[release/10.0.1xx] Backport remaining CFSClean fixes - #12394
Closed
jonathanpeppers wants to merge 5 commits into
Closed
[release/10.0.1xx] Backport remaining CFSClean fixes#12394jonathanpeppers wants to merge 5 commits into
jonathanpeppers wants to merge 5 commits into
Conversation
CFSClean reports network-isolation warnings when tests and CI tooling resolve packages directly from public NuGet endpoints. Route those package downloads through the existing dnceng `dotnet-public` Azure Artifacts feed and rely on the repository `NuGet.config` for generated test projects and the API-docs tool installation. Direct `.nupkg` test downloads now use the feed's V3 package base address, while obsolete `ExtraNuGetConfigSources` public overrides are removed. No fallback to nuget.org is retained. `Xamarin.Google.Android.InstallReferrer` 1.1.2.6 is not currently mirrored to `dotnet-public`; `InstallAndRunTests.GradleFBProj` will require that package to be mirrored. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Internal [build 14925232](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14925232) reported CFSClean violations during **Create MAUI template**. The pipeline needs to suppress three independent .NET network paths: 1. `DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=true` prevents background workload advertising-manifest updates. 2. `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` prevents the .NET CLI's separate background SDK release/vulnerability/EOL metadata refresh. The SDK invokes this refresh from restoring commands such as `dotnet build` and `dotnet restore`. 3. `NuGetAudit=false` disables NuGet restore's package-advisory lookup. This is a distinct MSBuild property and does not replace the SDK-level variable. The immediate MAUI violation came from `dotnet new maui`, which runs a restore post-action by default. That restore had no project-specific `NuGet.config`, so it contacted public NuGet and workload advertising-manifest hosts. Passing `--no-restore` creates the template without running that post-action. This does not remove the intended MAUI restore/build. The following Debug and Release build steps remain unchanged and explicitly pass `--configfile $(Build.SourcesDirectory)/maui/NuGet.config`, keeping package acquisition on the configured sources. Disabling these metadata checks also does not disable package hash/signature validation; it prevents external metadata lookups in network-isolated jobs. - Retain `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` and add `NuGetAudit=false` alongside it in shared pipeline variables and the internal override. - Add `--no-restore` to MAUI template creation in the main, public, and internal pipeline definitions. - Parsed all changed YAML files successfully. - Ran `git diff --check`. - Verified every MAUI template-creation variant uses `--no-restore`. - Verified all three isolation controls remain present where expected. - Verified `dotnet new --no-restore` creates a project without producing a restore assets file. - Confirmed the separate SDK behavior in [`RestoringCommand`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/Commands/Restore/RestoringCommand.cs) and [`SdkReleaseMetadataCache`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/SdkVulnerability/SdkReleaseMetadataCache.cs). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- declare the standard `skipRestore` symbol in every Android project template - map `skipRestore` to the user-facing `--no-restore` option through each template's `dotnetcli.host.json` - prevent `XASdkTests.DotNetNew` from restoring generated projects implicitly - copy the repository `NuGet.config` into generated projects before builds restore - route `AndroidMavenLibrary` items with blank repository metadata through `dotnet-public-maven` in test scope `--no-restore` is presented as a standard `dotnet new` option, but project templates must opt into accepting it by declaring a `skipRestore` boolean symbol and mapping that symbol to `--no-restore` in `dotnetcli.host.json`. This follows the symbol/mapping convention used by the .NET SDK and .NET MAUI templates. The Android templates intentionally do not add a restore post-action. They therefore preserve their existing default behavior and avoid restoring before test call sites configure approved package versions and feeds. The new option lets `XASdkTests` explicitly document and enforce that expectation before copying the repository `NuGet.config` into generated projects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Depends on dotnet#12336. The Windows template smoke project is generated under `$(Build.StagingDirectory)`, outside the repository `NuGet.config` hierarchy. Its implicit build restore therefore falls back to the agent's machine NuGet configuration and may access unapproved package feeds. - Pass `RestoreConfigFile=$(System.DefaultWorkingDirectory)\NuGet.config` to the template build. - Quote the template creation and build staging paths using Windows path syntax. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`CodeBehindTests` passed a file path to `CopyNuGetConfig`, which expects a directory and appends `NuGet.config`. This placed the repository configuration in a nested path, so generated projects could miss it and contact external package feeds. Pass the temporary project root instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. |
Contributor
There was a problem hiding this comment.
Pull request overview
Backports a set of CFSClean/network-isolation fixes from main into release/10.0.1xx, focusing on preventing unintended public NuGet access during CI and template/test flows while preserving release-branch-specific layout.
Changes:
- Removes explicit
api.nuget.orgoverrides from several test projects and routes direct package downloads throughdotnet-public. - Adds support for
dotnet new --no-restorein Android project templates and updatesXASdkTeststo create templates without restore, then build with an approvedNuGet.config. - Updates Azure Pipelines YAML to disable restore-related network paths (workload update notifications, SDK vulnerability checks, NuGet audit) and to avoid implicit restores in template creation/smoke steps.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/MSBuildDeviceIntegration/Tests/InstallAndRunTests.cs | Removes explicit nuget.org source override from a device integration test project. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Common/DotNetCLI.cs | Adds noRestore support to dotnet new wrapper used by tests. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/XASdkTests.cs | Uses --no-restore, copies repo NuGet.config, and adjusts build parameters (including Maven targeting for wear template). |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/Tasks/FilterAssembliesTests.cs | Switches test package downloads to the dotnet-public package base address and adds a lowercase URL test. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/dotnet-public-maven.targets | Adds an MSBuild hook to route blank AndroidMavenLibrary.Repository entries through dotnet-public-maven. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/CodeBehindTests.cs | Fixes CopyNuGetConfig usage to pass a directory instead of a file path. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest.cs | Removes explicit nuget.org source override from a smoke test project. |
| src/Microsoft.Android.Templates/androidlib/.template.config/template.json | Adds skipRestore symbol so templates can accept --no-restore. |
| src/Microsoft.Android.Templates/androidlib/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for the androidlib template. |
| src/Microsoft.Android.Templates/android/.template.config/template.json | Adds skipRestore symbol so templates can accept --no-restore. |
| src/Microsoft.Android.Templates/android/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for the android template. |
| src/Microsoft.Android.Templates/android-wear/.template.config/template.json | Adds skipRestore symbol so templates can accept --no-restore. |
| src/Microsoft.Android.Templates/android-wear/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for the androidwear template. |
| src/Microsoft.Android.Templates/android-bindinglib/.template.config/template.json | Adds skipRestore symbol so templates can accept --no-restore. |
| src/Microsoft.Android.Templates/android-bindinglib/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for the bindinglib template. |
| build-tools/automation/yaml-templates/variables.yaml | Adds variables to suppress workload updates, SDK vulnerability checks, and NuGet audit in isolated environments. |
| build-tools/automation/yaml-templates/build-windows.yaml | Quotes template paths and forces restore to use the repo NuGet.config during the Windows template smoke build. |
| build-tools/automation/azure-pipelines.yaml | Creates the MAUI template with --no-restore to prevent unconfigured restore post-actions. |
| build-tools/automation/azure-pipelines-apidocs.yaml | Removes explicit nuget.org source from boots tool installation to rely on approved feeds. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
Superseded by #12396, which uses a branch hosted directly on dotnet/android. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports the remaining non-Maven/Gradle CFSClean fixes from
maintorelease/10.0.1xx, with release-specific conflict resolution that preserves files removed or consolidated on the release branch.Maven/Gradle backports #12199 (
466da4a84) and #12368 (adffb38fd) are intentionally excluded because they are being handled separately.Original changes
8df1e87799f175f4c3e227c20e7c616e63d5570f— Use dotnet-public for CI package resolution7ace3137a4fa04f5c3c67cc71b32f7b61c339243— Prevent isolated NuGet accessc09c89aa1f2e984c9eb37a2368d3b459568aab65— Keepdotnet newrestores on approved feeds13727e665929d7fd7fd9a03b5709ff179fcc6a3b— Use repo NuGet config for template smoke buildd57b8c42f131bd346a3c809da269ba18552272be— Fix CodeBehind NuGet config placementValidation
origin/release/10.0.1xxand the PR range contains exactly five backport commits.git diff --check origin/release/10.0.1xx...HEADdotnet build src\Microsoft.Android.Templates\Microsoft.Android.Templates.csproj -c Debug -p:RunningOnCI=true -v:minimal -nodeReuse:falseXamarin.Android.Build.Testsbuild; repository preparation was blocked after all three approved-feed runtime-pack restore attempts timed out.