[release/10.0.1xx] Backport remaining CFSClean fixes - #12396
Open
jonathanpeppers wants to merge 5 commits into
Open
[release/10.0.1xx] Backport remaining CFSClean fixes#12396jonathanpeppers wants to merge 5 commits into
jonathanpeppers wants to merge 5 commits into
Conversation
CFSClean reports network-isolation warnings when tests and CI tooling resolve packages directly from public NuGet endpoints. Route those package downloads through the existing dnceng `dotnet-public` Azure Artifacts feed and rely on the repository `NuGet.config` for generated test projects and the API-docs tool installation. Direct `.nupkg` test downloads now use the feed's V3 package base address, while obsolete `ExtraNuGetConfigSources` public overrides are removed. No fallback to nuget.org is retained. `Xamarin.Google.Android.InstallReferrer` 1.1.2.6 is not currently mirrored to `dotnet-public`; `InstallAndRunTests.GradleFBProj` will require that package to be mirrored. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Internal [build 14925232](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14925232) reported CFSClean violations during **Create MAUI template**. The pipeline needs to suppress three independent .NET network paths: 1. `DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=true` prevents background workload advertising-manifest updates. 2. `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` prevents the .NET CLI's separate background SDK release/vulnerability/EOL metadata refresh. The SDK invokes this refresh from restoring commands such as `dotnet build` and `dotnet restore`. 3. `NuGetAudit=false` disables NuGet restore's package-advisory lookup. This is a distinct MSBuild property and does not replace the SDK-level variable. The immediate MAUI violation came from `dotnet new maui`, which runs a restore post-action by default. That restore had no project-specific `NuGet.config`, so it contacted public NuGet and workload advertising-manifest hosts. Passing `--no-restore` creates the template without running that post-action. This does not remove the intended MAUI restore/build. The following Debug and Release build steps remain unchanged and explicitly pass `--configfile $(Build.SourcesDirectory)/maui/NuGet.config`, keeping package acquisition on the configured sources. Disabling these metadata checks also does not disable package hash/signature validation; it prevents external metadata lookups in network-isolated jobs. - Retain `DOTNET_SDK_VULNERABILITY_CHECK_DISABLE=true` and add `NuGetAudit=false` alongside it in shared pipeline variables and the internal override. - Add `--no-restore` to MAUI template creation in the main, public, and internal pipeline definitions. - Parsed all changed YAML files successfully. - Ran `git diff --check`. - Verified every MAUI template-creation variant uses `--no-restore`. - Verified all three isolation controls remain present where expected. - Verified `dotnet new --no-restore` creates a project without producing a restore assets file. - Confirmed the separate SDK behavior in [`RestoringCommand`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/Commands/Restore/RestoringCommand.cs) and [`SdkReleaseMetadataCache`](https://github.com/dotnet/sdk/blob/8795d0128cf1efbb900edd5cfbd8e9789be10653/src/Cli/dotnet/SdkVulnerability/SdkReleaseMetadataCache.cs). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- declare the standard `skipRestore` symbol in every Android project template - map `skipRestore` to the user-facing `--no-restore` option through each template's `dotnetcli.host.json` - prevent `XASdkTests.DotNetNew` from restoring generated projects implicitly - copy the repository `NuGet.config` into generated projects before builds restore - route `AndroidMavenLibrary` items with blank repository metadata through `dotnet-public-maven` in test scope `--no-restore` is presented as a standard `dotnet new` option, but project templates must opt into accepting it by declaring a `skipRestore` boolean symbol and mapping that symbol to `--no-restore` in `dotnetcli.host.json`. This follows the symbol/mapping convention used by the .NET SDK and .NET MAUI templates. The Android templates intentionally do not add a restore post-action. They therefore preserve their existing default behavior and avoid restoring before test call sites configure approved package versions and feeds. The new option lets `XASdkTests` explicitly document and enforce that expectation before copying the repository `NuGet.config` into generated projects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Depends on #12336. The Windows template smoke project is generated under `$(Build.StagingDirectory)`, outside the repository `NuGet.config` hierarchy. Its implicit build restore therefore falls back to the agent's machine NuGet configuration and may access unapproved package feeds. - Pass `RestoreConfigFile=$(System.DefaultWorkingDirectory)\NuGet.config` to the template build. - Quote the template creation and build staging paths using Windows path syntax. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
`CodeBehindTests` passed a file path to `CopyNuGetConfig`, which expects a directory and appends `NuGet.config`. This placed the repository configuration in a nested path, so generated projects could miss it and contact external package feeds. Pass the temporary project root instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
Member
Author
|
/azp run |
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. |
Contributor
There was a problem hiding this comment.
Pull request overview
Backport of remaining CFSClean-related changes from main to release/10.0.1xx, focusing on keeping NuGet/Maven access on approved mirrors/feeds and preventing implicit restores from contacting public endpoints in CI and test scenarios.
Changes:
- Remove direct
nuget.orgusage in tests/pipelines and switch package downloads todotnet-publicfeed URLs. - Add
--no-restoreflows and template support (skipRestore+dotnetcli.host.jsonmapping) to prevent implicit restore network access. - Fix NuGet.config placement/copying in test scenarios and add a small MSBuild target override for Maven repository metadata in test scope.
Reviewed changes
Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/MSBuildDeviceIntegration/Tests/InstallAndRunTests.cs | Removes explicit api.nuget.org override to rely on repo-approved feeds. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Common/DotNetCLI.cs | Adds noRestore option for dotnet new invocation in tests. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/XASdkTests.cs | Uses dotnet new --no-restore, copies repo NuGet.config, and applies Maven repo override for wear template builds. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/Tasks/FilterAssembliesTests.cs | Downloads .nupkg directly from dotnet-public flat container and adds a lowercase URL test. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/dotnet-public-maven.targets | Adds a test-only target to default empty AndroidMavenLibrary.Repository metadata to dotnet-public-maven. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/CodeBehindTests.cs | Fixes CopyNuGetConfig call to pass a directory rather than a file path. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest.cs | Removes explicit api.nuget.org override to rely on repo-approved feeds. |
| src/Microsoft.Android.Templates/androidlib/.template.config/template.json | Adds skipRestore symbol so --no-restore can be wired through. |
| src/Microsoft.Android.Templates/androidlib/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for dotnet new. |
| src/Microsoft.Android.Templates/android/.template.config/template.json | Adds skipRestore symbol so --no-restore can be wired through. |
| src/Microsoft.Android.Templates/android/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for dotnet new. |
| src/Microsoft.Android.Templates/android-wear/.template.config/template.json | Adds skipRestore symbol so --no-restore can be wired through. |
| src/Microsoft.Android.Templates/android-wear/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for dotnet new. |
| src/Microsoft.Android.Templates/android-bindinglib/.template.config/template.json | Adds skipRestore symbol so --no-restore can be wired through. |
| src/Microsoft.Android.Templates/android-bindinglib/.template.config/dotnetcli.host.json | Maps skipRestore to --no-restore for dotnet new. |
| build-tools/automation/yaml-templates/variables.yaml | Adds CI variables to disable workload update notify, SDK vulnerability check, and NuGet audit. |
| build-tools/automation/yaml-templates/build-windows.yaml | Quotes staging paths and forces restore to use repo NuGet.config during template smoke build. |
| build-tools/automation/azure-pipelines.yaml | Adds --no-restore to MAUI template creation step. |
| build-tools/automation/azure-pipelines-apidocs.yaml | Removes --add-source https://api.nuget.org/v3/index.json from boots tool install. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
@dalexsoto review |
jonathanpeppers
added
the
ready-to-review
dalexsoto
approved these changes
Aug 16, 2026
dalexsoto
left a comment
dalexsoto
left a comment
Member
There was a problem hiding this comment.
The backport is complete for its stated non-Maven/Gradle scope, the changed execution and generated-artifact paths are consistent, and I found no source blocker. The remaining Azure failure is an unrelated DNS infrastructure failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports the remaining non-Maven/Gradle CFSClean fixes from
maintorelease/10.0.1xx, with release-specific conflict resolution that preserves files removed or consolidated on the release branch.Maven/Gradle backports #12199 (
466da4a84) and #12368 (adffb38fd) are intentionally excluded because they are being handled separately.Original changes
8df1e87799f175f4c3e227c20e7c616e63d5570f— Use dotnet-public for CI package resolution7ace3137a4fa04f5c3c67cc71b32f7b61c339243— Prevent isolated NuGet accessc09c89aa1f2e984c9eb37a2368d3b459568aab65— Keepdotnet newrestores on approved feeds13727e665929d7fd7fd9a03b5709ff179fcc6a3b— Use repo NuGet config for template smoke buildd57b8c42f131bd346a3c809da269ba18552272be— Fix CodeBehind NuGet config placementValidation
origin/release/10.0.1xxand the PR range contains exactly five backport commits.git diff --check origin/release/10.0.1xx...HEADdotnet build src\Microsoft.Android.Templates\Microsoft.Android.Templates.csproj -c Debug -p:RunningOnCI=true -v:minimal -nodeReuse:falseXamarin.Android.Build.Testsbuild; repository preparation was blocked after all three approved-feed runtime-pack restore attempts timed out.