[jonathanpeppers]

Adapt the fix from #13280 (e22e418) to release/10.0.1xx. No merge from main or unrelated changes. The initial backport is 2473560; follow-up 7976857 restores noRestore: true, as requested. The user chose a second commit rather than rewriting the first.

Projects generated outside the source tree, including under BUILD_STAGINGDIRECTORY, do not inherit the repository NuGet.config. Restore can then use the user or machine api.nuget.org source and fail with NU1301 and proxy HTTP 403 under network isolation.

Xamarin.ProjectTools.DotNetCLI.New() now creates ProjectDirectory and copies the repository config there before running dotnet new, only when no project config exists. Existing custom configs stay unchanged. Item-template output directories such as Resources/layout do not receive a config. Default Deny remains enabled; no source is allowlisted and no restore failure is ignored.

Release test coverage:

• XASdkTests.DotNetNew has four cases: android, androidlib, android-bindinglib, and androidwear.
• Keep noRestore: true and remove the separate config copy. These release templates have no restore post-action. Removing --no-restore did not exercise restore during project creation; the earlier description claiming that coverage was incorrect.
• Keep the file-content assertion. Check it again after creating activity/layout items, and assert that Resources/layout/NuGet.config does not exist. Keep the existing Debug and Release builds and warning checks; these builds restore using the project config.
• These tests check that the shared helper supplies the config and keeps it at the project root. They do not prove that the copy precedes a creation-time restore.
• DotNetNewAndroidTest and NestedBuildReusesResolvedAndroidTooling are absent from this release branch. This PR does not add them or claim coverage from them.

Validation: focused source checks and git diff --check passed. Per the user's request to let CI test this, no SDK build, device setup, or test run was started, and no pipeline was manually queued. Restore, builds, and Default Deny behavior remain for CI to verify. Public PR checks without network isolation cannot establish Default Deny results.

No linked issue.

---

Pull Request
title and
description
should follow the
commit-messages.md workflow documentation, and in particular should include:

• Useful description of why the change is necessary.
• Links to issues fixed
• Unit tests

[Copilot]

🟡 Changes recommended

The tests leave config-copy ordering unverified because the templates lack restore post-actions; a restore-enabled regression must assert that project.assets.json exists immediately after New(), before any build.

1 open issue

• Test restore occurs during template creation · New

What changed in this PR

Backports repository NuGet feed handling to release/10.0.1xx so generated test projects outside the source tree receive the repository configuration before dotnet new runs.

Changes:

• Creates the project directory and copies NuGet.config only when none exists.
• Removes the test-local config copy and --no-restore argument.
• Adds checks that item creation leaves the project config unchanged and creates no layout-directory config, while retaining Debug and Release build checks.

File	Description
src/​Xamarin.Android.Build.Tasks/​Tests/​Xamarin.ProjectTools/​Common/​DotNetCLI.cs	Copies repository NuGet configuration before template creation.
src/​Xamarin.Android.Build.Tasks/​Tests/​Xamarin.Android.Build.Tests/​XASdkTests.cs	Uses shared config handling and checks config placement after item creation.

_{Review effort: Balanced}

[jonathanpeppers]

/azp run

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.

[jonathanpeppers]

Checked internal CI run 15834717, which tested merge commit 9cd7c3913aa82734c1cb32a3cbbd844b16a9c2f3 and includes this PR's latest commit, 7976857a61.

All four release XASdkTests.DotNetNew cases passed on Windows, Linux, and macOS. Checked the execution logs across all 8 Windows, 10 macOS, and 2 Linux MSBuild lanes:

DotNetNew case	Windows lane	macOS lane	Linux lane	Result
android	1	5	2	All passed
androidlib	2	6	2	All passed
androidwear	3	7	2	All passed
android-bindinglib	8	4	2	All passed

The other MSBuild lanes had none of these four cases.

All 28 network-isolation stop logs reported no blocked connections and Default Deny COMPLIANT. This includes every Windows and Linux lane listed above. The Windows MSBuild 1 start log confirms Enforce -Policies DefaultDeny,CFSClean, not audit-only mode. The macOS lanes had no network-isolation tasks, so their passes do not establish Default Deny coverage.

The run failed overall in the macOS APK 1 and APK 2 jobs, not in the network-isolation checks.

Coverage limit: NestedBuildReusesResolvedAndroidTooling and DotNetNewAndroidTest are absent from this release branch. These results cover the release template tests and their later restore/build steps, not those main-only tests or restore during project creation.

[jonathanpeppers]

Checked the CI failures in build 15834717. The failures appear unrelated to this PR.

The downloaded NUnit results show:

Failures	Evidence	Assessment
36 HTTP test failures across six configurations	All return HTTP 403 Forbidden. The tests use external HTTP redirect endpoints.	These appear unrelated to copying NuGet.config and are consistent with blocked network access. The results alone do not identify which server or proxy returned the 403.
One NativeAOT failure	InflateCustomView_ShouldNotLeakGlobalRefs reports 328 extra global references after inflating 100 custom views; the allowed limit is 100.	This appears to be a separate runtime/test issue. I have not confirmed whether it also fails on a baseline build.

[jonathanpeppers]

@dalexsoto stamp

[dalexsoto]

Stamping as requested by @jonathanpeppers; no code review performed.