 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -84,6 +84,15 @@ parameters: type: boolean default: false +# Controls per-test output attachments. Defaults to Failed. +- name: testResultAttachmentMode + type: string + default: Failed + values: + - Failed + - All + - None + # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is @@ -210,6 +219,7 @@ jobs: organization='${{ parameters.organization }}' repository='${{ parameters.repository }}' + testResultAttachmentMode='${{ parameters.testResultAttachmentMode }}' # Fall back to Azure DevOps-provided environment variables when the caller did not # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically @@ -232,6 +242,9 @@ jobs: if [ -n "$organization" ]; then toolArgs+=( --organization "$organization" ); fi if [ -n "$repository" ]; then toolArgs+=( --repository "$repository" ); fi + if [ -n "$testResultAttachmentMode" ]; then + toolArgs+=( --test-result-attachment-mode "$testResultAttachmentMode" ) + fi # Build.Reason and Build.SourceBranch are required to derive the Helix source filter # the same way the Helix SDK submitter does (PR -> 'pr', internal -> 'official', diff --git a/eng/common/core-templates/post-build/post-build.yml b/eng/common/core-templates/post-build/post-build.yml index 9d95135269..6dcee6664d 100644 --- a/eng/common/core-templates/post-build/post-build.yml +++ b/eng/common/core-templates/post-build/post-build.yml @@ -236,6 +236,7 @@ stages: StageLabel: 'Validation' JobLabel: 'Signing' BinlogToolVersion: $(BinlogToolVersion) + enableInternalRuntimes: false # SourceLink validation has been removed — the underlying CLI tool # (targeting netcoreapp2.1) has not functioned for years. diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml index 2c1e0ab116..3f0a9b9e6a 100644 --- a/eng/common/core-templates/steps/publish-logs.yml +++ b/eng/common/core-templates/steps/publish-logs.yml @@ -5,6 +5,7 @@ parameters: # A default - in case value from eng/common/core-templates/post-build/common-variables.yml is not passed BinlogToolVersion: '1.0.11' is1ESPipeline: false + enableInternalRuntimes: true steps: - task: Powershell@2 @@ -25,13 +26,20 @@ steps: # Sensitive data can as well be added to $(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' # If the file exists - sensitive data for redaction will be sourced from it # (single entry per line, lines starting with '# ' are considered comments and skipped) - arguments: -InputPath '$(System.DefaultWorkingDirectory)/PostBuildLogs' - -BinlogToolVersion '${{parameters.BinlogToolVersion}}' - -TokensFilePath '$(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' - -runtimeSourceFeed https://ci.dot.net/internal - -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' - '$(System.AccessToken)' - ${{parameters.CustomSensitiveDataList}} + ${{ if and(parameters.enableInternalRuntimes, ne(variables['System.TeamProject'], 'public')) }}: + arguments: -InputPath '$(System.DefaultWorkingDirectory)/PostBuildLogs' + -BinlogToolVersion '${{parameters.BinlogToolVersion}}' + -TokensFilePath '$(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' + -runtimeSourceFeed https://ci.dot.net/internal + -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' + '$(System.AccessToken)' + ${{parameters.CustomSensitiveDataList}} + ${{ else }}: + arguments: -InputPath '$(System.DefaultWorkingDirectory)/PostBuildLogs' + -BinlogToolVersion '${{parameters.BinlogToolVersion}}' + -TokensFilePath '$(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' + '$(System.AccessToken)' + ${{parameters.CustomSensitiveDataList}} continueOnError: true condition: always() diff --git a/eng/common/msbuild.ps1 b/eng/common/msbuild.ps1 index 495d533a90..b6dfb570ea 100644 --- a/eng/common/msbuild.ps1 +++ b/eng/common/msbuild.ps1 @@ -3,6 +3,7 @@ Param( [string] $verbosity = 'minimal', [bool] $warnAsError = $true, [bool] $nodeReuse = $true, + [bool][Alias('mt')]$msbuildMultiThreaded = $false, [switch] $ci, [switch] $prepareMachine, [switch] $excludePrereleaseVS, @@ -13,12 +14,9 @@ Param( . $PSScriptRoot\tools.ps1 try { - if ($ci) { - # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") { - $nodeReuse = $false - } + # Node reuse isn't used on CI unless it was explicitly requested via -nodeReuse. + if ($ci -and -not $PSBoundParameters.ContainsKey('nodeReuse')) { + $nodeReuse = $false } MSBuild @extraArgs diff --git a/eng/common/msbuild.sh b/eng/common/msbuild.sh index 333be3232f..a40c101237 100755 --- a/eng/common/msbuild.sh +++ b/eng/common/msbuild.sh @@ -14,7 +14,9 @@ scriptroot="$( cd -P "$( dirname "$source" )" && pwd )" verbosity='minimal' warn_as_error=true -node_reuse=true +# Empty means "not specified"; tools.sh defaults these to on for local builds and off on CI. +node_reuse='' +msbuild_multi_threaded='' prepare_machine=false extra_args='' @@ -33,6 +35,10 @@ while (($# > 0)); do node_reuse=$2 shift 2 ;; + --msbuildmultithreaded|--mt) + msbuild_multi_threaded=$2 + shift 2 + ;; --ci) ci=true shift 1 @@ -50,13 +56,5 @@ done . "$scriptroot/tools.sh" -if [[ "$ci" == true ]]; then - # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. - # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. - if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then - node_reuse=false - fi -fi - MSBuild $extra_args ExitWithExitCode 0 diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index da07386ff1..e84033dad9 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -31,11 +31,16 @@ # Set to true to reuse msbuild nodes. Recommended to not reuse on CI. [bool]$nodeReuse = if (Test-Path variable:nodeReuse) { $nodeReuse } else { !$ci } +# Set to true to build with MSBuild's multi-threaded mode (-mt). Opt-in for now, so off unless it was +# explicitly requested. It's intended to become the default for local builds once it has proven out. +[bool]$msbuildMultiThreaded = if (Test-Path variable:msbuildMultiThreaded) { $msbuildMultiThreaded } else { $false } + # Configures warning treatment in msbuild. [bool]$warnAsError = if (Test-Path variable:warnAsError) { $warnAsError } else { $true } # Specifies semi-colon delimited list of warning codes that should not be treated as errors. -[string]$warnNotAsError = if (Test-Path variable:warnNotAsError) { $warnNotAsError } else { '' } +# Defaults to NuGet Audit warning codes NU1901-NU1904. +[string]$warnNotAsError = if ((Test-Path variable:warnNotAsError) -and $warnNotAsError) { $warnNotAsError } else { 'NU1901;NU1902;NU1903;NU1904' } # Specifies which msbuild engine to use for build: 'vs', 'dotnet' or unspecified (determined based on presence of tools.vs in global.json). [string]$msbuildEngine = if (Test-Path variable:msbuildEngine) { $msbuildEngine } else { $null } @@ -808,8 +813,8 @@ function MSBuild() { $cmdArgs = "$($buildTool.Command) /m /nologo /clp:Summary /v:$verbosity /nr:$nodeReuse /p:ContinuousIntegrationBuild=$ci" - # Add -mt flag for MSBuild multithreaded mode if enabled via environment variable - if ($env:MSBUILD_MT_ENABLED -eq "1") { + # Build with MSBuild's multi-threaded mode. + if ($msbuildMultiThreaded) { $cmdArgs += ' -mt' } diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 20f791c11d..4d14b100b0 100644 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -1,5 +1,15 @@ #!/usr/bin/env bash +# Normalizes the value of a boolean build argument. Accepts 1/0 in addition to true/false so that +# the same value works with the PowerShell scripts, whose [bool] parameters only bind 1/0. +function NormalizeBoolArg { + case "${1:-}" in + 1) echo true ;; + 0) echo false ;; + *) echo "${1:-}" ;; + esac +} + # Initialize variables if they aren't already defined. # CI mode - set to true on CI server for PR validation build or official build. @@ -43,17 +53,25 @@ restore=${restore:-true} verbosity=${verbosity:-'minimal'} # Set to true to reuse msbuild nodes. Recommended to not reuse on CI. +node_reuse=$(NormalizeBoolArg "${node_reuse:-}") if [[ "$ci" == true ]]; then node_reuse=${node_reuse:-false} else node_reuse=${node_reuse:-true} fi +# Set to true to build with MSBuild's multi-threaded mode (-mt). Opt-in for now, so off unless it was +# explicitly requested. It's intended to become the default for local builds once it has proven out. +msbuild_multi_threaded=$(NormalizeBoolArg "${msbuild_multi_threaded:-}") +msbuild_multi_threaded=${msbuild_multi_threaded:-false} + # Configures warning treatment in msbuild. +warn_as_error=$(NormalizeBoolArg "${warn_as_error:-}") warn_as_error=${warn_as_error:-true} # Specifies semi-colon delimited list of warning codes that should not be treated as errors. -warn_not_as_error=${warn_not_as_error:-''} +# Defaults to NuGet Audit warning codes NU1901-NU1904. +warn_not_as_error="${warn_not_as_error:-NU1901;NU1902;NU1903;NU1904}" # True to attempt using .NET Core already that meets requirements specified in global.json # installed on the machine instead of downloading one. @@ -587,9 +605,9 @@ function MSBuild { } } - # Add -mt flag for MSBuild multithreaded mode if enabled via environment variable + # Build with MSBuild's multi-threaded mode. local mt_switch="" - if [[ "${MSBUILD_MT_ENABLED:-}" == "1" ]]; then + if [[ "$msbuild_multi_threaded" == true ]]; then mt_switch="-mt" fi diff --git a/global.json b/global.json index da9d2e2709..69b61b8fc3 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "11.0.100-preview.6.26359.118" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26407.8" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26414.2" } }