From 13a168ec06a99eae9bbce7b3ea2eb7875425aa19 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 15:31:08 -0600 Subject: [PATCH 1/9] Update dependency powershell to v7.6.5 (554) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .config/dotnet-tools.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json index 7b7805ba0..636973a25 100644 --- a/.config/dotnet-tools.json +++ b/.config/dotnet-tools.json @@ -3,7 +3,7 @@ "isRoot": true, "tools": { "powershell": { - "version": "7.6.4", + "version": "7.6.5", "commands": [ "pwsh" ], From aff6973563477503fa4c5687eb2fb8ecee6e8f46 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 16 Aug 2026 14:45:26 -0600 Subject: [PATCH 2/9] Update dependency xunit.v3.mtp-v2 to v4 (555) --- Directory.Packages.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 462d1d045..7dcdc1999 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -15,7 +15,7 @@ - + From f5d9436d8989c3ccded6c85f65e53357ae2b0992 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sun, 16 Aug 2026 14:46:16 -0600 Subject: [PATCH 3/9] Update dependency nerdbank.dotnetrepotools to v1.5.42 (556) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .config/dotnet-tools.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json index 636973a25..3abeb5a09 100644 --- a/.config/dotnet-tools.json +++ b/.config/dotnet-tools.json @@ -31,7 +31,7 @@ "rollForward": false }, "nerdbank.dotnetrepotools": { - "version": "1.5.15", + "version": "1.5.42", "commands": [ "repo" ], From d96634554028fda7232c2ec2ce2ea9f3f1c49be7 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 16:59:43 -0600 Subject: [PATCH 4/9] Update mcr.microsoft.com/dotnet/sdk:10.0.400 Docker digest to e1ffd2a (557) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .devcontainer/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index cfa41d1fa..566f9e488 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,5 +1,5 @@ # Refer to https://hub.docker.com/_/microsoft-dotnet-sdk for available versions -FROM mcr.microsoft.com/dotnet/sdk:10.0.400@sha256:e1fc6e423f543119c406d24e2e687d67c569f18f04a37a8b0005d80ad0dcee80 +FROM mcr.microsoft.com/dotnet/sdk:10.0.400@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c # Installing mono makes `dotnet test` work without errors even for net472. # But installing it takes a long time, so it's excluded by default. From 38e8ff9ddfb56b895835c40e43fe13aafdcedba3 Mon Sep 17 00:00:00 2001 From: Andrew Arnott Date: Thu, 20 Aug 2026 08:48:05 -0600 Subject: [PATCH 5/9] Update notes about how the release workflow works --- CONTRIBUTING.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 05e4d16b1..dae8d956d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -60,8 +60,10 @@ Having previously used `nbgv tag` and pushing the tag will help you identify the After publishing the release, the `.github/workflows/release.yml` workflow will be automatically triggered, which will: 1. Find the most recent `.github/workflows/build.yml` GitHub workflow run of the tagged release. -1. Upload the `deployables` artifact from that workflow run to your GitHub Release. -1. If you have `NUGET_API_KEY` defined as a secret variable for your repo or org, any nuget packages in the `deployables` artifact will be pushed to nuget.org. +1. Upload the `deployables-Linux` artifact from that workflow run to your GitHub Release. +1. Any nuget packages in the `deployables-Linux` artifact will be pushed to nuget.org. + +The workflow is written to leverage NuGet.org Trusted Publishing. ### Azure Pipelines From 60fd229ac29504262000ecee51f1bf29d095babf Mon Sep 17 00:00:00 2001 From: Andrew Arnott Date: Thu, 20 Aug 2026 08:49:27 -0600 Subject: [PATCH 6/9] Document the requirement for a repo secret --- CONTRIBUTING.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dae8d956d..2c566c0be 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -64,6 +64,7 @@ After publishing the release, the `.github/workflows/release.yml` workflow will 1. Any nuget packages in the `deployables-Linux` artifact will be pushed to nuget.org. The workflow is written to leverage NuGet.org Trusted Publishing. +You should set `NUGET_USER` as a repo secret to satisfy Trusted Publishing requirements. ### Azure Pipelines From 910d33cf9d4566d498e2944b58618ee4d0de6592 Mon Sep 17 00:00:00 2001 From: Andrew Arnott Date: Thu, 20 Aug 2026 08:57:50 -0600 Subject: [PATCH 7/9] Add better error and corner case handling to release workflow --- .github/workflows/release.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b1332218..bbaf6be77 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,6 +25,9 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: | + $ErrorActionPreference = 'Stop' + $PSNativeCommandUseErrorActionPreference = $true + if ('${{ inputs.ship_run_id }}') { $runid = '${{ inputs.ship_run_id }}' } else { @@ -40,8 +43,8 @@ jobs: Write-Host "Resolved ${{ github.ref_name }} to $commitSha" - $releases = gh run list -R ${{ github.repository }} -c $commitSha -w .github/workflows/build.yml -s success --json databaseId,startedAt,event,headBranch ` - | ConvertFrom-Json | Sort-Object startedAt -Descending + $releases = @(gh run list -R ${{ github.repository }} -c $commitSha -w .github/workflows/build.yml -s success --json databaseId,startedAt,event,headBranch ` + | ConvertFrom-Json | Sort-Object startedAt -Descending) $preferredReleases = $releases | Where-Object { $_.event -eq 'push' -and ($_.headBranch -eq 'main' -or $_.headBranch -match '^v\d+(?:\.\d+)?$') @@ -93,6 +96,9 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: | + $ErrorActionPreference = 'Stop' + $PSNativeCommandUseErrorActionPreference = $true + Get-ChildItem '${{ runner.temp }}/deployables' -File -Recurse |% { Write-Host "Uploading $($_.Name) to release..." gh release -R ${{ github.repository }} upload "${{ github.ref_name }}" $_.FullName From 549ad157543aad73d56bb43d93762ad337735070 Mon Sep 17 00:00:00 2001 From: Andrew Arnott Date: Mon, 24 Aug 2026 11:42:04 -0600 Subject: [PATCH 8/9] Update network isolation policy This latest update keeps compliant with the latest security push. --- azure-pipelines/archive-sourcecode.yml | 2 +- azure-pipelines/libtemplate-update.yml | 2 +- azure-pipelines/official.yml | 2 +- azure-pipelines/release.yml | 2 +- azure-pipelines/unofficial.yml | 2 +- azure-pipelines/vs-insertion.yml | 2 +- azure-pipelines/vs-validation.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/azure-pipelines/archive-sourcecode.yml b/azure-pipelines/archive-sourcecode.yml index cb8d68e9c..13015bef5 100644 --- a/azure-pipelines/archive-sourcecode.yml +++ b/azure-pipelines/archive-sourcecode.yml @@ -36,7 +36,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable diff --git a/azure-pipelines/libtemplate-update.yml b/azure-pipelines/libtemplate-update.yml index acbfbacef..8b342de2b 100644 --- a/azure-pipelines/libtemplate-update.yml +++ b/azure-pipelines/libtemplate-update.yml @@ -31,7 +31,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: name: AzurePipelines-EO diff --git a/azure-pipelines/official.yml b/azure-pipelines/official.yml index 99815ebbe..084d0d82d 100644 --- a/azure-pipelines/official.yml +++ b/azure-pipelines/official.yml @@ -46,7 +46,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable codeSignValidation: diff --git a/azure-pipelines/release.yml b/azure-pipelines/release.yml index a8218f052..3df977e55 100644 --- a/azure-pipelines/release.yml +++ b/azure-pipelines/release.yml @@ -21,7 +21,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable diff --git a/azure-pipelines/unofficial.yml b/azure-pipelines/unofficial.yml index efc60f322..fd5937972 100644 --- a/azure-pipelines/unofficial.yml +++ b/azure-pipelines/unofficial.yml @@ -56,7 +56,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable credscan: diff --git a/azure-pipelines/vs-insertion.yml b/azure-pipelines/vs-insertion.yml index 9f5743aec..1b5313e6a 100644 --- a/azure-pipelines/vs-insertion.yml +++ b/azure-pipelines/vs-insertion.yml @@ -23,7 +23,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable sbom: diff --git a/azure-pipelines/vs-validation.yml b/azure-pipelines/vs-validation.yml index e7e4c9787..b4037eed6 100644 --- a/azure-pipelines/vs-validation.yml +++ b/azure-pipelines/vs-validation.yml @@ -27,7 +27,7 @@ extends: template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate parameters: settings: - networkIsolationPolicy: Permissive,CFSClean2 + networkIsolationPolicy: DefaultDeny,CFSClean3 sdl: sourceAnalysisPool: VSEng-MicroBuildVSStable credscan: From cf76312e1968f88766808c44540fb616b6744683 Mon Sep 17 00:00:00 2001 From: Andrew Arnott Date: Mon, 24 Aug 2026 12:10:53 -0600 Subject: [PATCH 9/9] Bump MicroBuild to 2.0.257 --- Directory.Packages.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index c3d8ce3f0..f9ef4a965 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -6,7 +6,7 @@ true 2.3.3 - 2.0.226 + 2.0.257