From 5da80ed31c0dadf84161989e5647acfd91f83df3 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 3 Aug 2026 05:02:38 +0000 Subject: [PATCH 1/3] Backflow from https://github.com/dotnet/dotnet / 5da2de2 build 325270 Diff: https://github.com/dotnet/dotnet/compare/92df1c70330ca09d71d9200de13ce2eda4bd2a53..5da2de22f7c6e2ebe7ed4c16c614b00183145d3c From: https://github.com/dotnet/dotnet/commit/92df1c70330ca09d71d9200de13ce2eda4bd2a53 To: https://github.com/dotnet/dotnet/commit/5da2de22f7c6e2ebe7ed4c16c614b00183145d3c [[ commit created by automation ]] --- eng/Versions.props | 4 ++-- src/Directory.Build.props | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/eng/Versions.props b/eng/Versions.props index 7c3c5bd912..520c87373e 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -4,8 +4,8 @@ 3.0.0 - preview - 7 + rc + 1 diff --git a/src/Directory.Build.props b/src/Directory.Build.props index 5bd6594024..69d588cb55 100644 --- a/src/Directory.Build.props +++ b/src/Directory.Build.props @@ -10,9 +10,6 @@ true - - - $(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904 From ac69fd4791eef69890e463c5cb6c9dfa39604455 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 3 Aug 2026 05:02:39 +0000 Subject: [PATCH 2/3] Update dependencies from build 325270 Updated Dependencies: Microsoft.DotNet.Arcade.Sdk (Version 11.0.0-beta.26365.101 -> 11.0.0-beta.26401.101) [[ commit created by automation ]] --- eng/Version.Details.props | 2 +- eng/Version.Details.xml | 6 +- eng/common/build.ps1 | 2 + eng/common/build.sh | 11 ++++ .../core-templates/job/helix-job-monitor.yml | 30 +++++++-- eng/common/core-templates/job/onelocbuild.yml | 20 +++++- .../core-templates/steps/publish-logs.yml | 1 - eng/common/cross/build-rootfs.sh | 43 ++++++++----- eng/common/cross/toolchain.cmake | 2 + eng/common/native/init-os-and-arch.sh | 6 +- eng/common/sdk-task.ps1 | 17 ++++- eng/common/sdk-task.sh | 22 +++++-- eng/common/tools.ps1 | 50 +++++++++++++-- eng/common/tools.sh | 62 +++++++++++++++++-- global.json | 6 +- 15 files changed, 229 insertions(+), 51 deletions(-) diff --git a/eng/Version.Details.props b/eng/Version.Details.props index f407c7480d..f10550bc8f 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -6,7 +6,7 @@ This file should be imported by eng/Versions.props - 11.0.0-beta.26365.101 + 11.0.0-beta.26401.101 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 097ff86aad..33b0e808ff 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,12 +1,12 @@ - + - + https://github.com/dotnet/dotnet - cb8306a63c5cf24e9381108a3a9eb58907fd0f60 + 5da2de22f7c6e2ebe7ed4c16c614b00183145d3c diff --git a/eng/common/build.ps1 b/eng/common/build.ps1 index 2cbb725323..dd84699f50 100644 --- a/eng/common/build.ps1 +++ b/eng/common/build.ps1 @@ -23,6 +23,7 @@ Param( [switch] $clean, [switch][Alias('pb')]$productBuild, [switch]$fromVMR, + [switch]$disablePipelineSetResult, [switch][Alias('bl')]$binaryLog, [string][Alias('bln')]$binaryLogName = '', [switch][Alias('nobl')]$excludeCIBinarylog, @@ -80,6 +81,7 @@ function Print-Usage() { Write-Host " -nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" Write-Host " -buildCheck Sets /check msbuild parameter" Write-Host " -fromVMR Set when building from within the VMR" + Write-Host " -disablePipelineSetResult Set to disable masking the actual exit code in the pipeline when the build fails" Write-Host "" Write-Host "Command line arguments not listed above are passed thru to msbuild." diff --git a/eng/common/build.sh b/eng/common/build.sh index 3a9fdcfd0f..e37edd6cff 100755 --- a/eng/common/build.sh +++ b/eng/common/build.sh @@ -40,12 +40,14 @@ usage() echo " --projects Project or solution file(s) to build" echo " --ci Set when running on CI server" echo " --excludeCIBinarylog Don't output binary log (short: -nobl)" + echo " --pipelinesLog Promote msbuild errors/warnings to Azure Pipelines timeline issues; defaults to on in CI (short: -pl)" echo " --prepareMachine Prepare machine for CI run, clean up processes after build" echo " --nodeReuse Sets nodereuse msbuild parameter ('true' or 'false')" echo " --warnAsError Sets warnaserror msbuild parameter ('true' or 'false')" echo " --warnNotAsError Sets a semi-colon delimited list of warning codes that should not be treated as errors" echo " --buildCheck Sets /check msbuild parameter" echo " --fromVMR Set when building from within the VMR" + echo " --disablePipelineSetResult Set to disable masking the actual exit code in the pipeline when the build fails" echo "" echo "Command line arguments not listed above are passed thru to msbuild." echo "Arguments can also be passed in with a single hyphen." @@ -68,6 +70,7 @@ build=false source_build=false product_build=false from_vmr=false +disable_pipeline_set_result=false rebuild=false test=false integration_test=false @@ -86,6 +89,7 @@ build_check=false binary_log=false binary_log_name='' exclude_ci_binary_log=false +pipelines_log=false projects='' configuration='' @@ -124,6 +128,9 @@ while [[ $# -gt 0 ]]; do -excludecibinarylog|-nobl) exclude_ci_binary_log=true ;; + -pipelineslog|-pl) + pipelines_log=true + ;; -restore|-r) restore=true ;; @@ -152,6 +159,9 @@ while [[ $# -gt 0 ]]; do -fromvmr|-from-vmr) from_vmr=true ;; + -disablepipelinesetresult|-disable-pipeline-set-result) + disable_pipeline_set_result=true + ;; -test|-t) test=true ;; @@ -213,6 +223,7 @@ if [[ -z "$configuration" ]]; then fi if [[ "$ci" == true ]]; then + pipelines_log=true # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED. # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on. if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 96287e55a1..62fa199711 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -65,6 +65,14 @@ parameters: type: boolean default: true +# When true, test results are reported to Azure DevOps using the fully qualified test name +# (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as +# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display; +# primarily useful for frameworks like MSTest whose display name is only the method name. +- name: useFullyQualifiedTestName + type: boolean + default: false + # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is @@ -96,9 +104,11 @@ jobs: pool: ${{ if eq(variables['System.TeamProject'], 'public') }}: name: $(DncEngPublicBuildPool) + os: linux demands: ImageOverride -equals build.azurelinux.3.amd64.open ${{ else }}: name: $(DncEngInternalBuildPool) + os: linux demands: ImageOverride -equals build.azurelinux.3.amd64 steps: - checkout: self @@ -176,11 +186,13 @@ jobs: set -euo pipefail toolArgs=( - --helix-base-uri '${{ parameters.helixBaseUri }}' - --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' - --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' - --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. - --stage-name '$(System.StageName)' + --helix-base-uri '${{ parameters.helixBaseUri }}' + --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' + --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' + --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}' + --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. + --stage-name '$(System.StageName)' + --stage-attempt '$(System.StageAttempt)' ) organization='${{ parameters.organization }}' @@ -188,12 +200,18 @@ jobs: # Fall back to Azure DevOps-provided environment variables when the caller did not # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically - # 'owner/repo' for GitHub-backed builds. + # 'owner/repo' for GitHub-backed builds and 'owner-repo' for internal builds. if [ -z "$organization" ] || [ -z "$repository" ]; then buildRepoName="${BUILD_REPOSITORY_NAME:-}" if [ -n "$buildRepoName" ] && [[ "$buildRepoName" == */* ]]; then repoOwner="${buildRepoName%%/*}" repoName="${buildRepoName#*/}" + elif [ -n "$buildRepoName" ] && [[ "$buildRepoName" == *-* ]]; then + repoOwner="${buildRepoName%%-*}" + repoName="${buildRepoName#*-}" + fi + + if [ -n "${repoOwner:-}" ] && [ -n "${repoName:-}" ]; then if [ -z "$organization" ]; then organization="$repoOwner"; fi if [ -z "$repository" ]; then repository="$repoName"; fi fi diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 86ea9f6350..2816d2905a 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -8,6 +8,12 @@ parameters: CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex GithubPat: $(BotAccount-dotnet-bot-repo-PAT) + # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). + # When set, dnceng/internal builds acquire a federated Entra token instead of using a PAT. + # All other projects (e.g. DevDiv, public), where this dnceng-scoped service connection does not + # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. + CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -74,6 +80,15 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} + # Acquire an Entra token for ceapex feed access via WIF (dnceng/internal only). + # All other projects use PAT-based auth, since the ceapex service connection is scoped to dnceng/internal. + - ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/templates/steps/get-federated-access-token.yml + parameters: + federatedServiceConnection: ${{ parameters.CeapexServiceConnection }} + outputVariableName: 'CeapexEntraToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -89,7 +104,10 @@ jobs: isUseLfLineEndingsSelected: ${{ parameters.UseLfLineEndings }} isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - patVariable: ${{ parameters.CeapexPat }} + ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + patVariable: $(CeapexEntraToken) + ${{ if or(eq(parameters.CeapexServiceConnection, ''), ne(variables['System.TeamProject'], 'internal')) }}: + patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} gitHubPatVariable: "${{ parameters.GithubPat }}" diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml index 2731e48cce..c496f3d0dc 100644 --- a/eng/common/core-templates/steps/publish-logs.yml +++ b/eng/common/core-templates/steps/publish-logs.yml @@ -31,7 +31,6 @@ steps: -runtimeSourceFeed https://ci.dot.net/internal -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' '$(publishing-dnceng-devdiv-code-r-build-re)' - '$(dn-bot-all-orgs-artifact-feeds-rw)' '$(akams-client-id)' '$(System.AccessToken)' ${{parameters.CustomSensitiveDataList}} diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh index 453bb1ba5b..f58abbd2d1 100755 --- a/eng/common/cross/build-rootfs.sh +++ b/eng/common/cross/build-rootfs.sh @@ -8,8 +8,8 @@ usage() echo "BuildArch can be: arm(default), arm64, loongarch64, ppc64le, riscv64, s390x, x64, x86" echo "CodeName - optional, Code name for Linux, can be: xenial(default), zesty, bionic, alpine" echo " for alpine can be specified with version: alpineX.YY or alpineedge" - echo " for FreeBSD can be: freebsd13, freebsd14" - echo " for OpenBSD can be: openbsd" + echo " for FreeBSD can be: freebsd14, freebsd15" + echo " for OpenBSD can be: openbsd7.8, openbsd7.9" echo " for illumos can be: illumos" echo " for Haiku can be: haiku." echo "lldbx.y - optional, LLDB version, can be: lldb3.9(default), lldb4.0, lldb5.0, lldb6.0 no-lldb. Ignored for alpine and FreeBSD" @@ -78,9 +78,9 @@ __AlpinePackages+=" krb5-dev" __AlpinePackages+=" openssl-dev" __AlpinePackages+=" zlib-dev" -__FreeBSDBase="13.5-RELEASE" -__FreeBSDPkg="2.7.5" -__FreeBSDABI="13" +__FreeBSDBase="14.4-RELEASE" +__FreeBSDPkg="2.8.0" +__FreeBSDABI="14" __FreeBSDPackages="libunwind" __FreeBSDPackages+=" icu" __FreeBSDPackages+=" libinotify" @@ -187,17 +187,14 @@ while :; do __AlpineArch=loongarch64 __QEMUArch=loongarch64 __UbuntuArch=loong64 - __UbuntuSuites=unreleased __LLDB_Package="liblldb-19-dev" ;; riscv64) __BuildArch=riscv64 __AlpineArch=riscv64 - __AlpinePackages="${__AlpinePackages// lldb-dev/}" __QEMUArch=riscv64 __UbuntuArch=riscv64 - __UbuntuPackages="${__UbuntuPackages// libunwind8-dev/}" - unset __LLDB_Package + __LLDB_Package="liblldb-19-dev" ;; ppc64le) __BuildArch=ppc64le @@ -291,6 +288,10 @@ while :; do __CodeName=noble __LLDB_Package="liblldb-19-dev" ;; + resolute) # Ubuntu 26.04 + __CodeName=resolute + __LLDB_Package="liblldb-21-dev" + ;; stretch) # Debian 9 __CodeName=stretch __LLDB_Package="liblldb-6.0-dev" @@ -331,7 +332,7 @@ while :; do # Debian-Ports architectures need different values case "$__UbuntuArch" in - amd64|arm64|armhf|i386|mips64el|ppc64el|riscv64|s390x) + amd64|arm64|armhf|i386|mips64el|ppc64el|riscv64|loong64|s390x) __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg" if [[ -z "$__UbuntuRepo" ]]; then @@ -365,20 +366,29 @@ while :; do __AlpineVersion="$__AlpineMajorVersion.$__AlpineMinorVersion" fi ;; - freebsd13) + freebsd14) __CodeName=freebsd __SkipUnmount=1 ;; - freebsd14) + freebsd15) __CodeName=freebsd - __FreeBSDBase="14.3-RELEASE" - __FreeBSDABI="14" + __FreeBSDBase="15.1-RELEASE" + __FreeBSDABI="15" __SkipUnmount=1 ;; openbsd) __CodeName=openbsd __SkipUnmount=1 ;; + openbsd7.8) + __CodeName=openbsd + __SkipUnmount=1 + ;; + openbsd7.9) + __CodeName=openbsd + __OpenBSDVersion="7.9" + __SkipUnmount=1 + ;; illumos) __CodeName=illumos __SkipUnmount=1 @@ -453,9 +463,12 @@ case "$__AlpineVersion" in elif [[ "$__AlpineArch" == "x86" ]]; then __AlpineVersion=3.17 # minimum version that supports lldb-dev __AlpinePackages+=" llvm15-libs" - elif [[ "$__AlpineArch" == "riscv64" || "$__AlpineArch" == "loongarch64" ]]; then + elif [[ "$__AlpineArch" == "loongarch64" ]]; then __AlpineVersion=3.21 # minimum version that supports lldb-dev __AlpinePackages+=" llvm19-libs" + elif [[ "$__AlpineArch" == "riscv64" ]]; then + __AlpineVersion=3.22 # lldb-dev requires 3.21+, but 3.22+ provides the newer linux-headers needed for RISC-V extension probes + __AlpinePackages+=" llvm20-libs" elif [[ -n "$__AlpineMajorVersion" ]]; then # use whichever alpine version is provided and select the latest toolchain libs __AlpineLlvmLibsLookup=1 diff --git a/eng/common/cross/toolchain.cmake b/eng/common/cross/toolchain.cmake index ead7fe3ef2..70b71395e3 100644 --- a/eng/common/cross/toolchain.cmake +++ b/eng/common/cross/toolchain.cmake @@ -87,6 +87,8 @@ elseif(TARGET_ARCH_NAME STREQUAL "ppc64le") set(CMAKE_SYSTEM_PROCESSOR ppc64le) if(EXISTS ${CROSS_ROOTFS}/usr/lib/gcc/powerpc64le-alpine-linux-musl) set(TOOLCHAIN "powerpc64le-alpine-linux-musl") + elseif(FREEBSD) + set(TOOLCHAIN "powerpc64le-unknown-freebsd14") else() set(TOOLCHAIN "powerpc64le-linux-gnu") endif() diff --git a/eng/common/native/init-os-and-arch.sh b/eng/common/native/init-os-and-arch.sh index 38921d4338..62d62fed52 100644 --- a/eng/common/native/init-os-and-arch.sh +++ b/eng/common/native/init-os-and-arch.sh @@ -27,6 +27,10 @@ if [ "$os" = "sunos" ]; then os="solaris" fi CPUName=$(isainfo -n) +elif [ "$os" = "freebsd" ]; then + # FreeBSD's `uname -m` is the machine class ("powerpc" for every PowerPC + # variant); `uname -p` gives the specific processor (e.g. powerpc64le). + CPUName=$(uname -p) else # For the rest of the operating systems, use uname(1) to determine what the CPU is. CPUName=$(uname -m) @@ -75,7 +79,7 @@ case "$CPUName" in arch=s390x ;; - ppc64le) + ppc64le|powerpc64le) arch=ppc64le ;; *) diff --git a/eng/common/sdk-task.ps1 b/eng/common/sdk-task.ps1 index 68119de603..8d72d803dd 100644 --- a/eng/common/sdk-task.ps1 +++ b/eng/common/sdk-task.ps1 @@ -4,7 +4,9 @@ Param( [string] $task, [string] $verbosity = 'minimal', [string] $msbuildEngine = $null, - [switch] $restore, + # Restore defaults to on; -restore is retained only so existing consumers that pass it don't break. Use -norestore to opt out. + [switch] $restore = $true, + [switch] $norestore, [switch] $prepareMachine, [switch][Alias('nobl')]$excludeCIBinaryLog, [switch]$noWarnAsError, @@ -18,12 +20,23 @@ $ci = $true $binaryLog = if ($excludeCIBinaryLog) { $false } else { $true } $warnAsError = if ($noWarnAsError) { $false } else { $true } +# Reconcile the restore state before importing tools.ps1: it reads $restore at import time to +# decide whether toolset/SDK acquisition installs. -norestore must win so that skipping restore +# also skips toolset initialization, not just the explicit Restore build below. +if ($norestore) { $restore = $false } + +# sdk-task runs a standalone Arcade SDK task and does not need repo-specific toolset setup. +# Skip importing configure-toolset.ps1 so its side effects (e.g. a repo's configure-toolset.ps1 +# calling exit) don't terminate this script before the task runs. +$disableConfigureToolsetImport = $true + . $PSScriptRoot\tools.ps1 function Print-Usage() { Write-Host "Common settings:" Write-Host " -task Name of Arcade task (name of a project in toolset directory of the Arcade SDK package)" - Write-Host " -restore Restore dependencies" + Write-Host " -restore (Legacy) Restore runs by default; retained for backward compatibility. Use -norestore to skip" + Write-Host " -norestore Skip restoring dependencies" Write-Host " -verbosity Msbuild verbosity: q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]" Write-Host " -help Print help and exit" Write-Host "" diff --git a/eng/common/sdk-task.sh b/eng/common/sdk-task.sh index 1cf71bb2ae..a7f1ba060d 100755 --- a/eng/common/sdk-task.sh +++ b/eng/common/sdk-task.sh @@ -3,7 +3,8 @@ show_usage() { echo "Common settings:" echo " --task Name of Arcade task (name of a project in toolset directory of the Arcade SDK package)" - echo " --restore Restore dependencies" + echo " --restore (Legacy) Restore runs by default; retained for backward compatibility. Use --norestore to skip" + echo " --norestore Skip restoring dependencies" echo " --verbosity Msbuild verbosity: q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]" echo " --help Print help and exit" echo "" @@ -50,10 +51,11 @@ binary_log=true configuration="Debug" verbosity="minimal" exclude_ci_binary_log=false -restore=false +# restore defaults to on; --restore is retained only so existing consumers that pass it don't break. Use --norestore to opt out. +restore=true help=false properties='' -warnAsError=true +warn_as_error=true while (($# > 0)); do lowerI="$(echo $1 | tr "[:upper:]" "[:lower:]")" @@ -63,7 +65,10 @@ while (($# > 0)); do shift 2 ;; --restore) - restore=true + shift 1 + ;; + --norestore) + restore=false shift 1 ;; --verbosity) @@ -75,8 +80,8 @@ while (($# > 0)); do exclude_ci_binary_log=true shift 1 ;; - --noWarnAsError) - warnAsError=false + --nowarnaserror) + warn_as_error=false shift 1 ;; --help) @@ -97,6 +102,11 @@ if $help; then exit 0 fi +# sdk-task runs a standalone Arcade SDK task and does not need repo-specific toolset setup. +# Skip importing configure-toolset.sh so its side effects (e.g. a repo's configure-toolset.sh +# calling exit) don't terminate this script before the task runs. +disable_configure_toolset_import=1 + . "$scriptroot/tools.sh" InitializeToolset diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1 index 6f664ad890..da07386ff1 100644 --- a/eng/common/tools.ps1 +++ b/eng/common/tools.ps1 @@ -13,6 +13,12 @@ # Set to true to output binary log from msbuild. Note that emitting binary log slows down the build. [bool]$binaryLog = if (Test-Path variable:binaryLog) { $binaryLog } else { $ci -and !$excludeCIBinarylog } +# Set to true to use the pipelines logger which will enable Azure logging output. +# https://github.com/Microsoft/azure-pipelines-tasks/blob/master/docs/authoring/commands.md +# This flag is meant as a temporary opt-in for the feature while validating it across +# our consumers. It will be deleted in the future. +[bool]$pipelinesLog = if (Test-Path variable:pipelinesLog) { $pipelinesLog } else { $ci } + # Turns on machine preparation/clean up code that changes the machine state (e.g. kills build processes). [bool]$prepareMachine = if (Test-Path variable:prepareMachine) { $prepareMachine } else { $false } @@ -65,6 +71,8 @@ $ErrorActionPreference = 'Stop' # True when the build is running within the VMR. [bool]$fromVMR = if (Test-Path variable:fromVMR) { $fromVMR } else { $false } +[bool]$disablePipelineSetResult = if (Test-Path variable:disablePipelineSetResult) { $disablePipelineSetResult } else { $false } + function Create-Directory ([string[]] $path) { New-Item -Path $path -Force -ItemType 'Directory' | Out-Null } @@ -713,7 +721,17 @@ function InitializeToolset() { $downloadArgs += "--configfile" $downloadArgs += $nugetConfig } - DotNet @downloadArgs + + # 'dotnet package download' fails outright if any source in the repo's NuGet.config is + # unavailable (for example a transport feed that was decommissioned after a release). The + # Arcade SDK is always published to the public dotnet-eng feed, so if the config-driven + # download fails, retry once against that feed directly (which ignores the other sources) + # before giving up, so a single dead source doesn't block the build. + $downloadExitCode = DotNet -ignoreFailure @downloadArgs + if ($downloadExitCode) { + Write-Host "Restoring the Arcade SDK from the configured sources failed; retrying from the public dotnet-eng feed." + DotNet @downloadArgs --source "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" + } $packageDir = Join-Path $nugetPackageCachePath (Join-Path 'microsoft.dotnet.arcade.sdk' $toolsetVersion) $packageToolsetDir = Join-Path $packageDir 'toolset' @@ -775,6 +793,19 @@ function MSBuild() { $buildTool = InitializeBuildTool + if ($pipelinesLog) { + $toolsetBuildProject = InitializeToolset + $basePath = Split-Path -parent $toolsetBuildProject + $selectedPath = Join-Path $basePath (Join-Path 'net' 'Microsoft.DotNet.ArcadeLogging.dll') + + # Only inject the logger when it's present. A last-known-good Arcade used to bootstrap + # the build may not ship the logger yet, so its absence must not be a hard error. + # Specify the logger type explicitly so loading is deterministic. + if (Test-Path $selectedPath) { + $args += "/logger:Microsoft.DotNet.ArcadeLogging.PipelinesLogger,$selectedPath" + } + } + $cmdArgs = "$($buildTool.Command) /m /nologo /clp:Summary /v:$verbosity /nr:$nodeReuse /p:ContinuousIntegrationBuild=$ci" # Add -mt flag for MSBuild multithreaded mode if enabled via environment variable @@ -790,7 +821,8 @@ function MSBuild() { } if ($warnAsError -and $warnNotAsError) { - $cmdArgs += " /warnnotaserror:$warnNotAsError /p:AdditionalWarningsNotAsErrors=$warnNotAsError" + $escapedWarnNotAsError = $warnNotAsError -replace ';', '%3B' + $cmdArgs += " /warnnotaserror:$warnNotAsError /p:AdditionalWarningsNotAsErrors=$escapedWarnNotAsError" } foreach ($arg in $args) { @@ -813,8 +845,8 @@ function MSBuild() { Write-Host "Build failed with exit code $exitCode. Check errors above." -ForegroundColor Red # When running on Azure Pipelines, override the returned exit code to avoid double logging. - # Skip this when the build is a child of the VMR build. - if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) { + # Skip this when the build is a child of the VMR build, or when -disablePipelineSetResult is set so the real exit code propagates. + if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR -and !$disablePipelineSetResult) { Write-PipelineSetResult -Result "Failed" -Message "msbuild execution failed." # Exiting with an exit code causes the azure pipelines task to log yet another "noise" error # The above Write-PipelineSetResult will cause the task to be marked as failure without adding yet another error @@ -829,7 +861,7 @@ function MSBuild() { # Executes a dotnet command with arguments passed to the function. # Terminates the script if the command fails. # -function DotNet() { +function DotNet([switch]$ignoreFailure) { $dotnetRoot = InitializeDotNetCli -install:$restore $dotnetPath = Join-Path $dotnetRoot (GetExecutableFileName 'dotnet') @@ -848,9 +880,15 @@ function DotNet() { $exitCode = Exec-Process $dotnetPath $cmdArgs if ($exitCode -ne 0) { + # When -ignoreFailure is set, return the exit code to the caller so it can implement + # its own fallback logic instead of terminating the script. + if ($ignoreFailure) { + return $exitCode + } + Write-Host "dotnet command failed with exit code $exitCode. Check errors above." -ForegroundColor Red - if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) { + if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR -and !$disablePipelineSetResult) { Write-PipelineSetResult -Result "Failed" -Message "dotnet command execution failed." ExitWithExitCode 0 } else { diff --git a/eng/common/tools.sh b/eng/common/tools.sh index 347a29b888..20f791c11d 100755 --- a/eng/common/tools.sh +++ b/eng/common/tools.sh @@ -8,6 +8,16 @@ ci=${ci:-false} # Build mode source_build=${source_build:-false} +# Set to true to use the pipelines logger which will enable Azure logging output. +# https://github.com/Microsoft/azure-pipelines-tasks/blob/master/docs/authoring/commands.md +# This flag is meant as a temporary opt-in for the feature while validating it across +# our consumers. It will be deleted in the future. +if [[ "$ci" == true ]]; then + pipelines_log=${pipelines_log:-true} +else + pipelines_log=${pipelines_log:-false} +fi + # Build configuration. Common values include 'Debug' and 'Release', but the repository may use other names. configuration=${configuration:-'Debug'} @@ -68,6 +78,8 @@ runtime_source_feed_key=${runtime_source_feed_key:-''} # True when the build is running within the VMR. from_vmr=${from_vmr:-false} +disable_pipeline_set_result=${disable_pipeline_set_result:-false} + # Resolve any symlinks in the given path. function ResolvePath { local path=$1 @@ -442,7 +454,16 @@ function InitializeToolset { if [[ -n "$nuget_config" ]]; then download_args+=("--configfile" "$nuget_config") fi - DotNet "${download_args[@]}" + + # 'dotnet package download' fails outright if any source in the repo's NuGet.config is + # unavailable (for example a transport feed that was decommissioned after a release). The + # Arcade SDK is always published to the public dotnet-eng feed, so if the config-driven + # download fails, retry once against that feed directly (which ignores the other sources) + # before giving up, so a single dead source doesn't block the build. + if ! DotNet true "${download_args[@]}"; then + echo "Restoring the Arcade SDK from the configured sources failed; retrying from the public dotnet-eng feed." + DotNet "${download_args[@]}" --source "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" + fi local package_dir="$_InitializeNuGetPackageCachePath/microsoft.dotnet.arcade.sdk/$toolset_version" @@ -481,6 +502,15 @@ function StopProcesses { } function DotNet { + # When the first argument is 'true' or 'false' it controls the exit behavior on failure: + # 'true' returns the dotnet exit code to the caller (so it can implement its own fallback), + # while the default terminates the script. Any other first argument is treated as a dotnet argument. + local ignore_failure=false + if [[ "$1" == 'true' || "$1" == 'false' ]]; then + ignore_failure="$1" + shift + fi + InitializeDotNetCli $restore local dotnet_path="$_InitializeDotNetCli/dotnet" @@ -489,9 +519,14 @@ function DotNet { "$dotnet_path" "$@" || { local exit_code=$? + + if [[ "$ignore_failure" == true ]]; then + return $exit_code + fi + echo "dotnet command failed with exit code $exit_code. Check errors above." - if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true ]]; then + if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true && "$disable_pipeline_set_result" != true ]]; then Write-PipelineSetResult -result "Failed" -message "dotnet command execution failed." ExitWithExitCode 0 else @@ -510,6 +545,21 @@ function MSBuild { InitializeBuildTool + local logger_switch=() + if [[ "$pipelines_log" == true ]]; then + InitializeToolset + + local toolset_dir="${_InitializeToolset%/*}" + local selectedPath="$toolset_dir/net/Microsoft.DotNet.ArcadeLogging.dll" + + # Only inject the logger when it's present. A last-known-good Arcade used to bootstrap + # the build may not ship the logger yet, so its absence must not be a hard error. + # Specify the logger type explicitly so loading is deterministic. + if [[ -f "$selectedPath" ]]; then + logger_switch=("-logger:Microsoft.DotNet.ArcadeLogging.PipelinesLogger,$selectedPath") + fi + fi + local warnaserror_switch="" if [[ $warn_as_error == true ]]; then warnaserror_switch="/warnaserror" @@ -525,8 +575,8 @@ function MSBuild { echo "Build failed with exit code $exit_code. Check errors above." # When running on Azure Pipelines, override the returned exit code to avoid double logging. - # Skip this when the build is a child of the VMR build. - if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true ]]; then + # Skip this when the build is a child of the VMR build, or when -disablePipelineSetResult is set so the real exit code propagates. + if [[ "$ci" == true && -n ${SYSTEM_TEAMPROJECT:-} && "$from_vmr" != true && "$disable_pipeline_set_result" != true ]]; then Write-PipelineSetResult -result "Failed" -message "msbuild execution failed." # Exiting with an exit code causes the azure pipelines task to log yet another "noise" error # The above Write-PipelineSetResult will cause the task to be marked as failure without adding yet another error @@ -545,10 +595,10 @@ function MSBuild { local warnnotaserror_switch="" if [[ -n "$warn_not_as_error" && "$warn_as_error" == true ]]; then - warnnotaserror_switch="/warnnotaserror:$warn_not_as_error /p:AdditionalWarningsNotAsErrors=$warn_not_as_error" + warnnotaserror_switch="/warnnotaserror:$warn_not_as_error /p:AdditionalWarningsNotAsErrors=${warn_not_as_error//;/%3B}" fi - RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" + RunBuildTool "$_InitializeBuildToolCommand" /m /nologo /clp:Summary /v:$verbosity /nr:$node_reuse $warnaserror_switch $mt_switch $warnnotaserror_switch ${logger_switch[@]+"${logger_switch[@]}"} /p:TreatWarningsAsErrors=$warn_as_error /p:ContinuousIntegrationBuild=$ci "$@" } function GetDarc { diff --git a/global.json b/global.json index 8c99a74258..1bea4ced09 100644 --- a/global.json +++ b/global.json @@ -1,6 +1,6 @@ { "sdk": { - "version": "11.0.100-preview.5.26302.115", + "version": "11.0.100-preview.6.26359.118", "allowPrerelease": true, "rollForward": "latestFeature", "paths": [ @@ -10,9 +10,9 @@ "errorMessage": "The required .NET SDK wasn't found. Please run ./eng/common/dotnet.cmd/sh to install it." }, "tools": { - "dotnet": "11.0.100-preview.5.26302.115" + "dotnet": "11.0.100-preview.6.26359.118" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26365.101" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26401.101" } } From 5eb5c73008e7fdd7176b21e851d178f9bb0faf89 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" Date: Mon, 10 Aug 2026 05:02:26 +0000 Subject: [PATCH 3/3] Update dependencies from build 326361 Updated Dependencies: Microsoft.DotNet.Arcade.Sdk (Version 11.0.0-beta.26401.101 -> 11.0.0-beta.26409.102) [[ commit created by automation ]] --- eng/Version.Details.props | 2 +- eng/Version.Details.xml | 6 +- eng/common/Get-GitHubAppToken.ps1 | 154 ++++++++++++++++++ .../core-templates/job/helix-job-monitor.yml | 13 ++ eng/common/core-templates/job/onelocbuild.yml | 28 +++- .../job/publish-build-assets.yml | 2 - .../post-build/common-variables.yml | 2 - eng/common/core-templates/stages/renovate.yml | 2 + .../steps/get-github-app-token.yml | 79 +++++++++ .../core-templates/steps/publish-logs.yml | 3 - .../steps/get-github-app-token.yml | 7 + .../templates/steps/get-github-app-token.yml | 7 + global.json | 2 +- 13 files changed, 294 insertions(+), 13 deletions(-) create mode 100644 eng/common/Get-GitHubAppToken.ps1 create mode 100644 eng/common/core-templates/steps/get-github-app-token.yml create mode 100644 eng/common/templates-official/steps/get-github-app-token.yml create mode 100644 eng/common/templates/steps/get-github-app-token.yml diff --git a/eng/Version.Details.props b/eng/Version.Details.props index f10550bc8f..975102560f 100644 --- a/eng/Version.Details.props +++ b/eng/Version.Details.props @@ -6,7 +6,7 @@ This file should be imported by eng/Versions.props - 11.0.0-beta.26401.101 + 11.0.0-beta.26409.102 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 33b0e808ff..df98dadfa1 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,12 +1,12 @@ - + - + https://github.com/dotnet/dotnet - 5da2de22f7c6e2ebe7ed4c16c614b00183145d3c + 7fb8cef14d9ae6bd729b04638f88d00f1ba7eb99 diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1 new file mode 100644 index 0000000000..6b5899d7a2 --- /dev/null +++ b/eng/common/Get-GitHubAppToken.ps1 @@ -0,0 +1,154 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The signed JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements: +# - A GitHub App whose private key has been uploaded into Key Vault as an RSA +# key (the PEM converted to a Key Vault *key*, NOT stored as a secret). +# - The caller (the federated Azure service connection used to run this script) +# must have the `Key Vault Crypto User` role (or at minimum the `Sign` +# action) on that key. +# - The App must be installed on the target organization/account +# (`InstallationOwner`) with the permissions/repositories it needs. +# +# Installation tokens (ghs_*) are exempt from the enterprise classic-PAT +# lifetime policy, which is why this replaces the long-lived PAT. + +[CmdletBinding()] +param( + # Name of the Key Vault that holds the GitHub App's RSA signing key. + [Parameter(Mandatory = $true)] + [string] $KeyVaultName, + + # Name of the RSA key inside the Key Vault (the App's private key). + [Parameter(Mandatory = $true)] + [string] $KeyName, + + # The GitHub App's Client ID (the value to put in the `iss` JWT claim). + [Parameter(Mandatory = $true)] + [string] $AppClientId, + + # Login of the organization or user account whose installation we should + # mint the token for (e.g. `dotnet`, `microsoft`). + [Parameter(Mandatory = $true)] + [string] $InstallationOwner, + + # Optional Azure DevOps pipeline variable name to set with the installation + # token (marked as a secret). When not specified, the token is written to + # stdout instead. + [Parameter(Mandatory = $false)] + [string] $OutputVariableName +) + +$ErrorActionPreference = 'Stop' +$PSNativeCommandUseErrorActionPreference = $true + +. $PSScriptRoot\pipeline-logging-functions.ps1 + +function ConvertTo-Base64Url([byte[]] $bytes) { + return [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_') +} + +# Build JWT header and payload. Use [ordered] hashtables so JSON +# serialization is deterministic. +$jwtHeader = [ordered]@{ + alg = 'RS256' + typ = 'JWT' +} +$now = [System.DateTimeOffset]::UtcNow +$jwtPayload = [ordered]@{ + iat = $now.AddMinutes(-1).ToUnixTimeSeconds() + exp = $now.AddMinutes(5).ToUnixTimeSeconds() + iss = $AppClientId +} + +$headerEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtHeader | ConvertTo-Json -Compress))) +$payloadEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtPayload | ConvertTo-Json -Compress))) +$signingInput = "$headerEncoded.$payloadEncoded" + +# Key Vault `sign` expects the *digest* (base64), not the raw bytes. +$sha256 = [System.Security.Cryptography.SHA256]::Create() +$digestBytes = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($signingInput)) +$digestBase64 = [Convert]::ToBase64String($digestBytes) + +Write-Host "Signing JWT with key '$KeyName' in vault '$KeyVaultName'..." +$previousNativeCommandErrorPreference = $PSNativeCommandUseErrorActionPreference +try { + # Azure CLI can emit non-fatal Python warnings to stderr even when signing succeeds. + # Use the exit code to determine success for this invocation. + $PSNativeCommandUseErrorActionPreference = $false + $signatureBase64 = az keyvault key sign ` + --vault-name $KeyVaultName ` + --name $KeyName ` + --algorithm RS256 ` + --digest $digestBase64 ` + --query signature ` + --output tsv ` + --only-show-errors + $signExitCode = $LASTEXITCODE +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to sign the JWT via Key Vault (key '$KeyName', vault '$KeyVaultName'): $_. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +finally { + $PSNativeCommandUseErrorActionPreference = $previousNativeCommandErrorPreference +} +if ($signExitCode -ne 0 -or [string]::IsNullOrWhiteSpace($signatureBase64)) { + Write-PipelineTelemetryError -Category 'Build' -Message "'az keyvault key sign' exited with code $signExitCode for key '$KeyName' in vault '$KeyVaultName'. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +$signatureUrl = $signatureBase64.Trim().TrimEnd('=').Replace('+', '-').Replace('/', '_') +$jwt = "$signingInput.$signatureUrl" + +$headers = @{ + Authorization = "Bearer $jwt" + 'X-GitHub-Api-Version' = '2022-11-28' + Accept = 'application/vnd.github+json' + 'User-Agent' = 'dotnet-arcade-onelocbuild' +} + +Write-Host "Looking up installation for '$InstallationOwner'..." +try { + $installations = @() + $page = 1 + do { + $pageInstallations = @(Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations?per_page=100&page=$page" ` + -Headers $headers ` + -Method Get) + $installations += $pageInstallations + $page++ + } while ($pageInstallations.Count -eq 100) +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect." + exit 1 +} +$installation = $installations | Where-Object { $_.account.login -ieq $InstallationOwner } | Select-Object -First 1 +if (-not $installation) { + $found = ($installations | ForEach-Object { $_.account.login }) -join ', ' + Write-PipelineTelemetryError -Category 'Build' -Message "No installation found for '$InstallationOwner'. App is installed on: $found" + exit 1 +} + +try { + $tokenResponse = Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations/$($installation.id)/access_tokens" ` + -Headers $headers ` + -Method Post ` + -ContentType 'application/json' +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to mint an installation access token for '$InstallationOwner' (installation $($installation.id)): $_" + exit 1 +} + +Write-Host "Got installation token for '$InstallationOwner' (expires $($tokenResponse.expires_at))." +if ($OutputVariableName) { + Write-Host "Setting pipeline variable '$OutputVariableName'." + Write-Host "##vso[task.setvariable variable=$OutputVariableName;issecret=true]$($tokenResponse.token)" +} +else { + Write-Host $tokenResponse.token -ForegroundColor Green +} diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml index 62fa199711..a65b50d0a7 100644 --- a/eng/common/core-templates/job/helix-job-monitor.yml +++ b/eng/common/core-templates/job/helix-job-monitor.yml @@ -26,6 +26,11 @@ parameters: type: string default: '' +# Whether failures in the monitor job should allow the pipeline to continue. +- name: continueOnError + type: boolean + default: false + # NuGet package id of the Helix job monitor tool. - name: toolPackageId type: string @@ -65,6 +70,12 @@ parameters: type: boolean default: true +# When true, allow the monitor to succeed when this stage produces no Helix jobs in any attempt. +# Forwarded as --allow-no-helix-jobs. +- name: allowNoHelixJobs + type: boolean + default: false + # When true, test results are reported to Azure DevOps using the fully qualified test name # (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as # well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display; @@ -97,6 +108,7 @@ jobs: - job: HelixJobMonitor displayName: Monitor Helix Jobs timeoutInMinutes: ${{ parameters.timeoutInMinutes }} + continueOnError: ${{ parameters.continueOnError }} ${{ if ne(length(parameters.dependsOn), 0) }}: dependsOn: ${{ parameters.dependsOn }} ${{ if ne(parameters.condition, '') }}: @@ -189,6 +201,7 @@ jobs: --helix-base-uri '${{ parameters.helixBaseUri }}' --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}' --fail-on-failed-tests '${{ parameters.failWorkItemsWithFailedTests }}' + --allow-no-helix-jobs '${{ parameters.allowNoHelixJobs }}' --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}' --max-wait-minutes "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully. --stage-name '$(System.StageName)' diff --git a/eng/common/core-templates/job/onelocbuild.yml b/eng/common/core-templates/job/onelocbuild.yml index 2816d2905a..4f5653d73a 100644 --- a/eng/common/core-templates/job/onelocbuild.yml +++ b/eng/common/core-templates/job/onelocbuild.yml @@ -14,6 +14,15 @@ parameters: # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + # GitHub App authentication for the OneLoc check-in PR (dnceng/internal only). + # The infrastructure identifiers are centralized here and the App path is enabled by default. + # DevDiv requires its own project-scoped service connection before this path can be enabled there. + UseGitHubAppAuthentication: true + GitHubAppServiceConnection: 'dnceng-oneloc-githubapp' + GitHubAppClientId: 'Iv23lijBU8x3gc9lDOc9' + GitHubAppKeyVaultName: 'EngKeyVault' + GitHubAppKeyName: 'oneloc-localization-app-key' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -89,6 +98,20 @@ jobs: outputVariableName: 'CeapexEntraToken' condition: ${{ parameters.condition }} + # Mint a short-lived GitHub App installation token for the loc check-in PR (dnceng/internal only). + # All other projects fall back to PAT-based auth, since the app service connection is scoped to dnceng/internal. + - ${{ if and(eq(parameters.RepoType, 'gitHub'), eq(parameters.UseGitHubAppAuthentication, true), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: ${{ parameters.is1ESPipeline }} + azureSubscription: ${{ parameters.GitHubAppServiceConnection }} + keyVaultName: ${{ parameters.GitHubAppKeyVaultName }} + keyName: ${{ parameters.GitHubAppKeyName }} + appClientId: ${{ parameters.GitHubAppClientId }} + installationOwner: ${{ parameters.GitHubOrg }} + outputVariableName: 'GitHubAppInstallationToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -110,7 +133,10 @@ jobs: patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} - gitHubPatVariable: "${{ parameters.GithubPat }}" + ${{ if and(eq(parameters.UseGitHubAppAuthentication, true), eq(variables['System.TeamProject'], 'internal')) }}: + gitHubPatVariable: "$(GitHubAppInstallationToken)" + ${{ if or(eq(parameters.UseGitHubAppAuthentication, false), ne(variables['System.TeamProject'], 'internal')) }}: + gitHubPatVariable: "${{ parameters.GithubPat }}" ${{ if ne(parameters.MirrorRepo, '') }}: isMirrorRepoSelected: true gitHubOrganization: ${{ parameters.GitHubOrg }} diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml index 4229288d3d..330225ae09 100644 --- a/eng/common/core-templates/job/publish-build-assets.yml +++ b/eng/common/core-templates/job/publish-build-assets.yml @@ -58,8 +58,6 @@ jobs: parameters: is1ESPipeline: ${{ parameters.is1ESPipeline }} - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false # unconditional - needed for logs publishing (redactor tool version) diff --git a/eng/common/core-templates/post-build/common-variables.yml b/eng/common/core-templates/post-build/common-variables.yml index db298ae16b..a3a8480e25 100644 --- a/eng/common/core-templates/post-build/common-variables.yml +++ b/eng/common/core-templates/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/eng/common/core-templates/stages/renovate.yml b/eng/common/core-templates/stages/renovate.yml index edab281825..cfa9683794 100644 --- a/eng/common/core-templates/stages/renovate.yml +++ b/eng/common/core-templates/stages/renovate.yml @@ -81,6 +81,8 @@ resources: extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: + settings: + networkIsolationPolicy: Permissive pool: ${{ parameters.pool }} sdl: sourceAnalysisPool: ${{ parameters.sdlPool }} diff --git a/eng/common/core-templates/steps/get-github-app-token.yml b/eng/common/core-templates/steps/get-github-app-token.yml new file mode 100644 index 0000000000..6d42a48d3c --- /dev/null +++ b/eng/common/core-templates/steps/get-github-app-token.yml @@ -0,0 +1,79 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements (per GitHub App you want to authenticate as): +# - A GitHub App with its private key uploaded into Key Vault as an RSA key +# (PEM converted to a key, NOT stored as a secret). +# - The Azure service connection passed via `azureSubscription` must be +# granted the `Key Vault Crypto User` role (or at minimum `Sign` action) +# on that key. +# - The App must be installed on the target organization/account +# (`installationOwner`) with the permissions/repositories you need. +# +# Output: a secret pipeline variable named ${{ parameters.outputVariableName }} +# containing the installation access token. Token lifetime is ~1 hour and is +# automatically scrubbed from logs. Installation tokens are exempt from the +# enterprise classic-PAT lifetime policy. + +parameters: +# Azure DevOps service connection (federated) that can call +# `az keyvault key sign` on the App's signing key. +- name: azureSubscription + type: string + +# Name of the Key Vault that holds the GitHub App's RSA signing key. +- name: keyVaultName + type: string + +# Name of the RSA key inside the Key Vault (the App's private key). +- name: keyName + type: string + +# The GitHub App's Client ID (the value to put in the `iss` JWT claim). +# Prefer this over the numeric App ID; GitHub accepts either, but Client ID +# is the documented form going forward. +- name: appClientId + type: string + +# Login of the organization or user account whose installation we should +# mint the token for (e.g. `dotnet`, `microsoft`). +- name: installationOwner + type: string + +# Name of the pipeline variable that will receive the installation token. +- name: outputVariableName + type: string + +- name: is1ESPipeline + type: boolean + +- name: stepName + type: string + default: getGitHubAppInstallationToken + +- name: condition + type: string + default: '' + +- name: displayName + type: string + default: Get GitHub App installation token + +steps: +- task: AzureCLI@2 + displayName: ${{ parameters.displayName }} + name: ${{ parameters.stepName }} + ${{ if ne(parameters.condition, '') }}: + condition: ${{ parameters.condition }} + inputs: + azureSubscription: ${{ parameters.azureSubscription }} + scriptType: pscore + scriptLocation: inlineScript + inlineScript: | + & "$(System.DefaultWorkingDirectory)/eng/common/Get-GitHubAppToken.ps1" ` + -KeyVaultName '${{ parameters.keyVaultName }}' ` + -KeyName '${{ parameters.keyName }}' ` + -AppClientId '${{ parameters.appClientId }}' ` + -InstallationOwner '${{ parameters.installationOwner }}' ` + -OutputVariableName '${{ parameters.outputVariableName }}' diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml index c496f3d0dc..2c1e0ab116 100644 --- a/eng/common/core-templates/steps/publish-logs.yml +++ b/eng/common/core-templates/steps/publish-logs.yml @@ -30,8 +30,6 @@ steps: -TokensFilePath '$(System.DefaultWorkingDirectory)/eng/BinlogSecretsRedactionFile.txt' -runtimeSourceFeed https://ci.dot.net/internal -runtimeSourceFeedKey '$(dotnetbuilds-internal-container-read-token-base64)' - '$(publishing-dnceng-devdiv-code-r-build-re)' - '$(akams-client-id)' '$(System.AccessToken)' ${{parameters.CustomSensitiveDataList}} continueOnError: true @@ -56,4 +54,3 @@ steps: condition: always() retryCountOnTaskFailure: 10 # for any files being locked isProduction: false # logs are non-production artifacts - diff --git a/eng/common/templates-official/steps/get-github-app-token.yml b/eng/common/templates-official/steps/get-github-app-token.yml new file mode 100644 index 0000000000..c89f3641a4 --- /dev/null +++ b/eng/common/templates-official/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: true + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/eng/common/templates/steps/get-github-app-token.yml b/eng/common/templates/steps/get-github-app-token.yml new file mode 100644 index 0000000000..79e182c641 --- /dev/null +++ b/eng/common/templates/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: false + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/global.json b/global.json index 1bea4ced09..ca68292c79 100644 --- a/global.json +++ b/global.json @@ -13,6 +13,6 @@ "dotnet": "11.0.100-preview.6.26359.118" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26401.101" + "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26409.102" } }