Official build: validate + promote with the newly built Arcade (3/3)

azure-pipelines.yml

@@ -20,6 +20,15 @@ trigger:
     - THIRD-PARTY-NOTICES.TXT
 pr: none
 
+parameters:
+# Bootstrap-breakage escape hatch. The ValidateSdk stage self-bootstraps arcade with the newly
+# produced SDK and validates signing + promotion using that SDK; publishing depends on it.
+# Override to false at queue time to ship a new Arcade when the current one cannot self-validate.
+- name: runValidateSdk
+  displayName: Run the Validate Arcade SDK stage (signing + self-build + promotion validation)
+  type: boolean
+  default: true
+
 variables:
 - template: /eng/common-variables.yml@self
   parameters:
@@ -59,3 +68,4 @@ extends:
         ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/main') }}:
           oneLocEnabled: true
         microbuildUseESRP: true
+        runValidateSdk: ${{ parameters.runValidateSdk }}

eng/build.yml

@@ -5,6 +5,14 @@ parameters:
 - name: microbuildUseESRP
   default: false
   type: boolean
+# When true (default), run the Validate Arcade SDK stage: three parallel validations of the newly
+# produced SDK - signing validation, self-build (self-bootstrap), and promotion to a test channel
+# with the new Arcade. Set to false as a bootstrap-breakage escape hatch to ship a new Arcade when
+# the current one cannot self-validate; the promotion to '.NET Eng - Latest' still runs on build
+# success.
+- name: runValidateSdk
+  default: true
+  type: boolean
 
 stages:
 - stage: build
@@ -49,17 +57,25 @@ stages:
             /p:Test=false
           displayName: Windows Build / Publish
 
-- stage: ValidateSdk
-  displayName: Validate Arcade SDK
-  dependsOn: build
-  jobs:
-  - template: /eng/validate-sdk.yml@self
-    parameters:
-      microbuildUseESRP: ${{ parameters.microbuildUseESRP }}
-      buildArgs: -configuration $(_BuildConfig)
-        -prepareMachine
-        $(_InternalBuildArgs)
-        /p:Test=false
+- ${{ if eq(parameters.runValidateSdk, true) }}:
+  - stage: ValidateSdk
+    displayName: Validate Arcade SDK
+    dependsOn: build
+    jobs:
+    # Self-bootstrap: rebuild arcade with the newly produced SDK (build + sign + pack + publish).
+    - template: /eng/validate-sdk.yml@self
+      parameters:
+        microbuildUseESRP: ${{ parameters.microbuildUseESRP }}
+        buildArgs: -configuration $(_BuildConfig)
+          -prepareMachine
+          $(_InternalBuildArgs)
+          /p:Test=false
+    # Sign a curated set of artifact types with the newly built SignTool.
+    - template: /eng/validate-signing.yml@self
+      parameters:
+        microbuildUseESRP: ${{ parameters.microbuildUseESRP }}
+    # Validate that build promotion works when driven by the newly built Arcade.
+    - template: /eng/validate-promotion.yml@self
 
 - template: /eng/common/templates-official/post-build/post-build.yml@self
   parameters:
@@ -68,4 +84,72 @@ stages:
     enableSigningValidation: false
     publishDependsOn:
     - Validate
-    - ValidateSdk
+    - ${{ if eq(parameters.runValidateSdk, true) }}:
+      - ValidateSdk
+
+# Promote the build to '.NET Eng - Latest' using the current/default Arcade. Runs after a successful
+# build, and - when validation is enabled - after ValidateSdk passes, so a build can still be promoted
+# when validation is disabled. Main only: release branches keep using dotnet/arcade-validation for
+# this gate (see #17046). The assets were already published to '.NET Eng - Validation' by the
+# post-build publish stage, so this uses --skip-assets-publishing.
+- ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/main') }}:
+  - stage: PromoteToLatest
+    displayName: Promote to '.NET Eng - Latest'
+    dependsOn:
+    - publish_using_darc
+    - ${{ if eq(parameters.runValidateSdk, true) }}:
+      - ValidateSdk
+    jobs:
+    - template: /eng/common/templates-official/job/job.yml@self
+      parameters:
+        name: PromoteToLatest
+        displayName: Promote to '.NET Eng - Latest'
+        enableMicrobuild: false
+        timeoutInMinutes: 60
+        # The publish-build-assets job writes the BAR build id as the first line of ReleaseConfigs.txt.
+        artifacts:
+          download:
+            name: ReleaseConfigs
+            path: release_configs
+        variables:
+        - group: Publish-Build-Assets
+        - template: /eng/common/templates-official/variables/pool-providers.yml@self
+        pool:
+          name: $(DncEngInternalBuildPool)
+          demands: ImageOverride -equals windows.vs2026.amd64
+        preSteps:
+        - checkout: self
+          clean: true
+        steps:
+        - powershell: |
+            $releaseConfigs = Get-Content "$(System.DefaultWorkingDirectory)/release_configs/ReleaseConfigs.txt"
+            $barId = ($releaseConfigs | Select-Object -First 1).Trim()
+            if ([string]::IsNullOrEmpty($barId)) { Write-Error "Could not read BAR build id from ReleaseConfigs.txt"; exit 1 }
+            Write-Host "BAR build id: $barId"
+            Write-Host "##vso[task.setvariable variable=BARBuildId]$barId"
+          displayName: Read BAR build id
+        - task: AzureCLI@2
+          displayName: Get AzDO token (WIF)
+          name: GetAzDoToken
+          inputs:
+            azureSubscription: "dnceng-build-rw-code-rw-wif"
+            scriptType: ps
+            scriptLocation: inlineScript
+            inlineScript: |
+              $azdoToken = az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query accessToken -o tsv
+              if ($LASTEXITCODE -ne 0) { Write-Error "Failed to get AzDO token"; exit 1 }
+              Write-Host "##vso[task.setvariable variable=WifAzDoToken;issecret=true]$azdoToken"
+        - task: AzureCLI@2
+          displayName: Promote to '.NET Eng - Latest'
+          inputs:
+            azureSubscription: "Darc: Maestro Production"
+            scriptType: ps
+            scriptLocation: inlineScript
+            inlineScript: |
+              $ci = $true
+              $disableConfigureToolsetImport = $true
+              . $(Build.SourcesDirectory)/eng/common/tools.ps1
+              $darc = Get-Darc
+              # Assets were already published to '.NET Eng - Validation'; this is the promotion gate.
+              & $darc add-build-to-channel --id $(BARBuildId) --channel '.NET Eng - Latest' --azdev-pat $(WifAzDoToken) --ci --skip-assets-publishing
+              if ($LASTEXITCODE -ne 0) { Write-Error "Failed to promote build $(BARBuildId) to '.NET Eng - Latest'."; exit 1 }

eng/validate-promotion.yml

@@ -0,0 +1,59 @@
+# Validates that Arcade build promotion works when driven by the newly built Arcade. One of the
+# parallel jobs of the official build's ValidateSdk stage. See eng/validation/validate-promotion.ps1.
+#
+# NOTE: runs only in the internal official build; not testable locally or in PR. Needs
+# @dotnet/dnceng review and a real official-build run to confirm.
+
+jobs:
+- template: /eng/common/templates-official/job/job.yml@self
+  parameters:
+    name: ValidatePromotion
+    displayName: Validate promotion (newly built Arcade)
+    enableMicrobuild: false
+    timeoutInMinutes: 120
+    # The publish-build-assets job writes the BAR build id as the first line of ReleaseConfigs.txt.
+    artifacts:
+      download:
+        name: ReleaseConfigs
+        path: release_configs
+    variables:
+    - group: Publish-Build-Assets
+    - template: /eng/common/templates-official/variables/pool-providers.yml@self
+    pool:
+      name: $(DncEngInternalBuildPool)
+      demands: ImageOverride -equals windows.vs2026.amd64
+    preSteps:
+    - checkout: self
+      clean: true
+    steps:
+    - powershell: |
+        $releaseConfigs = Get-Content "$(System.DefaultWorkingDirectory)/release_configs/ReleaseConfigs.txt"
+        $barId = ($releaseConfigs | Select-Object -First 1).Trim()
+        if ([string]::IsNullOrEmpty($barId)) { Write-Error "Could not read BAR build id from ReleaseConfigs.txt"; exit 1 }
+        Write-Host "BAR build id: $barId"
+        Write-Host "##vso[task.setvariable variable=BARBuildId]$barId"
+      displayName: Read BAR build id
+    # Token with code read/write on the internal AzDO mirror, to push the update-dependencies branch.
+    - task: AzureCLI@2
+      displayName: Get AzDO token (WIF)
+      name: GetAzDoToken
+      inputs:
+        azureSubscription: "dnceng-build-rw-code-rw-wif"
+        scriptType: ps
+        scriptLocation: inlineScript
+        inlineScript: |
+          $azdoToken = az account get-access-token --resource "499b84ac-1321-427f-aa17-267ca6975798" --query accessToken -o tsv
+          if ($LASTEXITCODE -ne 0) { Write-Error "Failed to get AzDO token"; exit 1 }
+          Write-Host "##vso[task.setvariable variable=WifAzDoToken;issecret=true]$azdoToken"
+    - task: AzureCLI@2
+      displayName: Validate promotion with the newly built Arcade
+      inputs:
+        azureSubscription: "Darc: Maestro Production"
+        scriptType: ps
+        scriptLocation: scriptPath
+        scriptPath: $(System.DefaultWorkingDirectory)/eng/validation/validate-promotion.ps1
+        arguments: >
+          -BuildId $(BARBuildId)
+          -Commit $(Build.SourceVersion)
+          -AzdoToken $(WifAzDoToken)
+          -GitHubPat $(BotAccount-dotnet-maestro-bot-PAT)

eng/validate-sdk.yml

@@ -34,16 +34,15 @@ jobs:
     - checkout: self
       clean: true
     steps:
-    - task: AzureCLI@2
-      displayName: Update package source
-      inputs:
-        azureSubscription: "Darc: Maestro Production"
-        scriptType: ps
-        scriptLocation: inlineScript
-        inlineScript: >
-          .\eng\update-packagesource.ps1
-          -gitHubPat $(BotAccount-dotnet-maestro-bot-PAT)
-          -packagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts
+    # Point the repo at the newly produced Arcade/Helix SDK (bump global.json + add the local feed) so
+    # the build below validates the SDK this build produced, not the bootstrap SDK. Pure file edit (no
+    # darc / no auth): darc update-dependencies --packages-folder can do the bump too, but it re-syncs
+    # eng/common from the remote arcade repo at the built commit (needs a GitHub PAT and the commit on
+    # github.com/dotnet/arcade), so it can't run on dev/PR builds. The file-based bump works everywhere.
+    - powershell: >
+        .\eng\validation\use-built-sdk.ps1
+        -PackagesSource $(System.DefaultWorkingDirectory)/build_stage_artifacts
+      displayName: Use newly built SDK
     - script: eng\common\cibuild.cmd
         $(_BuildArgs)
       displayName: Build / Validate