[main] Update dependencies to ensure coherency

NuGet.config

@@ -23,6 +23,14 @@
     <!--  End: Package sources from dotnet-aspnetcore -->
     <!--  Begin: Package sources from dotnet-emsdk -->
     <add key="darc-pub-dotnet-emsdk-78f6f07" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-8" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-8/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-7/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-6" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-6/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-5" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-5/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-4" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-4/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-3" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-3/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-2" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-2/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-78f6f07-1" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-78f6f07d-1/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-emsdk -->
     <!--  Begin: Package sources from dotnet-maui -->
     <!--  End: Package sources from dotnet-maui -->

eng/Version.Details.xml

@@ -31,13 +31,13 @@
     </Dependency>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.25210.1">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="10.0.0-beta.25259.2">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>490307dc9bb09caf016b2fa96005ac8aaa89c4e7</Sha>
+      <Sha>80c4e4d26cb85c86f7e1be77d2d9eceeef0f3493</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="10.0.0-beta.25210.1">
+    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="10.0.0-beta.25259.2">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>490307dc9bb09caf016b2fa96005ac8aaa89c4e7</Sha>
+      <Sha>80c4e4d26cb85c86f7e1be77d2d9eceeef0f3493</Sha>
     </Dependency>
     <Dependency Name="Microsoft.DotNet.XHarness.CLI" Version="10.0.0-prerelease.25207.6">
       <Uri>https://github.com/dotnet/xharness</Uri>

eng/common/build.sh

@@ -136,7 +136,7 @@ while [[ $# > 0 ]]; do
       restore=true
       pack=true
       ;;
-    -productBuild|-pb)
+    -productbuild|-pb)
       build=true
       product_build=true
       restore=true

eng/common/core-templates/job/source-build.yml

@@ -27,6 +27,8 @@ parameters:
   #   Specifies the build script to invoke to perform the build in the repo. The default
   #   './build.sh' should work for typical Arcade repositories, but this is customizable for
   #   difficult situations.
+  # buildArguments: ''
+  #   Specifies additional build arguments to pass to the build script.
   # jobProperties: {}
   #   A list of job properties to inject at the top level, for potential extensibility beyond
   #   container and pool.

eng/common/core-templates/jobs/jobs.yml

@@ -27,6 +27,9 @@ parameters:
   # Optional: Publish the assets as soon as the publish to BAR stage is complete, rather doing so in a separate stage.
   publishAssetsImmediately: false
 
+  # Optional: 🌤️ or not the build has assets it wants to publish to BAR
+  isAssetlessBuild: false
+
   # Optional: If using publishAssetsImmediately and additional parameters are needed, can be used to send along additional parameters (normally sent to post-build.yml)
   artifactsPublishingAdditionalParameters: ''
   signingValidationAdditionalParameters: ''
@@ -93,7 +96,7 @@ jobs:
         ${{ parameter.key }}: ${{ parameter.value }}
 
 - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-  - ${{ if or(eq(parameters.enablePublishBuildAssets, true), eq(parameters.artifacts.publish.manifests, 'true'), ne(parameters.artifacts.publish.manifests, '')) }}:
+  - ${{ if or(eq(parameters.enablePublishBuildAssets, true), eq(parameters.artifacts.publish.manifests, 'true'), ne(parameters.artifacts.publish.manifests, ''), eq(parameters.isAssetlessBuild, true)) }}:
     - template: ../job/publish-build-assets.yml
       parameters:
         is1ESPipeline: ${{ parameters.is1ESPipeline }}
@@ -109,7 +112,8 @@ jobs:
           - Source_Build_Complete
 
         runAsPublic: ${{ parameters.runAsPublic }}
-        publishAssetsImmediately: ${{ parameters.publishAssetsImmediately }}
+        publishAssetsImmediately: ${{ or(parameters.publishAssetsImmediately, parameters.isAssetlessBuild) }}
+        isAssetlessBuild: ${{ parameters.isAssetlessBuild }}
         enablePublishBuildArtifacts: ${{ parameters.enablePublishBuildArtifacts }}
         artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }}
         signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }}

eng/common/core-templates/jobs/source-build.yml

@@ -14,7 +14,7 @@ parameters:
   # This is the default platform provided by Arcade, intended for use by a managed-only repo.
   defaultManagedPlatform:
     name: 'Managed'
-    container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9'
+    container: 'mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream-10-amd64'
 
   # Defines the platforms on which to run build jobs. One job is created for each platform, and the
   # object in this array is sent to the job template as 'platform'. If no platforms are specified,

eng/common/core-templates/steps/install-microbuild.yml

@@ -11,30 +11,6 @@ parameters:
 steps:
   - ${{ if eq(parameters.enableMicrobuild, 'true') }}:
     - ${{ if eq(parameters.enableMicrobuildForMacAndLinux, 'true') }}:
-      # Install Python 3.12.x on when Python > 3.12.x is installed - https://github.com/dotnet/source-build/issues/4802
-      - script: |
-          version=$(python3 --version | awk '{print $2}')
-          major=$(echo $version | cut -d. -f1)
-          minor=$(echo $version | cut -d. -f2)
-
-          installPython=false
-          if [ "$major" -gt 3 ] || { [ "$major" -eq 3 ] && [ "$minor" -gt 12 ]; }; then
-            installPython=true
-          fi
-
-          echo "Python version: $version."
-          echo "Install Python 3.12.x: $installPython."
-          echo "##vso[task.setvariable variable=installPython;isOutput=true]$installPython"
-        name: InstallPython
-        displayName: 'Determine Python installation'
-        condition: and(succeeded(), ne(variables['Agent.Os'], 'Windows_NT'))
-
-      - task: UsePythonVersion@0
-        inputs:
-          versionSpec: '3.12.x'
-        displayName: 'Use Python 3.12.x'
-        condition: and(succeeded(), eq(variables['InstallPython.installPython'], 'true'), ne(variables['Agent.Os'], 'Windows_NT'))
-
       # Needed to download the MicroBuild plugin nupkgs on Mac and Linux when nuget.exe is unavailable
       - task: UseDotNet@2
         displayName: Install .NET 8.0 SDK for MicroBuild Plugin
@@ -91,8 +67,18 @@ steps:
           script: |
             Write-Host "Copying Linux Path"
             $MBSIGN_APPFOLDER = '$(MBSIGN_APPFOLDER)'
-            $MBSIGN_APPFOLDER = $MBSIGN_APPFOLDER -replace '/build', ''
-            $MBSIGN_APPFOLDER = $MBSIGN_APPFOLDER + '/1.1.1032' + '/build'
+            $MBSIGN_APPFOLDER = ($MBSIGN_APPFOLDER -replace '/build', '')
+
+            $versionRegex = '\d+\.\d+\.\d+'
+            $package = Get-ChildItem -Path $MBSIGN_APPFOLDER -Directory |
+              Where-Object { $_.Name -match $versionRegex }
+
+            if ($package.Count -ne 1) {
+                Write-Host "There should be exactly one matching subfolder, but found $($package.Count)."
+                exit 1
+            }
+
+            $MBSIGN_APPFOLDER = $package[0].FullName + '/build'
             $MBSIGN_APPFOLDER | Write-Host
             $SignConfigPath = $MBSIGN_APPFOLDER + '/signconfig.xml'
             Copy-Item -Path "$(MBSIGN_APPFOLDER)/signconfig.xml" -Destination $SignConfigPath -Force

eng/common/core-templates/steps/source-build.yml

@@ -19,19 +19,6 @@ steps:
     set -x
     df -h
 
-    # If file changes are detected, set CopyWipIntoInnerSourceBuildRepo to copy the WIP changes into the inner source build repo.
-    internalRestoreArgs=
-    if ! git diff --quiet; then
-      internalRestoreArgs='/p:CopyWipIntoInnerSourceBuildRepo=true'
-      # The 'Copy WIP' feature of source build uses git stash to apply changes from the original repo.
-      # This only works if there is a username/email configured, which won't be the case in most CI runs.
-      git config --get user.email
-      if [ $? -ne 0 ]; then
-        git config user.email [email protected]
-        git config user.name dn-bot
-      fi
-    fi
-
     # If building on the internal project, the internal storage variable may be available (usually only if needed)
     # In that case, add variables to allow the download of internal runtimes if the specified versions are not found
     # in the default public locations.
@@ -46,11 +33,6 @@ steps:
       buildConfig='$(_BuildConfig)'
     fi
 
-    officialBuildArgs=
-    if [ '${{ and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}' = 'True' ]; then
-      officialBuildArgs='/p:DotNetPublishUsingPipelines=true /p:OfficialBuildId=$(BUILD.BUILDNUMBER)'
-    fi
-
     targetRidArgs=
     if [ '${{ parameters.platform.targetRID }}' != '' ]; then
       targetRidArgs='/p:TargetRid=${{ parameters.platform.targetRID }}'
@@ -66,68 +48,31 @@ steps:
       baseOsArgs='/p:BaseOS=${{ parameters.platform.baseOS }}'
     fi
 
-    publishArgs=
-    if [ '${{ parameters.platform.skipPublishValidation }}' != 'true' ]; then
-      publishArgs='--publish'
-    fi
-
-    assetManifestFileName=SourceBuild_RidSpecific.xml
-    if [ '${{ parameters.platform.name }}' != '' ]; then
-      assetManifestFileName=SourceBuild_${{ parameters.platform.name }}.xml
-    fi
-
     portableBuildArgs=
     if [ '${{ parameters.platform.portableBuild }}' != '' ]; then
       portableBuildArgs='/p:PortableBuild=${{ parameters.platform.portableBuild }}'
     fi
 
     ${{ coalesce(parameters.platform.buildScript, './build.sh') }} --ci \
       --configuration $buildConfig \
-      --restore --build --pack $publishArgs -bl \
-      $officialBuildArgs \
+      --restore --build --pack -bl \
+      ${{ parameters.platform.buildArguments }} \
       $internalRuntimeDownloadArgs \
-      $internalRestoreArgs \
       $targetRidArgs \
       $runtimeOsArgs \
       $baseOsArgs \
       $portableBuildArgs \
       /p:DotNetBuildSourceOnly=true \
       /p:DotNetBuildRepo=true \
-      /p:AssetManifestFileName=$assetManifestFileName
   displayName: Build
 
-# Upload build logs for diagnosis.
-- task: CopyFiles@2
-  displayName: Prepare BuildLogs staging directory
-  inputs:
-    SourceFolder: '$(Build.SourcesDirectory)'
-    Contents: |
-      **/*.log
-      **/*.binlog
-      artifacts/sb/prebuilt-report/**
-    TargetFolder: '$(Build.StagingDirectory)/BuildLogs'
-    CleanTargetFolder: true
-  continueOnError: true
-  condition: succeededOrFailed()
-
 - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
   parameters:
     is1ESPipeline: ${{ parameters.is1ESPipeline }}
     args:
       displayName: Publish BuildLogs
-      targetPath: '$(Build.StagingDirectory)/BuildLogs'
+      targetPath: artifacts/log/${{ coalesce(variables._BuildConfig, 'Release') }}
       artifactName: BuildLogs_SourceBuild_${{ parameters.platform.name }}_Attempt$(System.JobAttempt)
       continueOnError: true
       condition: succeededOrFailed()
       sbomEnabled: false  # we don't need SBOM for logs
-
-# Manually inject component detection so that we can ignore the source build upstream cache, which contains
-# a nupkg cache of input packages (a local feed).
-# This path must match the upstream cache path in property 'CurrentRepoSourceBuiltNupkgCacheDir'
-# in src\Microsoft.DotNet.Arcade.Sdk\tools\SourceBuild\SourceBuildArcade.targets
-- template: /eng/common/core-templates/steps/component-governance.yml
-  parameters:
-    displayName: Component Detection (Exclude upstream cache)
-    is1ESPipeline: ${{ parameters.is1ESPipeline }}
-    componentGovernanceIgnoreDirectories: '$(Build.SourcesDirectory)/artifacts/sb/src/artifacts/obj/source-built-upstream-cache'
-    disableComponentGovernance: ${{ eq(variables['System.TeamProject'], 'public') }}

eng/common/core-templates/steps/source-index-stage1-publish.yml

@@ -1,6 +1,6 @@
 parameters:
-  sourceIndexUploadPackageVersion: 2.0.0-20240522.1
-  sourceIndexProcessBinlogPackageVersion: 1.0.1-20240522.1
+  sourceIndexUploadPackageVersion: 2.0.0-20250425.2
+  sourceIndexProcessBinlogPackageVersion: 1.0.1-20250425.2
   sourceIndexPackageSource: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json
   binlogPath: artifacts/log/Debug/Build.binlog
 

eng/common/darc-init.sh

@@ -68,7 +68,7 @@ function InstallDarcCli {
     fi
   fi
 
-  local arcadeServicesSource="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json"
+  local arcadeServicesSource="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json"
 
   echo "Installing Darc CLI version $darcVersion..."
   echo "You may need to restart your command shell if this is the first dotnet tool you have installed."

eng/common/sdk-task.ps1

@@ -6,12 +6,13 @@ Param(
   [string] $msbuildEngine = $null,
   [switch] $restore,
   [switch] $prepareMachine,
+  [switch][Alias('nobl')]$excludeCIBinaryLog,
   [switch] $help,
   [Parameter(ValueFromRemainingArguments=$true)][String[]]$properties
 )
 
 $ci = $true
-$binaryLog = $true
+$binaryLog = if ($excludeCIBinaryLog) { $false } else { $true }
 $warnAsError = $true
 
 . $PSScriptRoot\tools.ps1
@@ -27,17 +28,19 @@ function Print-Usage() {
   Write-Host "Advanced settings:"
   Write-Host "  -prepareMachine         Prepare machine for CI run"
   Write-Host "  -msbuildEngine <value>  Msbuild engine to use to run build ('dotnet', 'vs', or unspecified)."
+  Write-Host "  -excludeCIBinaryLog     When running on CI, allow no binary log (short: -nobl)"
   Write-Host ""
   Write-Host "Command line arguments not listed above are passed thru to msbuild."
 }
 
 function Build([string]$target) {
   $logSuffix = if ($target -eq 'Execute') { '' } else { ".$target" }
   $log = Join-Path $LogDir "$task$logSuffix.binlog"
+  $binaryLogArg = if ($binaryLog) { "/bl:$log" } else { "" }
   $outputPath = Join-Path $ToolsetDir "$task\"
 
   MSBuild $taskProject `
-    /bl:$log `
+    $binaryLogArg `
     /t:$target `
     /p:Configuration=$configuration `
     /p:RepoRoot=$RepoRoot `

eng/common/sdk-task.sh

@@ -7,6 +7,10 @@ show_usage() {
     echo "  --verbosity <value>      Msbuild verbosity: q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]"
     echo "  --help                   Print help and exit"
     echo ""
+
+    echo "Advanced settings:"
+    echo "  --excludeCIBinarylog     Don't output binary log (short: -nobl)"
+    echo ""
     echo "Command line arguments not listed above are passed thru to msbuild."
 }
 
@@ -27,10 +31,12 @@ Build() {
     local log_suffix=""
     [[ "$target" != "Execute" ]] && log_suffix=".$target"
     local log="$log_dir/$task$log_suffix.binlog"
+    local binaryLogArg=""
+    [[ $binary_log == true ]] && binaryLogArg="/bl:$log"
     local output_path="$toolset_dir/$task/"
 
     MSBuild "$taskProject" \
-        /bl:"$log" \
+        $binaryLogArg \
         /t:"$target" \
         /p:Configuration="$configuration" \
         /p:RepoRoot="$repo_root" \
@@ -39,8 +45,10 @@ Build() {
         $properties
 }
 
+binary_log=true
 configuration="Debug"
 verbosity="minimal"
+exclude_ci_binary_log=false
 restore=false
 help=false
 properties=''
@@ -60,6 +68,11 @@ while (($# > 0)); do
       verbosity=$2
       shift 2
       ;;
+    --excludecibinarylog|--nobl)
+      binary_log=false
+      exclude_ci_binary_log=true
+      shift 1
+      ;;
     --help)
       help=true
       shift 1
@@ -72,7 +85,6 @@ while (($# > 0)); do
 done
 
 ci=true
-binaryLog=true
 warnAsError=true
 
 if $help; then

eng/common/sdl/packages.config

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
-  <package id="Microsoft.Guardian.Cli" version="0.109.0"/>
+  <package id="Microsoft.Guardian.Cli" version="0.199.0"/>
 </packages>

global.json

@@ -1,15 +1,15 @@
 {
   "sdk": {
-    "version": "10.0.100-preview.3.25167.3",
+    "version": "10.0.100-preview.3.25201.16",
     "allowPrerelease": true,
     "rollForward": "major"
   },
   "tools": {
-    "dotnet": "10.0.100-preview.3.25167.3"
+    "dotnet": "10.0.100-preview.3.25201.16"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.25210.1",
-    "Microsoft.DotNet.Helix.Sdk": "10.0.0-beta.25210.1"
+    "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.25259.2",
+    "Microsoft.DotNet.Helix.Sdk": "10.0.0-beta.25259.2"
   },
   "native-tools": {
     "python3": "3.7.1"

src/arcade/eng/common/BuildConfiguration/build-configuration.json

@@ -0,0 +1,4 @@
+{
+  "RetryCountLimit": 1,
+  "RetryByAnyError": false
+}

src/arcade/eng/common/PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,11 @@
+@{
+    IncludeRules=@('PSAvoidUsingCmdletAliases',
+                   'PSAvoidUsingWMICmdlet',
+                   'PSAvoidUsingPositionalParameters',
+                   'PSAvoidUsingInvokeExpression',
+                   'PSUseDeclaredVarsMoreThanAssignments',
+                   'PSUseCmdletCorrectly',
+                   'PSStandardDSCFunctionsInResource',
+                   'PSUseIdenticalMandatoryParametersForDSC',
+                   'PSUseIdenticalParametersForDSC')
+}