Merge branch 'main' of https://github.com/dotnet/sdk into merge/release/9.0.3xx-to-main

Author: Jason Zhai

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "microsoft.dotnet.darc": {
-      "version": "1.1.0-beta.24367.3",
+      "version": "1.1.0-beta.25113.5",
       "commands": [
         "darc"
       ]

.config/tsaoptions.json

@@ -0,0 +1,10 @@
+{
+    "instanceUrl": "https://devdiv.visualstudio.com/",
+    "template": "TFSDEVDIV",
+    "projectName": "DEVDIV",
+    "areaPath": "DevDiv\\NET Tools\\SDK",
+    "iterationPath": "DevDiv",
+    "notificationAliases": [ "[email protected]" ],
+    "repositoryName": "dotnet-sdk",
+    "codebaseName": "dotnet-sdk"
+}

.devcontainer/vmr/devcontainer.json

@@ -3,7 +3,7 @@
 // The container supports source-building the SDK
 {
     "name": "VMR with PR changes",
-    "image": "mcr.microsoft.com/dotnet-buildtools/prereqs:fedora-39",
+    "image": "mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9",
     "hostRequirements": {
         // A completely source built .NET is >64 GB with all the repos/artifacts
         "storage": "128gb"

.devcontainer/vmr/init.sh

@@ -25,6 +25,6 @@ vmr_branch=$(git -C "$sdk_dir" log --pretty=format:'%D' HEAD^ \
   | sed 's@origin/@@' \
   | sed 's@,.*@@')
 
-"$workspace_dir/synchronize-vmr.sh" --branch "$vmr_branch" --debug
+"$workspace_dir/synchronize-vmr.sh" --branch "$vmr_branch" --ci --debug
 
-(cd "$vmr_dir" && ./prep-source-build.sh)
+cd "$vmr_dir"

.gitattributes

@@ -10,6 +10,12 @@
 ###############################################################################
 *.xlf linguist-generated=true
 
+###############################################################################
+# Set default behavior to:
+#   don't collapse these files in PRs
+###############################################################################
+**/build/** linguist-generated=false
+
 ###############################################################################
 # Set file behavior to:
 #   treat as text
@@ -61,3 +67,5 @@
 *.verified.txt text eol=lf working-tree-encoding=UTF-8
 *.verified.xml text eol=lf working-tree-encoding=UTF-8
 *.verified.json text eol=lf working-tree-encoding=UTF-8
+
+src/SourceBuild/patches/**/*.patch    text    eol=lf

.github/workflows/add-lockdown-label.yml

@@ -0,0 +1,75 @@
+name: Add Branch Lockdown Label to PRs
+
+on:
+  pull_request_target:
+  workflow_dispatch: # Allows manual triggering of the workflow
+
+permissions:
+  actions: write # For managing the operation state cache
+  issues: write
+
+jobs:
+  add-label:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Install jq
+        run: sudo apt-get install -y jq
+
+      - name: Add label to PRs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Determine the third Tuesday of the current month
+          third_tuesday=$(date -d "$(date +%Y-%m-01) +14 days" +%Y-%m-%d)
+          while [ $(date -d "$third_tuesday" +%u) -ne 2 ]; do
+            third_tuesday=$(date -d "$third_tuesday + 1 day" +%Y-%m-%d)
+          done
+          
+          # Determine the first Tuesday of the current month
+          first_tuesday=$(date -d "$(date +%Y-%m-01)" +%Y-%m-%d)
+          while [ $(date -d "$first_tuesday" +%u) -ne 2 ]; do
+            first_tuesday=$(date -d "$first_tuesday + 1 day" +%Y-%m-%d)
+          done
+
+          # Get current date
+          current_date=$(date +%Y-%m-%d)
+
+          echo "Current Date: $current_date"
+          echo "Third Tuesday of the month: $third_tuesday"
+          echo "First Tuesday of the month: $first_tuesday"
+
+          # Check if the current date is after the third Tuesday of this month or before the first Tuesday of this month
+          if [[ "$current_date" > "$third_tuesday" || "$current_date" < "$first_tuesday" ]]; then
+            echo "Within the label period. Checking if the branch matches..."
+
+            # Get all open PRs targeting branches release/8* and release/9* excluding release/9.0.3xx
+            echo "Running gh pr list query..."
+            prs=$(gh pr list --state open --limit 200 --json number,baseRefName,author,labels)
+            echo "Total PRs Count: $(echo "$prs" | jq length)"
+            echo "PRs JSON: $prs"
+
+            echo "Filtering PRs targeting release/8* and release/9* excluding release/9.0.3xx..."
+            prs_targeting_branches=$(echo "$prs" | jq '[.[] | select(.baseRefName | test("^release/[89].*")) | select(.baseRefName | test("^release/9.0.3xx") | not)]')
+            echo "Count of PRs targeting specific branches: $(echo "$prs_targeting_branches" | jq length)"
+
+            echo "Filtering PRs without Branch Lockdown label..."
+            filtered_prs=$(echo "$prs_targeting_branches" | jq '[.[] | select(.labels | map(.name) | index("Branch Lockdown") | not) | .number]')
+            echo "Filtered PRs without Branch Lockdown label JSON: $filtered_prs"
+            echo "Count of Filtered PRs without Branch Lockdown label: $(echo "$filtered_prs" | jq length)"
+
+            # Loop through filtered PRs and add label
+            for pr in $(echo "$filtered_prs" | jq -r '.[]'); do
+              echo "Adding label to PR #$pr"
+              gh pr edit $pr --add-label "Branch Lockdown"
+            done
+          else
+            echo "Outside the label period. No labels added."
+          fi

.github/workflows/pr-analysis.yml

@@ -0,0 +1,14 @@
+name: PR Analysis
+on:
+  pull_request:
+    types: [opened, synchronize, labeled, unlabeled]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  allowed-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Return error if branch is in lockdown or 'do not merge' label is present
+        run: echo "Labels on this PR prevent it from being merged. Please contact the repo owners for more information." && exit 1
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'Branch Lockdown') || contains(github.event.pull_request.labels.*.name, 'DO NOT MERGE') }}

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ on:
     inputs:
       daysBeforeStale:
         required: true
-        default: "2192"
+        default: "1827"
       daysBeforeClose:
         required: true
         default: "30"

.vsts-ci.yml

@@ -66,8 +66,6 @@ extends:
     containers:
       alpine319WithNode:
         image: mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.19-WithNode
-      cblMariner20Fpm:
-        image: mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-fpm
       centosStream9:
         image: mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9
       debian12Amd64:
@@ -76,13 +74,17 @@ extends:
         image: mcr.microsoft.com/dotnet-buildtools/prereqs:fedora-39
       mariner20CrossArm:
         image: mcr.microsoft.com/dotnet-buildtools/prereqs:cbl-mariner-2.0-cross-arm
-      ubuntu2204DebPkg:
-        image: mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-22.04-debpkg
     sdl:
       sourceAnalysisPool:
         name: $(DncEngInternalBuildPool)
         image: 1es-windows-2022
         os: windows
+      policheck:
+        enabled: true
+      tsa:
+        enabled: true
+      binskim:
+        enabled: true
       ${{ if or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')) }}:
         componentgovernance:
           # Refdoc: https://docs.opensource.microsoft.com/tools/cg/component-detection/variables/
@@ -106,6 +108,10 @@ extends:
             publishTaskPrefix: 1ES.
           runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://dotnetbuilds.blob.core.windows.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
           locBranch: release/9.0.3xx
+          # WORKAROUND: BinSkim requires the folder exist prior to scanning.
+          preSteps:
+          - powershell: New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/artifacts/bin -Force
+            displayName: Create artifacts/bin directory
           ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
             timeoutInMinutes: 90
             windowsJobParameterSets:
@@ -201,21 +207,20 @@ extends:
               runTests: false
             ### PORTABLE ###
             - categoryName: Portable
-              container: ubuntu2204DebPkg
               # Do not publish zips and tarballs. The linux-x64 binaries are already published by Official.
               publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false
               officialBuildProperties: $(_officialBuildProperties)
               osProperties: $(linuxOsPortableProperties) /p:BuildSdkDeb=true
               runTests: false
             - categoryName: Portable
-              container: cblMariner20Fpm
+              container: centosStream9
               # Do not publish zips and tarballs. The linux-x64 binaries are already published by Official.
               publishArgument: $(_publishArgument) /p:PublishBinariesAndBadge=false
               officialBuildProperties: $(_officialBuildProperties)
               osProperties: $(linuxOsPortableProperties) /p:IsRPMBasedDistro=true
               runTests: false
             - categoryName: Portable
-              container: cblMariner20Fpm
+              container: centosStream9
               buildArchitecture: arm64
               runtimeIdentifier: linux-arm64
               # Do not publish zips and tarballs. The linux-arm64 binaries are already published by Official.
@@ -306,16 +311,6 @@ extends:
               buildArchitecture: arm64
               runtimeIdentifier: osx-arm64
 
-      ############### SOURCE BUILD ###############
-      - template: /eng/common/templates-official/job/source-build.yml@self
-        parameters:
-          enableInternalSources: true
-          platform:
-            name: Managed
-            container: centosStream9
-            jobProperties:
-              timeoutInMinutes: 30
-
       ############### DOTNET-FORMAT ###############
       - ${{ if or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')) }}:
         - template: /eng/dotnet-format/dotnet-format-integration.yml@self
@@ -338,26 +333,3 @@ extends:
               name: $(DncEngInternalBuildPool)
               image: 1es-windows-2022
               os: windows
-
-      ############### POST-BUILD STAGE ###############
-      - template: /eng/common/templates-official/post-build/post-build.yml@self
-        parameters:
-          publishingInfraVersion: 3
-          enableSymbolValidation: false
-          enableSigningValidation: false
-          enableNugetValidation: false
-          enableSourceLinkValidation: false
-          publishInstallersAndChecksums: true
-          publishAssetsImmediately: true
-          SDLValidationParameters:
-            enable: false
-            params: ' -SourceToolsList @("policheck","credscan")
-            -TsaInstanceURL $(_TsaInstanceURL)
-            -TsaProjectName $(_TsaProjectName)
-            -TsaNotificationEmail $(_TsaNotificationEmail)
-            -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
-            -TsaBugAreaPath $(_TsaBugAreaPath)
-            -TsaIterationPath $(_TsaIterationPath)
-            -TsaRepositoryName "dotnet-sdk"
-            -TsaCodebaseName "dotnet-sdk"
-            -TsaPublish $True'

.vsts-pr.yml

@@ -8,6 +8,11 @@ pr:
     - main
     - release/*
     - internal/release/*
+  paths:
+    exclude:
+    - documentation/*
+    - README.md
+    - CODEOWNERS
 
 parameters:
 - name: enableArm64Job
@@ -78,15 +83,5 @@ stages:
           buildArchitecture: arm64
           runtimeIdentifier: osx-arm64
 
-  ############### SOURCE BUILD ###############
-  - template: /eng/common/templates/job/source-build.yml
-    parameters:
-      enableInternalSources: true
-      platform:
-        name: Managed
-        container: centosStream9
-        jobProperties:
-          timeoutInMinutes: 30
-
   ############### DOTNET-FORMAT ###############
   - template: /eng/dotnet-format/dotnet-format-integration.yml