From 1c1762fa7fb7224469b9cf5aa4bea918c9ff9a1b Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 22:52:19 +0000 Subject: [PATCH 1/8] [release/8.0.1xx] Update dependencies from dotnet/arcade (#10378) [release/8.0.1xx] Update dependencies from dotnet/arcade --- eng/Version.Details.xml | 4 +- eng/common/SetupNugetSources.ps1 | 51 ++++++++-------- eng/common/SetupNugetSources.sh | 59 +++++++++---------- .../templates-official/job/onelocbuild.yml | 20 ++++++- .../templates-official/steps/source-build.yml | 14 ++++- eng/common/templates/job/onelocbuild.yml | 20 ++++++- eng/common/templates/steps/source-build.yml | 14 ++++- global.json | 2 +- 8 files changed, 119 insertions(+), 65 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index b8e96e0b9c9..4639c91703e 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -17,9 +17,9 @@ - + https://github.com/dotnet/arcade - 4b95fb1a9307265eb75f62d4937be50e6786e94e + 444c2ef3c414558e2e409ee346f1faebb19687eb diff --git a/eng/common/SetupNugetSources.ps1 b/eng/common/SetupNugetSources.ps1 index 59b2d55e1a3..8f1ac28e119 100644 --- a/eng/common/SetupNugetSources.ps1 +++ b/eng/common/SetupNugetSources.ps1 @@ -1,17 +1,10 @@ -# This file is a temporary workaround for internal builds to be able to restore from private AzDO feeds. -# This file should be removed as part of this issue: https://github.com/dotnet/arcade/issues/4080 +# This script adds internal feeds required to build commits that depend on internal package sources. For instance, +# dotnet6-internal would be added automatically if dotnet6 was found in the nuget.config file. In addition also enables +# disabled internal Maestro (darc-int*) feeds. # -# What the script does is iterate over all package sources in the pointed NuGet.config and add a credential entry -# under for each Maestro managed private feed. Two additional credential -# entries are also added for the two private static internal feeds: dotnet3-internal and dotnet3-internal-transport. +# Optionally, this script also adds a credential entry for each of the internal feeds if supplied. # -# This script needs to be called in every job that will restore packages and which the base repo has -# private AzDO feeds in the NuGet.config. -# -# See example YAML call for this script below. Note the use of the variable `$(dn-bot-dnceng-artifact-feeds-rw)` -# from the AzureDevOps-Artifact-Feeds-Pats variable group. -# -# Any disabledPackageSources entries which start with "darc-int" will be re-enabled as part of this script executing +# See example call for this script below. # # - task: PowerShell@2 # displayName: Setup Private Feeds Credentials @@ -21,11 +14,17 @@ # arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $Env:Token # env: # Token: $(dn-bot-dnceng-artifact-feeds-rw) +# +# Note that the NuGetAuthenticate task should be called after SetupNugetSources. +# This ensures that: +# - Appropriate creds are set for the added internal feeds (if not supplied to the script) +# - The credential provider is installed. +# [CmdletBinding()] param ( [Parameter(Mandatory = $true)][string]$ConfigFile, - [Parameter(Mandatory = $true)][string]$Password + $Password ) $ErrorActionPreference = "Stop" @@ -48,11 +47,17 @@ function AddPackageSource($sources, $SourceName, $SourceEndPoint, $creds, $Usern else { Write-Host "Package source $SourceName already present." } + AddCredential -Creds $creds -Source $SourceName -Username $Username -pwd $pwd } # Add a credential node for the specified source function AddCredential($creds, $source, $username, $pwd) { + # If no cred supplied, don't do anything. + if (!$pwd) { + return; + } + # Looks for credential configuration for the given SourceName. Create it if none is found. $sourceElement = $creds.SelectSingleNode($Source) if ($sourceElement -eq $null) @@ -110,11 +115,6 @@ if (!(Test-Path $ConfigFile -PathType Leaf)) { ExitWithExitCode 1 } -if (!$Password) { - Write-PipelineTelemetryError -Category 'Build' -Message 'Eng/common/SetupNugetSources.ps1 returned a non-zero exit code. Please supply a valid PAT' - ExitWithExitCode 1 -} - # Load NuGet.config $doc = New-Object System.Xml.XmlDocument $filename = (Get-Item $ConfigFile).FullName @@ -127,11 +127,14 @@ if ($sources -eq $null) { $doc.DocumentElement.AppendChild($sources) | Out-Null } -# Looks for a node. Create it if none is found. -$creds = $doc.DocumentElement.SelectSingleNode("packageSourceCredentials") -if ($creds -eq $null) { - $creds = $doc.CreateElement("packageSourceCredentials") - $doc.DocumentElement.AppendChild($creds) | Out-Null +$creds = $null +if ($Password) { + # Looks for a node. Create it if none is found. + $creds = $doc.DocumentElement.SelectSingleNode("packageSourceCredentials") + if ($creds -eq $null) { + $creds = $doc.CreateElement("packageSourceCredentials") + $doc.DocumentElement.AppendChild($creds) | Out-Null + } } # Check for disabledPackageSources; we'll enable any darc-int ones we find there @@ -164,4 +167,4 @@ foreach ($dotnetVersion in $dotnetVersions) { } } -$doc.Save($filename) \ No newline at end of file +$doc.Save($filename) diff --git a/eng/common/SetupNugetSources.sh b/eng/common/SetupNugetSources.sh index c0e7bbef21c..5c1c644280e 100644 --- a/eng/common/SetupNugetSources.sh +++ b/eng/common/SetupNugetSources.sh @@ -1,28 +1,26 @@ #!/usr/bin/env bash -# This file is a temporary workaround for internal builds to be able to restore from private AzDO feeds. -# This file should be removed as part of this issue: https://github.com/dotnet/arcade/issues/4080 +# This script adds internal feeds required to build commits that depend on internal package sources. For instance, +# dotnet6-internal would be added automatically if dotnet6 was found in the nuget.config file. In addition also enables +# disabled internal Maestro (darc-int*) feeds. +# +# Optionally, this script also adds a credential entry for each of the internal feeds if supplied. # -# What the script does is iterate over all package sources in the pointed NuGet.config and add a credential entry -# under for each Maestro's managed private feed. Two additional credential -# entries are also added for the two private static internal feeds: dotnet3-internal and dotnet3-internal-transport. -# -# This script needs to be called in every job that will restore packages and which the base repo has -# private AzDO feeds in the NuGet.config. -# -# See example YAML call for this script below. Note the use of the variable `$(dn-bot-dnceng-artifact-feeds-rw)` -# from the AzureDevOps-Artifact-Feeds-Pats variable group. -# -# Any disabledPackageSources entries which start with "darc-int" will be re-enabled as part of this script executing. +# See example call for this script below. # # - task: Bash@3 -# displayName: Setup Private Feeds Credentials +# displayName: Setup Internal Feeds # inputs: # filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh -# arguments: $(System.DefaultWorkingDirectory)/NuGet.config $Token +# arguments: $(System.DefaultWorkingDirectory)/NuGet.config # condition: ne(variables['Agent.OS'], 'Windows_NT') -# env: -# Token: $(dn-bot-dnceng-artifact-feeds-rw) +# - task: NuGetAuthenticate@1 +# +# Note that the NuGetAuthenticate task should be called after SetupNugetSources. +# This ensures that: +# - Appropriate creds are set for the added internal feeds (if not supplied to the script) +# - The credential provider is installed. +# ConfigFile=$1 CredToken=$2 @@ -48,11 +46,6 @@ if [ ! -f "$ConfigFile" ]; then ExitWithExitCode 1 fi -if [ -z "$CredToken" ]; then - Write-PipelineTelemetryError -category 'Build' "Error: Eng/common/SetupNugetSources.sh returned a non-zero exit code. Please supply a valid PAT" - ExitWithExitCode 1 -fi - if [[ `uname -s` == "Darwin" ]]; then NL=$'\\\n' TB='' @@ -140,18 +133,20 @@ PackageSources+="$IFS" PackageSources+=$(grep -oh '"darc-int-[^"]*"' $ConfigFile | tr -d '"') IFS=$PrevIFS -for FeedName in ${PackageSources[@]} ; do - # Check if there is no existing credential for this FeedName - grep -i "<$FeedName>" $ConfigFile - if [ "$?" != "0" ]; then - echo "Adding credentials for $FeedName." +if [ "$CredToken" ]; then + for FeedName in ${PackageSources[@]} ; do + # Check if there is no existing credential for this FeedName + grep -i "<$FeedName>" $ConfigFile + if [ "$?" != "0" ]; then + echo "Adding credentials for $FeedName." - PackageSourceCredentialsNodeFooter="" - NewCredential="${TB}${TB}<$FeedName>${NL}${NL}${NL}" + PackageSourceCredentialsNodeFooter="" + NewCredential="${TB}${TB}<$FeedName>${NL}${NL}${NL}" - sed -i.bak "s|$PackageSourceCredentialsNodeFooter|$NewCredential${NL}$PackageSourceCredentialsNodeFooter|" $ConfigFile - fi -done + sed -i.bak "s|$PackageSourceCredentialsNodeFooter|$NewCredential${NL}$PackageSourceCredentialsNodeFooter|" $ConfigFile + fi + done +fi # Re-enable any entries in disabledPackageSources where the feed name contains darc-int grep -i "" $ConfigFile diff --git a/eng/common/templates-official/job/onelocbuild.yml b/eng/common/templates-official/job/onelocbuild.yml index 68e7a65605c..c103b0445a8 100644 --- a/eng/common/templates-official/job/onelocbuild.yml +++ b/eng/common/templates-official/job/onelocbuild.yml @@ -8,6 +8,12 @@ parameters: CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex GithubPat: $(BotAccount-dotnet-bot-repo-PAT) + # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). + # When set, dnceng/internal builds acquire a federated Entra token instead of using a PAT. + # All other projects (e.g. DevDiv, public), where this dnceng-scoped service connection does not + # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. + CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -68,6 +74,15 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} + # Acquire an Entra token for ceapex feed access via WIF (dnceng/internal only). + # All other projects use PAT-based auth, since the ceapex service connection is scoped to dnceng/internal. + - ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/templates-official/steps/get-federated-access-token.yml + parameters: + federatedServiceConnection: ${{ parameters.CeapexServiceConnection }} + outputVariableName: 'CeapexEntraToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -84,7 +99,10 @@ jobs: ${{ if eq(parameters.RepoType, 'gitHub') }}: isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - patVariable: ${{ parameters.CeapexPat }} + ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + patVariable: $(CeapexEntraToken) + ${{ if or(eq(parameters.CeapexServiceConnection, ''), ne(variables['System.TeamProject'], 'internal')) }}: + patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} gitHubPatVariable: "${{ parameters.GithubPat }}" diff --git a/eng/common/templates-official/steps/source-build.yml b/eng/common/templates-official/steps/source-build.yml index c307825c912..acb64b39a69 100644 --- a/eng/common/templates-official/steps/source-build.yml +++ b/eng/common/templates-official/steps/source-build.yml @@ -18,7 +18,6 @@ parameters: steps: # Build. Keep it self-contained for simple reusability. (No source-build-specific job variables.) - script: | - set -x df -h # If building on the internal project, the artifact feeds variable may be available (usually only if needed) @@ -30,7 +29,12 @@ steps: if [ '$(dn-bot-dnceng-artifact-feeds-rw)' != '$''(dn-bot-dnceng-artifact-feeds-rw)' ]; then # Temporarily work around https://github.com/dotnet/arcade/issues/7709 chmod +x $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh - $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh $(System.DefaultWorkingDirectory)/NuGet.config $(dn-bot-dnceng-artifact-feeds-rw) + # Authenticate to internal feeds using the build identity (System.AccessToken) + if [ -z "$(System.AccessToken)" ]; then + echo "##vso[task.logissue type=error]System.AccessToken is empty; cannot authenticate to internal feeds for source-build." + exit 1 + fi + "$(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh" "$(System.DefaultWorkingDirectory)/NuGet.config" "$(System.AccessToken)" internalRestoreArgs='/p:CopyWipIntoInnerSourceBuildRepo=true' # The 'Copy WIP' feature of source build uses git stash to apply changes from the original repo. @@ -50,6 +54,9 @@ steps: internalRuntimeDownloadArgs='/p:DotNetRuntimeSourceFeed=https://ci.dot.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64) --runtimesourcefeed https://ci.dot.net/internal --runtimesourcefeedkey $(dotnetbuilds-internal-container-read-token-base64)' fi + # Enable command tracing for the build-argument assembly below (no secrets are evaluated here). + set -x + buildConfig=Release # Check if AzDO substitutes in a build config from a variable, and use it if so. if [ '$(_BuildConfig)' != '$''(_BuildConfig)' ]; then @@ -86,6 +93,9 @@ steps: assetManifestFileName=SourceBuild_${{ parameters.platform.name }}.xml fi + # internalRuntimeDownloadArgs embeds the dotnetbuilds-internal-container-read-token-base64 secret, + # so disable tracing before the build invocation so the token isn't echoed via xtrace. + set +x ${{ coalesce(parameters.platform.buildScript, './build.sh') }} --ci \ --configuration $buildConfig \ --restore --build --pack $publishArgs -bl \ diff --git a/eng/common/templates/job/onelocbuild.yml b/eng/common/templates/job/onelocbuild.yml index 0d9a54751c8..77584083d3c 100644 --- a/eng/common/templates/job/onelocbuild.yml +++ b/eng/common/templates/job/onelocbuild.yml @@ -8,6 +8,12 @@ parameters: CeapexPat: $(dn-bot-ceapex-package-r) # PAT for the loc AzDO instance https://dev.azure.com/ceapex GithubPat: $(BotAccount-dotnet-bot-repo-PAT) + # Service connection for WIF-based Entra authentication to ceapex feeds (replaces CeapexPat). + # When set, dnceng/internal builds acquire a federated Entra token instead of using a PAT. + # All other projects (e.g. DevDiv, public), where this dnceng-scoped service connection does not + # exist, and any pipeline that sets this to '' fall back to PAT-based auth via the CeapexPat parameter. + CeapexServiceConnection: 'dnceng-onelocbuild-ceapex' + SourcesDirectory: $(System.DefaultWorkingDirectory) CreatePr: true AutoCompletePr: false @@ -65,6 +71,15 @@ jobs: displayName: Generate LocProject.json condition: ${{ parameters.condition }} + # Acquire an Entra token for ceapex feed access via WIF (dnceng/internal only). + # All other projects use PAT-based auth, since the ceapex service connection is scoped to dnceng/internal. + - ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + - template: /eng/common/templates/steps/get-federated-access-token.yml + parameters: + federatedServiceConnection: ${{ parameters.CeapexServiceConnection }} + outputVariableName: 'CeapexEntraToken' + condition: ${{ parameters.condition }} + - task: OneLocBuild@2 displayName: OneLocBuild env: @@ -81,7 +96,10 @@ jobs: ${{ if eq(parameters.RepoType, 'gitHub') }}: isShouldReusePrSelected: ${{ parameters.ReusePr }} packageSourceAuth: patAuth - patVariable: ${{ parameters.CeapexPat }} + ${{ if and(ne(parameters.CeapexServiceConnection, ''), eq(variables['System.TeamProject'], 'internal')) }}: + patVariable: $(CeapexEntraToken) + ${{ if or(eq(parameters.CeapexServiceConnection, ''), ne(variables['System.TeamProject'], 'internal')) }}: + patVariable: ${{ parameters.CeapexPat }} ${{ if eq(parameters.RepoType, 'gitHub') }}: repoType: ${{ parameters.RepoType }} gitHubPatVariable: "${{ parameters.GithubPat }}" diff --git a/eng/common/templates/steps/source-build.yml b/eng/common/templates/steps/source-build.yml index d08a0e92caa..91da8aaee5f 100644 --- a/eng/common/templates/steps/source-build.yml +++ b/eng/common/templates/steps/source-build.yml @@ -18,7 +18,6 @@ parameters: steps: # Build. Keep it self-contained for simple reusability. (No source-build-specific job variables.) - script: | - set -x df -h # If building on the internal project, the artifact feeds variable may be available (usually only if needed) @@ -30,7 +29,12 @@ steps: if [ '$(dn-bot-dnceng-artifact-feeds-rw)' != '$''(dn-bot-dnceng-artifact-feeds-rw)' ]; then # Temporarily work around https://github.com/dotnet/arcade/issues/7709 chmod +x $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh - $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh $(System.DefaultWorkingDirectory)/NuGet.config $(dn-bot-dnceng-artifact-feeds-rw) + # Authenticate to internal feeds using the build identity (System.AccessToken) + if [ -z "$(System.AccessToken)" ]; then + echo "##vso[task.logissue type=error]System.AccessToken is empty; cannot authenticate to internal feeds for source-build." + exit 1 + fi + "$(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.sh" "$(System.DefaultWorkingDirectory)/NuGet.config" "$(System.AccessToken)" internalRestoreArgs='/p:CopyWipIntoInnerSourceBuildRepo=true' # The 'Copy WIP' feature of source build uses git stash to apply changes from the original repo. @@ -50,6 +54,9 @@ steps: internalRuntimeDownloadArgs='/p:DotNetRuntimeSourceFeed=https://ci.dot.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64) --runtimesourcefeed https://ci.dot.net/internal --runtimesourcefeedkey $(dotnetbuilds-internal-container-read-token-base64)' fi + # Enable command tracing for the build-argument assembly below (no secrets are evaluated here). + set -x + buildConfig=Release # Check if AzDO substitutes in a build config from a variable, and use it if so. if [ '$(_BuildConfig)' != '$''(_BuildConfig)' ]; then @@ -86,6 +93,9 @@ steps: assetManifestFileName=SourceBuild_${{ parameters.platform.name }}.xml fi + # internalRuntimeDownloadArgs embeds the dotnetbuilds-internal-container-read-token-base64 secret, + # so disable tracing before the build invocation so the token isn't echoed via xtrace. + set +x ${{ coalesce(parameters.platform.buildScript, './build.sh') }} --ci \ --configuration $buildConfig \ --restore --build --pack $publishArgs -bl \ diff --git a/global.json b/global.json index f6f6bc4e91e..6544bee29c2 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "8.0.126" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26278.3" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26371.5" } } From abf5d7fdaa4ae2e7464b89869731da71c4128f37 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 07:54:34 -0500 Subject: [PATCH 2/8] [release/8.0.1xx] Update dependencies from dotnet/arcade (#10395) This pull request updates the following dependencies [marker]: <> (Begin:0d66de4b-fd8f-44dd-a789-08db9e4038dc) ## From https://github.com/dotnet/arcade - **Subscription**: [0d66de4b-fd8f-44dd-a789-08db9e4038dc](https://maestro.dot.net/subscriptions?search=0d66de4b-fd8f-44dd-a789-08db9e4038dc) - **Build**: [20260804.4](https://dev.azure.com/dnceng/internal/_build/results?buildId=3038758) ([325558](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/325558)) - **Date Produced**: August 4, 2026 12:07:43 PM UTC - **Commit**: [b9abaa942c5224cf7196918cdf25a4db6bf99487](https://github.com/dotnet/arcade/commit/b9abaa942c5224cf7196918cdf25a4db6bf99487) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.0-beta.26371.5 to 8.0.0-beta.26404.4][1] - Microsoft.DotNet.Arcade.Sdk [1]: https://github.com/dotnet/arcade/compare/444c2ef3c4...b9abaa942c [DependencyUpdate]: <> (End) [marker]: <> (End:0d66de4b-fd8f-44dd-a789-08db9e4038dc) Co-authored-by: dotnet-maestro[bot] --- eng/Version.Details.xml | 4 ++-- global.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 4639c91703e..76b0b988e7a 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -17,9 +17,9 @@ - + https://github.com/dotnet/arcade - 444c2ef3c414558e2e409ee346f1faebb19687eb + b9abaa942c5224cf7196918cdf25a4db6bf99487 diff --git a/global.json b/global.json index 6544bee29c2..2b87ef8dcc1 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "8.0.126" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26371.5" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26404.4" } } From 4bbec53908dde5c9191d3579b22643522e98e4b0 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 07:57:44 -0500 Subject: [PATCH 3/8] [release/8.0.1xx] Update dependencies from dotnet/source-build-assets (#10394) This pull request updates the following dependencies [marker]: <> (Begin:c3d369e0-9275-4689-0eb0-08db9e40a4f0) ## From https://github.com/dotnet/source-build-assets - **Subscription**: [c3d369e0-9275-4689-0eb0-08db9e40a4f0](https://maestro.dot.net/subscriptions?search=c3d369e0-9275-4689-0eb0-08db9e40a4f0) - **Build**: [20260803.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=3037777) ([325360](https://maestro.dot.net/channel/3885/github:dotnet:source-build-assets/build/325360)) - **Date Produced**: August 3, 2026 12:49:59 PM UTC - **Commit**: [c91650e32f386a2ac2fa3ee0eb17541de52e89d4](https://github.com/dotnet/source-build-assets/commit/c91650e32f386a2ac2fa3ee0eb17541de52e89d4) - **Branch**: [release/8.0](https://github.com/dotnet/source-build-assets/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.0-alpha.1.26301.2 to 8.0.0-alpha.1.26403.3][1] - Microsoft.SourceBuild.Intermediate.source-build-assets [1]: https://github.com/dotnet/source-build-assets/compare/2bb24ee4d1...c91650e32f [DependencyUpdate]: <> (End) [marker]: <> (End:c3d369e0-9275-4689-0eb0-08db9e40a4f0) Co-authored-by: dotnet-maestro[bot] --- eng/Version.Details.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 76b0b988e7a..b14b0b7618f 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -6,9 +6,9 @@ f537cc21040df4a14d26a3045a0d4b6fdc1efc3b - + https://github.com/dotnet/source-build-assets - 2bb24ee4d15de5a4550abed0265ca9e0ef0beae3 + c91650e32f386a2ac2fa3ee0eb17541de52e89d4 From 744e25229e0ad28a48fba3d871a3280476337f74 Mon Sep 17 00:00:00 2001 From: dotnet bot Date: Wed, 5 Aug 2026 11:42:36 -0700 Subject: [PATCH 4/8] [release/8.0.1xx] Update branding to 8.0.131 (#10397) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This PR updates version branding on branch `release/8.0.1xx`. **Changes:** - Repository: templating - PatchVersion: `30` → `31` **Files Modified:** - eng/Versions.props (+1 -1) --- eng/Versions.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/eng/Versions.props b/eng/Versions.props index 23248bf0acc..05dd075e336 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -4,7 +4,7 @@ true true - 8.0.130 + 8.0.131 true release From f22b8cdda0dcc4de324395f0f5ed16664df65666 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 18:55:44 +0000 Subject: [PATCH 5/8] [release/8.0.1xx] Update dependencies from dotnet/source-build-externals (#10373) This pull request updates the following dependencies [marker]: <> (Begin:73c99211-eb79-4ad6-8e30-08db9e435944) ## From https://github.com/dotnet/source-build-externals - **Subscription**: [73c99211-eb79-4ad6-8e30-08db9e435944](https://maestro.dot.net/subscriptions?search=73c99211-eb79-4ad6-8e30-08db9e435944) - **Build**: [20260803.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=3037770) ([325359](https://maestro.dot.net/channel/3073/github:dotnet:source-build-externals/build/325359)) - **Date Produced**: August 3, 2026 12:40:24 PM UTC - **Commit**: [d64f0dd8dea2a4cd6e956f1f84137a3c58d70bd9](https://github.com/dotnet/source-build-externals/commit/d64f0dd8dea2a4cd6e956f1f84137a3c58d70bd9) - **Branch**: [release/8.0](https://github.com/dotnet/source-build-externals/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.0-alpha.1.26301.1 to 8.0.0-alpha.1.26403.1][2] - Microsoft.SourceBuild.Intermediate.source-build-externals [2]: https://github.com/dotnet/source-build-externals/compare/f537cc2104...d64f0dd8de [DependencyUpdate]: <> (End) [marker]: <> (End:73c99211-eb79-4ad6-8e30-08db9e435944) --------- Co-authored-by: dotnet-maestro[bot] --- eng/Version.Details.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index b14b0b7618f..18d1f4c26a6 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -1,9 +1,9 @@ - + https://github.com/dotnet/source-build-externals - f537cc21040df4a14d26a3045a0d4b6fdc1efc3b + d64f0dd8dea2a4cd6e956f1f84137a3c58d70bd9 From a747ee8e1901e7aa078a42d76667d7753654d6f7 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:12:50 -0500 Subject: [PATCH 6/8] [release/8.0.4xx] Update dependencies from dotnet/arcade (#10407) This pull request updates the following dependencies [marker]: <> (Begin:20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) ## From https://github.com/dotnet/arcade - **Subscription**: [20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf](https://maestro.dot.net/subscriptions?search=20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) - **Build**: [20260805.8](https://dev.azure.com/dnceng/internal/_build/results?buildId=3040533) ([325963](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/325963)) - **Date Produced**: August 6, 2026 3:02:32 AM UTC - **Commit**: [dcc22d2c84bf1fbbe33978fdc46197968ff0aac5](https://github.com/dotnet/arcade/commit/dcc22d2c84bf1fbbe33978fdc46197968ff0aac5) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.0-beta.26404.4 to 8.0.0-beta.26405.8][1] - Microsoft.DotNet.Arcade.Sdk [1]: https://github.com/dotnet/arcade/compare/b9abaa942c...dcc22d2c84 [DependencyUpdate]: <> (End) [marker]: <> (End:20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) Co-authored-by: dotnet-maestro[bot] --- eng/Version.Details.xml | 4 ++-- eng/common/templates-official/job/publish-build-assets.yml | 2 -- eng/common/templates-official/jobs/codeql-build.yml | 1 - eng/common/templates-official/post-build/common-variables.yml | 2 -- eng/common/templates/job/publish-build-assets.yml | 2 -- eng/common/templates/jobs/codeql-build.yml | 1 - eng/common/templates/post-build/common-variables.yml | 2 -- global.json | 2 +- 8 files changed, 3 insertions(+), 13 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 04bf7ee515d..f9cd8d0dce2 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -17,9 +17,9 @@ - + https://github.com/dotnet/arcade - b9abaa942c5224cf7196918cdf25a4db6bf99487 + dcc22d2c84bf1fbbe33978fdc46197968ff0aac5 diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index 67a0de433a3..4842d4c723e 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -48,8 +48,6 @@ jobs: variables: - template: /eng/common/templates-official/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: diff --git a/eng/common/templates-official/jobs/codeql-build.yml b/eng/common/templates-official/jobs/codeql-build.yml index f6476912a86..b62247fe703 100644 --- a/eng/common/templates-official/jobs/codeql-build.yml +++ b/eng/common/templates-official/jobs/codeql-build.yml @@ -17,7 +17,6 @@ jobs: enableTelemetry: true variables: - - group: Publish-Build-Assets # The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in # sync with the packages.config file. - name: DefaultGuardianVersion diff --git a/eng/common/templates-official/post-build/common-variables.yml b/eng/common/templates-official/post-build/common-variables.yml index 173914f2364..c4b8507bb45 100644 --- a/eng/common/templates-official/post-build/common-variables.yml +++ b/eng/common/templates-official/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index 9234ccab1a4..42c154b1304 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -48,8 +48,6 @@ jobs: variables: - template: /eng/common/templates/variables/pool-providers.yml - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}: - - group: Publish-Build-Assets - - group: AzureDevOps-Artifact-Feeds-Pats - name: runCodesignValidationInjection value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: diff --git a/eng/common/templates/jobs/codeql-build.yml b/eng/common/templates/jobs/codeql-build.yml index e8b43e3b4cb..a89c1f02682 100644 --- a/eng/common/templates/jobs/codeql-build.yml +++ b/eng/common/templates/jobs/codeql-build.yml @@ -17,7 +17,6 @@ jobs: enableTelemetry: true variables: - - group: Publish-Build-Assets # The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in # sync with the packages.config file. - name: DefaultGuardianVersion diff --git a/eng/common/templates/post-build/common-variables.yml b/eng/common/templates/post-build/common-variables.yml index 173914f2364..c4b8507bb45 100644 --- a/eng/common/templates/post-build/common-variables.yml +++ b/eng/common/templates/post-build/common-variables.yml @@ -1,6 +1,4 @@ variables: - - group: Publish-Build-Assets - # Whether the build is internal or not - name: IsInternalBuild value: ${{ and(ne(variables['System.TeamProject'], 'public'), contains(variables['Build.SourceBranch'], 'internal')) }} diff --git a/global.json b/global.json index 2b87ef8dcc1..32f2bb283c9 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "8.0.126" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26404.4" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26405.8" } } From efd2f592a281279b41736a046cd4a2f027a4db49 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 23:25:22 +0000 Subject: [PATCH 7/8] [release/8.0.4xx] Update dependencies from dotnet/arcade (#10422) [release/8.0.4xx] Update dependencies from dotnet/arcade --- eng/Version.Details.xml | 4 +- eng/common/Get-GitHubAppToken.ps1 | 145 ++++++++++++++++++ .../steps/get-github-app-token.yml | 79 ++++++++++ .../steps/get-github-app-token.yml | 7 + eng/common/templates/job/execute-sdl.yml | 1 - .../templates/steps/get-github-app-token.yml | 7 + global.json | 2 +- 7 files changed, 241 insertions(+), 4 deletions(-) create mode 100644 eng/common/Get-GitHubAppToken.ps1 create mode 100644 eng/common/core-templates/steps/get-github-app-token.yml create mode 100644 eng/common/templates-official/steps/get-github-app-token.yml create mode 100644 eng/common/templates/steps/get-github-app-token.yml diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index f9cd8d0dce2..c0bece00161 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -17,9 +17,9 @@ - + https://github.com/dotnet/arcade - dcc22d2c84bf1fbbe33978fdc46197968ff0aac5 + 0992a0f871c48ccc32eaa49ad89fea8022b8f597 diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1 new file mode 100644 index 00000000000..648035a3ecf --- /dev/null +++ b/eng/common/Get-GitHubAppToken.ps1 @@ -0,0 +1,145 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The signed JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements: +# - A GitHub App whose private key has been uploaded into Key Vault as an RSA +# key (the PEM converted to a Key Vault *key*, NOT stored as a secret). +# - The caller (the federated Azure service connection used to run this script) +# must have the `Key Vault Crypto User` role (or at minimum the `Sign` +# action) on that key. +# - The App must be installed on the target organization/account +# (`InstallationOwner`) with the permissions/repositories it needs. +# +# Installation tokens (ghs_*) are exempt from the enterprise classic-PAT +# lifetime policy, which is why this replaces the long-lived PAT. + +[CmdletBinding()] +param( + # Name of the Key Vault that holds the GitHub App's RSA signing key. + [Parameter(Mandatory = $true)] + [string] $KeyVaultName, + + # Name of the RSA key inside the Key Vault (the App's private key). + [Parameter(Mandatory = $true)] + [string] $KeyName, + + # The GitHub App's Client ID (the value to put in the `iss` JWT claim). + [Parameter(Mandatory = $true)] + [string] $AppClientId, + + # Login of the organization or user account whose installation we should + # mint the token for (e.g. `dotnet`, `microsoft`). + [Parameter(Mandatory = $true)] + [string] $InstallationOwner, + + # Optional Azure DevOps pipeline variable name to set with the installation + # token (marked as a secret). When not specified, the token is written to + # stdout instead. + [Parameter(Mandatory = $false)] + [string] $OutputVariableName +) + +$ErrorActionPreference = 'Stop' +$PSNativeCommandUseErrorActionPreference = $true + +. $PSScriptRoot\pipeline-logging-functions.ps1 + +function ConvertTo-Base64Url([byte[]] $bytes) { + return [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_') +} + +# Build JWT header and payload. Use [ordered] hashtables so JSON +# serialization is deterministic. +$jwtHeader = [ordered]@{ + alg = 'RS256' + typ = 'JWT' +} +$now = [System.DateTimeOffset]::UtcNow +$jwtPayload = [ordered]@{ + iat = $now.AddMinutes(-1).ToUnixTimeSeconds() + exp = $now.AddMinutes(5).ToUnixTimeSeconds() + iss = $AppClientId +} + +$headerEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtHeader | ConvertTo-Json -Compress))) +$payloadEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtPayload | ConvertTo-Json -Compress))) +$signingInput = "$headerEncoded.$payloadEncoded" + +# Key Vault `sign` expects the *digest* (base64), not the raw bytes. +$sha256 = [System.Security.Cryptography.SHA256]::Create() +$digestBytes = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($signingInput)) +$digestBase64 = [Convert]::ToBase64String($digestBytes) + +Write-Host "Signing JWT with key '$KeyName' in vault '$KeyVaultName'..." +try { + $signatureUrl = az keyvault key sign ` + --vault-name $KeyVaultName ` + --name $KeyName ` + --algorithm RS256 ` + --digest $digestBase64 ` + --query value ` + --output tsv ` + --only-show-errors +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to sign the JWT via Key Vault (key '$KeyName', vault '$KeyVaultName'): $_. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($signatureUrl)) { + Write-PipelineTelemetryError -Category 'Build' -Message "'az keyvault key sign' exited with code $LASTEXITCODE for key '$KeyName' in vault '$KeyVaultName'. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key." + exit 1 +} +$jwt = "$signingInput.$($signatureUrl.Trim())" + +$headers = @{ + Authorization = "Bearer $jwt" + 'X-GitHub-Api-Version' = '2022-11-28' + Accept = 'application/vnd.github+json' + 'User-Agent' = 'dotnet-arcade-onelocbuild' +} + +Write-Host "Looking up installation for '$InstallationOwner'..." +try { + $installations = @() + $page = 1 + do { + $pageInstallations = @(Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations?per_page=100&page=$page" ` + -Headers $headers ` + -Method Get) + $installations += $pageInstallations + $page++ + } while ($pageInstallations.Count -eq 100) +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect." + exit 1 +} +$installation = $installations | Where-Object { $_.account.login -ieq $InstallationOwner } | Select-Object -First 1 +if (-not $installation) { + $found = ($installations | ForEach-Object { $_.account.login }) -join ', ' + Write-PipelineTelemetryError -Category 'Build' -Message "No installation found for '$InstallationOwner'. App is installed on: $found" + exit 1 +} + +try { + $tokenResponse = Invoke-RestMethod ` + -Uri "https://api.github.com/app/installations/$($installation.id)/access_tokens" ` + -Headers $headers ` + -Method Post ` + -ContentType 'application/json' +} +catch { + Write-PipelineTelemetryError -Category 'Build' -Message "Failed to mint an installation access token for '$InstallationOwner' (installation $($installation.id)): $_" + exit 1 +} + +Write-Host "Got installation token for '$InstallationOwner' (expires $($tokenResponse.expires_at))." +if ($OutputVariableName) { + Write-Host "Setting pipeline variable '$OutputVariableName'." + Write-Host "##vso[task.setvariable variable=$OutputVariableName;issecret=true]$($tokenResponse.token)" +} +else { + Write-Host $tokenResponse.token -ForegroundColor Green +} diff --git a/eng/common/core-templates/steps/get-github-app-token.yml b/eng/common/core-templates/steps/get-github-app-token.yml new file mode 100644 index 00000000000..6d42a48d3c3 --- /dev/null +++ b/eng/common/core-templates/steps/get-github-app-token.yml @@ -0,0 +1,79 @@ +# Mints a short-lived GitHub App installation access token by signing a JWT +# with a private key stored in Azure Key Vault (RSA, RS256). The JWT is +# exchanged with the GitHub API for a token scoped to a single installation. +# +# Requirements (per GitHub App you want to authenticate as): +# - A GitHub App with its private key uploaded into Key Vault as an RSA key +# (PEM converted to a key, NOT stored as a secret). +# - The Azure service connection passed via `azureSubscription` must be +# granted the `Key Vault Crypto User` role (or at minimum `Sign` action) +# on that key. +# - The App must be installed on the target organization/account +# (`installationOwner`) with the permissions/repositories you need. +# +# Output: a secret pipeline variable named ${{ parameters.outputVariableName }} +# containing the installation access token. Token lifetime is ~1 hour and is +# automatically scrubbed from logs. Installation tokens are exempt from the +# enterprise classic-PAT lifetime policy. + +parameters: +# Azure DevOps service connection (federated) that can call +# `az keyvault key sign` on the App's signing key. +- name: azureSubscription + type: string + +# Name of the Key Vault that holds the GitHub App's RSA signing key. +- name: keyVaultName + type: string + +# Name of the RSA key inside the Key Vault (the App's private key). +- name: keyName + type: string + +# The GitHub App's Client ID (the value to put in the `iss` JWT claim). +# Prefer this over the numeric App ID; GitHub accepts either, but Client ID +# is the documented form going forward. +- name: appClientId + type: string + +# Login of the organization or user account whose installation we should +# mint the token for (e.g. `dotnet`, `microsoft`). +- name: installationOwner + type: string + +# Name of the pipeline variable that will receive the installation token. +- name: outputVariableName + type: string + +- name: is1ESPipeline + type: boolean + +- name: stepName + type: string + default: getGitHubAppInstallationToken + +- name: condition + type: string + default: '' + +- name: displayName + type: string + default: Get GitHub App installation token + +steps: +- task: AzureCLI@2 + displayName: ${{ parameters.displayName }} + name: ${{ parameters.stepName }} + ${{ if ne(parameters.condition, '') }}: + condition: ${{ parameters.condition }} + inputs: + azureSubscription: ${{ parameters.azureSubscription }} + scriptType: pscore + scriptLocation: inlineScript + inlineScript: | + & "$(System.DefaultWorkingDirectory)/eng/common/Get-GitHubAppToken.ps1" ` + -KeyVaultName '${{ parameters.keyVaultName }}' ` + -KeyName '${{ parameters.keyName }}' ` + -AppClientId '${{ parameters.appClientId }}' ` + -InstallationOwner '${{ parameters.installationOwner }}' ` + -OutputVariableName '${{ parameters.outputVariableName }}' diff --git a/eng/common/templates-official/steps/get-github-app-token.yml b/eng/common/templates-official/steps/get-github-app-token.yml new file mode 100644 index 00000000000..c89f3641a4d --- /dev/null +++ b/eng/common/templates-official/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: true + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/eng/common/templates/job/execute-sdl.yml b/eng/common/templates/job/execute-sdl.yml index 28ccaaa4820..89f1b31bc55 100644 --- a/eng/common/templates/job/execute-sdl.yml +++ b/eng/common/templates/job/execute-sdl.yml @@ -36,7 +36,6 @@ jobs: displayName: Run SDL tool condition: and(succeededOrFailed(), eq( ${{ parameters.enable }}, 'true')) variables: - - group: DotNet-VSTS-Bot - name: AzDOProjectName value: ${{ parameters.AzDOProjectName }} - name: AzDOPipelineId diff --git a/eng/common/templates/steps/get-github-app-token.yml b/eng/common/templates/steps/get-github-app-token.yml new file mode 100644 index 00000000000..79e182c6416 --- /dev/null +++ b/eng/common/templates/steps/get-github-app-token.yml @@ -0,0 +1,7 @@ +steps: +- template: /eng/common/core-templates/steps/get-github-app-token.yml + parameters: + is1ESPipeline: false + + ${{ each parameter in parameters }}: + ${{ parameter.key }}: ${{ parameter.value }} diff --git a/global.json b/global.json index 32f2bb283c9..54507e64eb6 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "8.0.126" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26405.8" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26410.9" } } From 33e36c316a4a09931e0c52dac2ffad122f292c45 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 13:55:01 -0700 Subject: [PATCH 8/8] [release/8.0.4xx] Update dependencies from dotnet/arcade (#10426) This pull request updates the following dependencies [marker]: <> (Begin:20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) ## From https://github.com/dotnet/arcade - **Subscription**: [20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf](https://maestro.dot.net/subscriptions?search=20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) - **Build**: [20260811.4](https://dev.azure.com/dnceng/internal/_build/results?buildId=3044932) ([326584](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/326584)) - **Date Produced**: August 11, 2026 5:16:20 PM UTC - **Commit**: [7945b1b660dff1927e4d71aca0a11e5d067ba4a5](https://github.com/dotnet/arcade/commit/7945b1b660dff1927e4d71aca0a11e5d067ba4a5) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [8.0.0-beta.26410.9 to 8.0.0-beta.26411.4][1] - Microsoft.DotNet.Arcade.Sdk [1]: https://github.com/dotnet/arcade/compare/0992a0f871...7945b1b660 [DependencyUpdate]: <> (End) [marker]: <> (End:20c4d86a-e5ce-445f-1cbe-08dc5a6a3fdf) Co-authored-by: dotnet-maestro[bot] --- eng/Version.Details.xml | 4 ++-- eng/common/Get-GitHubAppToken.ps1 | 18 ++++++++++++++---- global.json | 2 +- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index c0bece00161..9e5e3b9a8f2 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -17,9 +17,9 @@ - + https://github.com/dotnet/arcade - 0992a0f871c48ccc32eaa49ad89fea8022b8f597 + 7945b1b660dff1927e4d71aca0a11e5d067ba4a5 diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1 index 648035a3ecf..ded1a6595cc 100644 --- a/eng/common/Get-GitHubAppToken.ps1 +++ b/eng/common/Get-GitHubAppToken.ps1 @@ -104,10 +104,13 @@ try { $installations = @() $page = 1 do { - $pageInstallations = @(Invoke-RestMethod ` + # Assign the response before wrapping it in @(). PowerShell otherwise + # preserves a top-level JSON array as one nested pipeline object. + $pageResponse = Invoke-RestMethod ` -Uri "https://api.github.com/app/installations?per_page=100&page=$page" ` -Headers $headers ` - -Method Get) + -Method Get + $pageInstallations = @($pageResponse) $installations += $pageInstallations $page++ } while ($pageInstallations.Count -eq 100) @@ -116,12 +119,19 @@ catch { Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect." exit 1 } -$installation = $installations | Where-Object { $_.account.login -ieq $InstallationOwner } | Select-Object -First 1 -if (-not $installation) { +$matchingInstallations = @($installations | Where-Object { $_.account.login -ieq $InstallationOwner }) +if ($matchingInstallations.Count -eq 0) { $found = ($installations | ForEach-Object { $_.account.login }) -join ', ' Write-PipelineTelemetryError -Category 'Build' -Message "No installation found for '$InstallationOwner'. App is installed on: $found" exit 1 } +if ($matchingInstallations.Count -ne 1) { + $matchingIds = ($matchingInstallations | ForEach-Object { $_.id }) -join ', ' + Write-PipelineTelemetryError -Category 'Build' -Message "Found multiple installations for '$InstallationOwner': $matchingIds" + exit 1 +} +$installation = $matchingInstallations[0] +Write-Host "Using installation $($installation.id) for '$($installation.account.login)'." try { $tokenResponse = Invoke-RestMethod ` diff --git a/global.json b/global.json index 54507e64eb6..d73d4ce63f9 100644 --- a/global.json +++ b/global.json @@ -3,6 +3,6 @@ "dotnet": "8.0.126" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26410.9" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.26411.4" } }