Official build: validate + promote with the newly built Arcade (3/3)#17080
Open
mmitche wants to merge 20 commits into
Open
Official build: validate + promote with the newly built Arcade (3/3)#17080mmitche wants to merge 20 commits into
mmitche wants to merge 20 commits into
Conversation
…dateSdk switch The ValidateSdk stage already self-bootstraps arcade with the newly produced SDK. Change its rebuild from /p:Test=false to /p:RunNonHelixTestsOnly=true so it also runs the ported Arcade SDK validation RepoTests against the new SDK, and publish their results (enablePublishTestResults). Add a runValidateSdk escape hatch (default true), exposed at queue time in azure-pipelines.yml, that gates the whole ValidateSdk stage and its place in post-build publishDependsOn so a badly-broken arcade can still ship a fix. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…otnet#17046) Add a main-only PromoteWithNewArcade stage to the official build that replaces the promotion validation dotnet/arcade-validation performed. After the build's assets are published to '.NET Eng - Validation', eng/validation/promote-with-new-arcade.ps1: 1. creates a dev branch off the built commit and runs darc update-dependencies --id <BAR> to bump Arcade to the version this build produced, pushing it to the internal AzDO mirror; 2. promotes the build to 'General Testing' with --source-branch <devBranch> so darc runs the promotion (publishing) pipeline from that branch -> PublishArtifactsInManifest / Tasks.Feed come from the NEWLY BUILT Arcade, validating promotion with the new Arcade; 3. on success, adds the build to '.NET Eng - Latest' with --skip-assets-publishing; 4. cleans up the dev branch. The BAR build id is read from the ReleaseConfigs artifact; the AzDO mirror push uses a WIF-derived code-rw token. A usePrebuiltArcadeForPublishing parameter (default true) reverts to promoting with the current global.json Arcade. Main only: release branches keep using arcade-validation for this gate. NOTE: runs only in the internal official build; needs @dotnet/dnceng review and a real run to validate (not testable locally or in PR). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR is part 3 of removing the arcade -> arcade-validation promotion/validation gate by moving (1) SDK validation RepoTests into the internal official build’s ValidateSdk stage, and (2) main-branch promotion validation into a new stage that promotes using the newly built Arcade.
Changes:
- Add a
runValidateSdkqueue-time parameter to optionally gate theValidateSdkstage and its inclusion in post-build publishing dependencies. - Enable publishing of inline (non-Helix) RepoTests results from the
ValidateSdkstage. - Add a main-only
PromoteWithNewArcadestage and a neweng/validation/promote-with-new-arcade.ps1script to validate promotion using the newly built Arcade before adding the build to.NET Eng - Latest(with an escape hatch viausePrebuiltArcadeForPublishing).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| eng/validation/promote-with-new-arcade.ps1 | New promotion-validation script that creates a temporary branch bumped to the newly built Arcade and promotes from that branch. |
| eng/validate-sdk.yml | Enables publishing test results for the inline validation RepoTests executed in the ValidateSdk job. |
| eng/build.yml | Adds parameters and wires ValidateSdk gating plus a main-only PromoteWithNewArcade stage into the official pipeline. |
| azure-pipelines.yml | Exposes queue-time parameters to control ValidateSdk and “use prebuilt Arcade for publishing” behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+76
to
+79
| $sha = $buildJson.commit | ||
|
|
||
| $targetBranch = "validation/promote-arcade-$BuildId" | ||
| $repoUri = "https://dev.azure.com/$AzdoOrg/$AzdoProject/_git/$AzdoRepoName" |
Comment on lines
+64
to
+66
| # Escape hatch: promote to the final channel with the current (global.json) Arcade. | ||
| Write-Host "UsePrebuiltArcade is '$UsePrebuiltArcade': promoting build $BuildId to '$FinalChannel' with the current Arcade." | ||
| Add-BuildToChannel $FinalChannel @('--skip-assets-publishing') |
ViktorHofer
previously approved these changes
Jul 8, 2026
…eparate Latest promotion Addresses review feedback on the official-build validation design (dotnet#17046): - Do NOT run the RepoTests in the official build (revert ValidateSdk to /p:Test=false); the RepoTests run in the PR build only. - ValidateSdk stage now runs three validations of the newly produced SDK in parallel: * self-build (eng/validate-sdk.yml) - rebuild arcade with the new SDK, * signing (eng/validate-signing.yml) - sign a curated set of artifact types with the new SignTool (ported arcade-validation Resources + jobs, cross-OS, after update-packagesource bumps the new SDK), * promotion (eng/validate-promotion.yml)- validate promotion works with the new arcade. - Separate the promotion *test* from the final promotion: * eng/validation/validate-promotion.ps1 promotes to 'General Testing' from a branch bumped to the new arcade (uses the current build commit; no --publishing-infra-version) - part of ValidateSdk. * eng/validation/promote-to-latest.ps1 promotes to '.NET Eng - Latest' with the default arcade in a separate PromoteToLatest stage that runs on build success, gated on ValidateSdk only when it is enabled - so a build can still be promoted when validation is disabled. - Remove the usePrebuiltArcadeForPublishing parameter (the new-arcade-ness now lives only in the promotion test). Main only: release branches keep using dotnet/arcade-validation for promotion. NOTE: the signing and promotion validations run only in the internal official build and cannot be validated locally or in PR; they need @dotnet/dnceng review and a real run. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
Reworked per review:
Matches the agreed flow: build → publish to BAR → (if enabled) ValidateSdk {signing, self-build, promotion to General Testing with new arcade} → promote to |
Comment on lines
+69
to
+72
| buildArgs: -configuration $(_BuildConfig) | ||
| -prepareMachine | ||
| $(_InternalBuildArgs) | ||
| /p:Test=false |
Comment on lines
+66
to
+70
| & git commit -am "Update Arcade to the newly built version for promotion validation (BAR $BuildId)" | ||
| if ($LASTEXITCODE -ne 0) { throw "git commit failed." } | ||
|
|
||
| & git -c "http.extraheader=$authHeader" push origin HEAD | ||
| if ($LASTEXITCODE -ne 0) { throw "git push of '$targetBranch' failed." } |
Comment on lines
+60
to
+64
| - task: CopyFiles@2 | ||
| displayName: Stage signing test packages | ||
| inputs: | ||
| sourceFolder: $(Build.SourcesDirectory)\eng\validation\resources | ||
| targetFolder: $(Build.SourcesDirectory)\artifacts\packages\$(_BuildConfig)\NonShipping |
Comment on lines
+124
to
+128
| - task: CopyFiles@2 | ||
| displayName: Stage signing test packages | ||
| inputs: | ||
| sourceFolder: $(Build.SourcesDirectory)/eng/validation/resources | ||
| targetFolder: $(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/NonShipping |
Comment on lines
+182
to
+186
| - task: CopyFiles@2 | ||
| displayName: Stage signing test packages | ||
| inputs: | ||
| sourceFolder: $(Build.SourcesDirectory)/eng/validation/resources | ||
| targetFolder: $(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/NonShipping |
| parameters: | ||
| microbuildUseESRP: ${{ parameters.microbuildUseESRP }} | ||
| # Validate that build promotion works when driven by the newly built Arcade. | ||
| - template: /eng/validate-promotion.yml@self |
ViktorHofer
previously approved these changes
Jul 10, 2026
The signing-validation inputs already exist as SignTool unit-test resources (src/Microsoft.DotNet.SignTool.Tests/Resources), which is a superset of arcade-validation's set. Point eng/validate-signing.yml at that folder with a curated file list instead of duplicating the binaries under eng/validation/resources, and remove the duplicated resources. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mmitche
force-pushed
the
dev/arcade-validation-removal/official-build-validation
branch
from
80e1f36 to
e942b69
Compare
Member
Author
|
Per review: the signing-validation inputs already exist as SignTool unit-test resources ( |
Comment on lines
+62
to
+70
| # Bump Arcade (and coherent dependencies) to the versions this build produced. | ||
| & $darc update-dependencies --id $BuildId --azdev-pat $AzdoToken --ci | ||
| if ($LASTEXITCODE -ne 0) { throw "darc update-dependencies failed." } | ||
|
|
||
| & git commit -am "Update Arcade to the newly built version for promotion validation (BAR $BuildId)" | ||
| if ($LASTEXITCODE -ne 0) { throw "git commit failed." } | ||
|
|
||
| & git -c "http.extraheader=$authHeader" push origin HEAD | ||
| if ($LASTEXITCODE -ne 0) { throw "git push of '$targetBranch' failed." } |
The VSIX staging step was only on the Windows signing job; arcade-validation copies the .vsix inputs in all three OS jobs. Add it to Linux and macOS so their sign runs also exercise VSIX signing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
+141
to
+145
| inlineScript: > | ||
| ./eng/update-packagesource.ps1 | ||
| -gitHubPat $(BotAccount-dotnet-maestro-bot-PAT) | ||
| -packagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts | ||
| - task: CopyFiles@2 |
Comment on lines
+221
to
+225
| inlineScript: > | ||
| ./eng/update-packagesource.ps1 | ||
| -gitHubPat $(BotAccount-dotnet-maestro-bot-PAT) | ||
| -packagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts | ||
| - task: CopyFiles@2 |
Comment on lines
+62
to
+70
| # Bump Arcade (and coherent dependencies) to the versions this build produced. | ||
| & $darc update-dependencies --id $BuildId --azdev-pat $AzdoToken --ci | ||
| if ($LASTEXITCODE -ne 0) { throw "darc update-dependencies failed." } | ||
|
|
||
| & git commit -am "Update Arcade to the newly built version for promotion validation (BAR $BuildId)" | ||
| if ($LASTEXITCODE -ne 0) { throw "git commit failed." } | ||
|
|
||
| & git -c "http.extraheader=$authHeader" push origin HEAD | ||
| if ($LASTEXITCODE -ne 0) { throw "git push of '$targetBranch' failed." } |
…a parameters - promote-to-latest.ps1 was essentially a single 'darc add-build-to-channel' call; inline it into the PromoteToLatest stage (Get-Darc from tools.ps1) and remove the script. - Hoist the signing-validation package/VSIX copy lists into template parameters (signingTestPackages / signingTestVSIXes) so they are defined once and shared by all three jobs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mmitche
force-pushed
the
dev/arcade-validation-removal/official-build-validation
branch
from
d68bb46 to
efeb511
Compare
…not update-packagesource)
update-packagesource.ps1 relies on Windows-oriented tools.ps1 helpers (InitializeDotNetCli), which
throw on Linux/macOS ('The property Path cannot be found'), so the Linux/macOS signing jobs failed
before signing. The signing validation only needs the Arcade/Helix SDK versions bumped + the local
feed added (not a full coherent darc update), so add eng/validation/use-built-sdk.ps1 - a dependency
free, cross-platform script (pure global.json + NuGet.config edits) - and use it in all signing jobs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
+18
to
+27
| # Discover the produced Arcade SDK version from the built package. | ||
| $arcadePkg = Get-ChildItem -Path $PackagesSource -Recurse -Filter 'Microsoft.DotNet.Arcade.Sdk.*.nupkg' -ErrorAction SilentlyContinue | Select-Object -First 1 | ||
| if (-not $arcadePkg) { | ||
| throw "Could not find Microsoft.DotNet.Arcade.Sdk.*.nupkg under '$PackagesSource'." | ||
| } | ||
| if ($arcadePkg.Name -notmatch '^Microsoft\.DotNet\.Arcade\.Sdk\.(.+)\.nupkg$') { | ||
| throw "Unexpected Arcade SDK package name '$($arcadePkg.Name)'." | ||
| } | ||
| $version = $Matches[1] | ||
| Write-Host "Using locally built Arcade/Helix SDK version '$version'." |
| $globalJson = Get-Content -Path $globalJsonPath -Raw | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Arcade\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Helix\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| Set-Content -Path $globalJsonPath -Value $globalJson -NoNewline |
Comment on lines
+40
to
+52
| $nugetConfig = New-Object System.Xml.XmlDocument | ||
| $nugetConfig.PreserveWhitespace = $true | ||
| $nugetConfig.Load($nugetConfigPath) | ||
| $packageSources = $nugetConfig.SelectSingleNode("//packageSources") | ||
| $newSource = $nugetConfig.CreateElement("add") | ||
| $keyAttribute = $nugetConfig.CreateAttribute("key") | ||
| $keyAttribute.Value = "arcade-local" | ||
| $valueAttribute = $nugetConfig.CreateAttribute("value") | ||
| $valueAttribute.Value = $PackagesSource | ||
| $newSource.Attributes.Append($keyAttribute) | Out-Null | ||
| $newSource.Attributes.Append($valueAttribute) | Out-Null | ||
| $packageSources.AppendChild($newSource) | Out-Null | ||
| $nugetConfig.Save($nugetConfigPath) |
The promotion validation re-publishes the build via darc from a branch bumped to the newly built Arcade; that pipeline restores the new Arcade toolset from the build's channel feed. On dev/PR branches there is no default channel, so the build is in BAR but not on a restorable feed and the promotion build fails with 'Unable to find a valid package version'. Skip promotion validation when 'darc get-build' shows the build is not assigned to any channel (it runs on main, where the build gets a default channel). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
+18
to
+27
| # Discover the produced Arcade SDK version from the built package. | ||
| $arcadePkg = Get-ChildItem -Path $PackagesSource -Recurse -Filter 'Microsoft.DotNet.Arcade.Sdk.*.nupkg' -ErrorAction SilentlyContinue | Select-Object -First 1 | ||
| if (-not $arcadePkg) { | ||
| throw "Could not find Microsoft.DotNet.Arcade.Sdk.*.nupkg under '$PackagesSource'." | ||
| } | ||
| if ($arcadePkg.Name -notmatch '^Microsoft\.DotNet\.Arcade\.Sdk\.(.+)\.nupkg$') { | ||
| throw "Unexpected Arcade SDK package name '$($arcadePkg.Name)'." | ||
| } | ||
| $version = $Matches[1] | ||
| Write-Host "Using locally built Arcade/Helix SDK version '$version'." |
Comment on lines
+29
to
+35
| # Bump the msbuild-sdks versions in global.json (targeted replace to preserve formatting). | ||
| $globalJsonPath = Join-Path $repoRoot 'global.json' | ||
| $globalJson = Get-Content -Path $globalJsonPath -Raw | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Arcade\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Helix\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| Set-Content -Path $globalJsonPath -Value $globalJson -NoNewline | ||
| Write-Host "Updated Arcade/Helix SDK versions in '$globalJsonPath'." |
Comment on lines
+30
to
+34
| $releaseConfigs = Get-Content "$(System.DefaultWorkingDirectory)/release_configs/ReleaseConfigs.txt" | ||
| $barId = ($releaseConfigs | Select-Object -First 1).Trim() | ||
| if ([string]::IsNullOrEmpty($barId)) { Write-Error "Could not read BAR build id from ReleaseConfigs.txt"; exit 1 } | ||
| Write-Host "BAR build id: $barId" | ||
| Write-Host "##vso[task.setvariable variable=BARBuildId]$barId" |
Comment on lines
+125
to
+129
| $releaseConfigs = Get-Content "$(System.DefaultWorkingDirectory)/release_configs/ReleaseConfigs.txt" | ||
| $barId = ($releaseConfigs | Select-Object -First 1).Trim() | ||
| if ([string]::IsNullOrEmpty($barId)) { Write-Error "Could not read BAR build id from ReleaseConfigs.txt"; exit 1 } | ||
| Write-Host "BAR build id: $barId" | ||
| Write-Host "##vso[task.setvariable variable=BARBuildId]$barId" |
…solves
The local feed pointed at the artifacts root (build_stage_artifacts); the nupkgs are nested under
packages/<config>/{Shipping,NonShipping}, which a NuGet folder source / the MSBuild SDK resolver did
not resolve, so 'build -sign' failed with 'Unable to find a valid package version' when restoring the
newly built Arcade.Sdk. Add each distinct directory that contains *.nupkg as a flat NuGet feed.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
+76
to
+85
| - task: AzureCLI@2 | ||
| displayName: Update package source (use newly built SDK) | ||
| inputs: | ||
| azureSubscription: "Darc: Maestro Production" | ||
| scriptType: ps | ||
| scriptLocation: inlineScript | ||
| inlineScript: > | ||
| .\eng\validation\use-built-sdk.ps1 | ||
| -PackagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts | ||
| - task: CopyFiles@2 |
Comment on lines
+142
to
+151
| - task: AzureCLI@2 | ||
| displayName: Update package source (use newly built SDK) | ||
| inputs: | ||
| azureSubscription: "Darc: Maestro Production" | ||
| scriptType: pscore | ||
| scriptLocation: inlineScript | ||
| inlineScript: > | ||
| ./eng/validation/use-built-sdk.ps1 | ||
| -PackagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts | ||
| - task: CopyFiles@2 |
Comment on lines
+207
to
+216
| - task: AzureCLI@2 | ||
| displayName: Update package source (use newly built SDK) | ||
| inputs: | ||
| azureSubscription: "Darc: Maestro Production" | ||
| scriptType: pscore | ||
| scriptLocation: inlineScript | ||
| inlineScript: > | ||
| ./eng/validation/use-built-sdk.ps1 | ||
| -PackagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts | ||
| - task: CopyFiles@2 |
Comment on lines
+71
to
+75
| # darc is 'darc.exe' on Windows and 'darc' on Linux/macOS. Use a StrictMode-safe OS check | ||
| # ($IsWindows is unset in Windows PowerShell 5.1 and throws under Set-StrictMode). | ||
| $darcExecutable = if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([System.Runtime.InteropServices.OSPlatform]::Windows)) { "darc.exe" } else { "darc" } | ||
| # Note: --github-pat is only needed for coherency updates, which this does not perform. | ||
| & (Join-Path $DarcExe $darcExecutable) update-dependencies ` |
arcade's NuGet.config uses <packageSourceMapping> with a <clear/>, so the freshly built Microsoft.DotNet.Arcade.Sdk (a microsoft.* package) is only resolvable from sources that have a matching mapping pattern. The signing validation added the local artifact feeds as bare <add> sources with no mapping entry, so NuGet never consulted them and restore failed with "Unable to find a valid package version". Mirror the broad remote patterns (microsoft.* and *) on each local feed so it ties with the remotes: the local feed becomes eligible for the new SDK (which only it has) but, because it only ties, never blocks resolution of packages it does not contain. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
62
to
66
| Write-Host "Updating dependencies using Darc..." | ||
| $dotnetRoot = InitializeDotNetCli -install:$true | ||
| $DarcExe = "$dotnetRoot\tools" | ||
| $DarcExe = Join-Path $dotnetRoot "tools" | ||
| Create-Directory $DarcExe | ||
| $DarcExe = Resolve-Path $DarcExe |
Comment on lines
+1
to
+5
| # Validates that the *newly built* Arcade SDK's SignTool can sign a curated set of artifact types | ||
| # (packages, VSIXes, .deb/.rpm/.pkg, loose assemblies, nested containers, ...). Ported from | ||
| # dotnet/arcade-validation's Validate_Signing_{Windows,Linux,MacOS} jobs, with an added step that | ||
| # bootstraps the newly produced SDK (update-packagesource) before signing so the new SignTool is used. | ||
| # |
Comment on lines
+14
to
+16
| # NOTE: real signing uses MicroBuild/ESRP and only runs in the internal official build; not testable | ||
| # locally or in PR. Needs @dotnet/dnceng review and a real official-build run to confirm (especially | ||
| # the cross-platform update-packagesource and Mac/Linux real-signing wiring). |
ViktorHofer
previously approved these changes
Jul 10, 2026
The channel gate read $buildJson.channels directly, but darc get-build omits the channels property from its JSON when the build is assigned to no channel (the dev/PR-branch case the gate is meant to detect). Under Set-StrictMode -Version 2.0 that missing-property access throws "The property 'channels' cannot be found on this object" instead of yielding an empty set, failing the promotion validation job. Read the property via PSObject.Properties (case-insensitive, no throw when absent) and handle array-wrapped darc output, so a build with no channel cleanly skips promotion validation as intended. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
43
to
45
| inlineScript: > | ||
| .\eng\update-packagesource.ps1 | ||
| -gitHubPat $(BotAccount-dotnet-maestro-bot-PAT) | ||
| -packagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts |
The previous fix assigned $channels via an if/else expression whose branches returned @(). An empty @() emitted from inside an if/else block puts nothing on the output stream, so $channels became $null and the subsequent $channels.Count threw "The property 'Count' cannot be found on this object" under Set-StrictMode -Version 2.0 - failing the promotion validation before the skip could take effect. Initialize $channels = @() up front, only reassign when channels are present, and read the count via @($channels).Count so a no-channel build cleanly skips. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Comment on lines
+19
to
+26
| $arcadePkg = Get-ChildItem -Path $PackagesSource -Recurse -Filter 'Microsoft.DotNet.Arcade.Sdk.*.nupkg' -ErrorAction SilentlyContinue | Select-Object -First 1 | ||
| if (-not $arcadePkg) { | ||
| throw "Could not find Microsoft.DotNet.Arcade.Sdk.*.nupkg under '$PackagesSource'." | ||
| } | ||
| if ($arcadePkg.Name -notmatch '^Microsoft\.DotNet\.Arcade\.Sdk\.(.+)\.nupkg$') { | ||
| throw "Unexpected Arcade SDK package name '$($arcadePkg.Name)'." | ||
| } | ||
| $version = $Matches[1] |
| $globalJson = Get-Content -Path $globalJsonPath -Raw | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Arcade\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Helix\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| Set-Content -Path $globalJsonPath -Value $globalJson -NoNewline |
The self-build validation ran eng/update-packagesource.ps1, which used `darc update-dependencies --packages-folder ... --channel ".NET Tools - Latest"` to bump the repo to the newly built Arcade SDK. But arcade does not declare Microsoft.DotNet.Arcade.Sdk/Helix.Sdk in eng/Version.Details.xml, so darc has nothing to update: it logs "Found no dependencies to update" and leaves global.json unchanged. The self-build therefore built with the bootstrap SDK pinned in global.json, not the SDK this build produced - a false positive. Reuse the dependency-free eng/validation/use-built-sdk.ps1 (already used by the signing validation) for the self-build too. It directly bumps the msbuild-sdks versions in global.json and adds the local package feed (with a packageSourceMapping entry so the microsoft.* SDK actually resolves from the local feed), so the build genuinely validates the newly produced SDK. This also removes the darc install and Azure CLI auth from the self-build step and deletes the now-unused update-packagesource.ps1, unifying both validations on one script. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
| $globalJson = Get-Content -Path $globalJsonPath -Raw | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Arcade\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| $globalJson = $globalJson -replace '("Microsoft\.DotNet\.Helix\.Sdk"\s*:\s*")[^"]*(")', "`${1}$version`${2}" | ||
| Set-Content -Path $globalJsonPath -Value $globalJson -NoNewline |
| $mappingKey = $nugetConfig.CreateAttribute("key") | ||
| $mappingKey.Value = $key | ||
| $mappingSource.Attributes.Append($mappingKey) | Out-Null | ||
| foreach ($pattern in @('microsoft.*', '*')) { |
Comment on lines
+35
to
+37
| # Install a private copy of darc so we don't disturb the repo's tool manifest. | ||
| $darcPath = Join-Path $PSScriptRoot "darc\$([guid]::NewGuid())" | ||
| & $PSScriptRoot\..\common\darc-init.ps1 -toolpath $darcPath | Out-Host |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 3 of removing the
arcade -> arcade-validationpromotion/validation gate (#17046). Builds on #17066 and #17078. Main-only — release branches keep using arcade-validation.What the official build validates about the newly produced SDK
buildstage — builds/packs/publishes arcade with the current SDK; registers in BAR; post-build publishes assets to.NET Eng - Validation.ValidateSdkstage (gated byrunValidateSdk, default true) — three validations of the new SDK, in parallel:eng/validate-sdk.yml) —update-packagesourcebumps to the new SDK, thencibuildrebuilds arcade with it (build + sign + pack + publish).eng/validate-signing.yml) — stages a curated set of artifact types (test.deb/.rpm/.pkg/.vsix/.nupkg, nested containers, loose assemblies, ...) and signs them with the new SignTool (build -sign), on Windows (test + real), Linux, macOS. Ported from arcade-validation'sValidate_Signing_*, with the new-SDK bump added.eng/validate-promotion.yml→validate-promotion.ps1) — promotes toGeneral Testingfrom a branch bumped to the new arcade (uses the current build commit; darc picks the publishing infra version), so the promotion pipeline runs the newTasks.Feed.PromoteToLateststage (main-only) — promotes to.NET Eng - Latestwith the default arcade (promote-to-latest.ps1,--skip-assets-publishing). Runs on build success; gated onValidateSdkonly when it is enabled, so a build can still be promoted when validation is off.Review feedback addressed
validate-promotion.ps1uses the current build commit (nodarc get-build) and doesn't pin--publishing-infra-version.usePrebuiltArcadeForPublishing.The signing and promotion validations run only in the internal official build and cannot be validated locally or in PR. They need @dotnet/dnceng review + a real official-build run. Key assumptions: cross-platform
update-packagesourcefor signing; Mac/Linux real-signing wiring; BAR id fromReleaseConfigs.txt;dnceng-build-rw-code-rw-wiffor the mirror push;dependsOn: publish_using_darc; General Testing promotion not conflicting with the Validation publish (arcade-validation had pre-checks — may need porting).Validated locally: all YAML parses; both promotion scripts parse.
Part of #17046.