Merge remote-tracking branch 'upstream/main' into sqltls

Author: afscrome

.github/actions/unlock-macos-keychain/action.yml

@@ -0,0 +1,59 @@
+name: 'Unlock macOS Keychain'
+description: 'Unlocks the macOS login keychain for CI tests that require keychain access'
+inputs:
+  keychain-password:
+    description: 'Password for the keychain (typically empty string for CI runners)'
+    required: false
+    default: ''
+  keychain-name:
+    description: 'Name of the keychain to unlock'
+    required: false
+    default: 'login.keychain-db'
+  timeout:
+    description: 'Timeout in seconds before keychain locks again (0 = no timeout)'
+    required: false
+    default: '7200'  # 2 hours
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check if running on macOS
+      if: runner.os != 'macOS'
+      shell: bash
+      run: |
+        echo "::warning::This action is designed for macOS runners but is running on ${{ runner.os }}. Skipping keychain unlock."
+
+    - name: Unlock keychain
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        KEYCHAIN_PATH="$HOME/Library/Keychains/${{ inputs.keychain-name }}"
+
+        echo "Unlocking keychain: $KEYCHAIN_PATH"
+        security unlock-keychain -p "${{ inputs.keychain-password }}" "$KEYCHAIN_PATH"
+
+        if [ "${{ inputs.timeout }}" != "0" ]; then
+          echo "Setting keychain timeout to ${{ inputs.timeout }} seconds"
+          security set-keychain-settings -lut ${{ inputs.timeout }} "$KEYCHAIN_PATH"
+        else
+          echo "Disabling keychain timeout"
+          security set-keychain-settings "$KEYCHAIN_PATH"
+        fi
+
+        # Add to search list to ensure it's used
+        security list-keychains -d user -s "$KEYCHAIN_PATH"
+
+        echo "Keychain unlocked successfully"
+
+    - name: Verify keychain is unlocked
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        KEYCHAIN_PATH="$HOME/Library/Keychains/${{ inputs.keychain-name }}"
+
+        # Try to access the keychain without password prompt
+        if security show-keychain-info "$KEYCHAIN_PATH" 2>&1 | grep -q "no-timeout"; then
+          echo "✓ Keychain is unlocked with no timeout"
+        else
+          echo "✓ Keychain is unlocked with timeout"
+        fi

.github/policies/milestoneAssignment.prClosed.yml

@@ -16,16 +16,16 @@ configuration:
           branch: main
       then:
       - addMilestone:
-          milestone: 13.1
+          milestone: 13.2
       description: '[Milestone Assignments] Assign Milestone to PRs merged to the `main` branch'
     - if:
       - payloadType: Pull_Request
       - isAction:
           action: Closed
       - targetsBranch:
-          branch: release/9.4
+          branch: release/13.1
       then:
       - removeMilestone
       - addMilestone:
-          milestone: 9.4.2
-      description: '[Milestone Assignments] Assign Milestone to PRs merged to release/9.4 branch'
+          milestone: 13.1
+      description: '[Milestone Assignments] Assign Milestone to PRs merged to release/13.1 branch'

.github/workflows/build-packages.yml

@@ -22,11 +22,16 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install VSCE tool
-        run: npm i -g @vscode/vsce
+        run: npm i -g @vscode/vsce@3.7.1
 
       - name: Build with packages
         run: ./build.sh -restore -build -build-extension -ci -pack -bl -p:InstallBrowsersForPlaywright=false -p:SkipTestProjects=true -p:SkipPlaygroundProjects=true ${{ inputs.versionOverrideArg }}
 
+      - name: Clean up artifacts
+        run: |
+          rm -rf artifacts/bin
+          rm -rf artifacts/obj
+
       - name: Stage RID-specific NuGets and remaining packages
         id: stage_rid_specific
         shell: bash

.github/workflows/ci.yml

@@ -86,13 +86,18 @@ jobs:
     steps:
       - name: Fail if any of the dependent jobs failed
         # Don't fail if the workflow is being skipped.
+        # Check skip_workflow on all declared dependencies. Workflows without
+        # skip_workflow outputs (e.g., tests, build_cli_archives) evaluate to
+        # empty string, so the check still works ('!= true' is true for empty).
         #
         # For others 'skipped' can be when a transitive dependency fails and the dependent job gets
         # 'skipped'. For example, one of setup_* jobs failing and the Integration test jobs getting
         # 'skipped'
         if: >-
           ${{ always() &&
               needs.prepare_for_ci.outputs.skip_workflow != 'true' &&
+              needs.tests.outputs.skip_workflow != 'true' &&
+              needs.build_cli_archives.outputs.skip_workflow != 'true' &&
               (contains(needs.*.result, 'failure') ||
                contains(needs.*.result, 'cancelled') ||
                contains(needs.*.result, 'skipped')) }}

.github/workflows/run-tests.yml

@@ -103,6 +103,8 @@ jobs:
             8.x
             9.x
             10.x
+        env:
+          DOTNET_INSTALL_DIR: ${{ env.DOTNET_ROOT }}
 
       - name: Trust HTTPS development certificate (Linux)
         if: inputs.os == 'ubuntu-latest'
@@ -269,17 +271,21 @@ jobs:
 
           Write-Output "Unzipped $zipFilePath to $destinationPath"
 
+      - name: Unlock macOS keychain for certificate tests
+        if: runner.os == 'macOS'
+        uses: ./.github/actions/unlock-macos-keychain
+
       - name: Run nuget dependent tests
         if: ${{ inputs.requiresNugets }}
         working-directory: ${{ github.workspace }}/run-tests/
         env:
-          DCP_DIAGNOSTICS_LOG_LEVEL: debug
-          DCP_DIAGNOSTICS_LOG_FOLDER: ${{ github.workspace }}/testresults/dcp
+          ASPIRE__TEST__DCPLOGBASEPATH: ${{ github.workspace }}/testresults/dcp
           BUILT_NUGETS_PATH: ${{ github.workspace }}/artifacts/packages/Debug/Shipping
           NUGET_PACKAGES: ${{ github.workspace }}/nuget-cache
           PLAYWRIGHT_INSTALLED: ${{ !inputs.enablePlaywrightInstall && 'false' || 'true' }}
           TEST_LOG_PATH: ${{ github.workspace }}/artifacts/log/test-logs
           TestsRunningOutsideOfRepo: true
+          TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX: 'netaspireci.azurecr.io'
         run: >
           dotnet ${{ env.TEST_ASSEMBLY_NAME }}.dll
           --ignore-exit-code 8
@@ -295,13 +301,13 @@ jobs:
         if: ${{ ! inputs.requiresNugets }}
         id: run-tests
         env:
-          DCP_DIAGNOSTICS_LOG_LEVEL: debug
-          DCP_DIAGNOSTICS_LOG_FOLDER: ${{ github.workspace }}/testresults/dcp
+          ASPIRE__TEST__DCPLOGBASEPATH: ${{ github.workspace }}/testresults/dcp
           # During restore and build, we use -ci, which causes NUGET_PACKAGES to point to a local cache (Arcade behavior).
           # In this step, we are not using Arcade, but want to make sure that MSBuild is able to evaluate correctly.
           # So, we manually set NUGET_PACKAGES
           NUGET_PACKAGES: ${{ github.workspace }}/.packages
           PLAYWRIGHT_INSTALLED: ${{ !inputs.enablePlaywrightInstall && 'false' || 'true' }}
+          TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX: 'netaspireci.azurecr.io'
         run: >
           ${{ env.DOTNET_SCRIPT }} test ${{ env.TEST_PROJECT_PATH }}
           /p:ContinuousIntegrationBuild=true
@@ -324,26 +330,26 @@ jobs:
         shell: pwsh
         run: |
           $trxFiles = Get-ChildItem -Path "${{ github.workspace }}/testresults" -Filter *.trx -Recurse -ErrorAction SilentlyContinue
-          
+
           if ($trxFiles.Count -eq 0) {
             Write-Error "No .trx files found. Tests may not have run due to infrastructure issues."
             exit 1
           }
-          
+
           Write-Host "Found $($trxFiles.Count) .trx file(s)"
-          
+
           $validFileCount = 0
           foreach ($trxFile in $trxFiles) {
             Write-Host "Checking $($trxFile.Name)..."
-            
+
             try {
               [xml]$trxContent = Get-Content -Path $trxFile.FullName
-              
+
               # Check if the XML is valid and non-empty
               if ($trxContent -and $trxContent.TestRun) {
                 $validFileCount++
                 $countersNode = $trxContent.TestRun.ResultSummary.Counters
-                
+
                 if ($countersNode -and $countersNode.total) {
                   $testCount = [int]$countersNode.total
                   Write-Host "  Total tests in file: $testCount"
@@ -358,12 +364,12 @@ jobs:
               Write-Warning "Failed to parse $($trxFile.Name): $_"
             }
           }
-          
+
           if ($validFileCount -eq 0) {
             Write-Error "No valid .trx files found. All .trx files are empty or invalid XML."
             exit 1
           }
-          
+
           Write-Host "✓ Test execution completed successfully (found $validFileCount valid .trx file(s))"
 
       - name: Dump docker info

.github/workflows/specialized-test-runner.yml

@@ -8,6 +8,10 @@ on:
         required: true
         type: string
         description: 'Arcade test runner name'
+      attributeName:
+        required: true
+        type: string
+        description: 'Attribute name to filter tests by like QuarantinedTest or OuterloopTest'
       extraRunSheetBuilderArgs:
         required: false
         type: string
@@ -33,13 +37,12 @@ jobs:
     if: ${{ github.repository_owner == 'dotnet' }}
     outputs:
       runsheet: ${{ steps.generate_tests_matrix.outputs.runsheet }}
+      requiresNugets: ${{ steps.check_nugets.outputs.requiresNugets }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Show disk usage before build
-        run: |-
-          df -h
-          du -sh ${{ github.workspace }}
+      - name: Identify relevant test projects
+        run: ./eng/scripts/generate-specialized-test-projects-list.sh ${{ inputs.attributeName }} ${{ github.workspace }}/artifacts/BeforeBuildProps.props
 
       # We need to build test projects, so that we can interrogate each test project
       # and find out whether it contains any tests of the specified type.
@@ -50,9 +53,9 @@ jobs:
           --restore
           --build
           -c Release
-          /p:BuildTestsOnly=true
           /p:GeneratePackageOnBuild=false
           /p:InstallBrowsersForPlaywright=false
+          /p:BeforeBuildPropsPath=${{ github.workspace }}/artifacts/BeforeBuildProps.props
 
       - name: Generate test runsheet
         id: generate_tests_matrix
@@ -67,30 +70,35 @@ jobs:
           /p:Restore=false
           /p:Build=false
           /p:InstallBrowsersForPlaywright=false
+          /p:BeforeBuildPropsPath=${{ github.workspace }}/artifacts/BeforeBuildProps.props
           /bl:${{ github.workspace }}/artifacts/log/Release/runsheet.binlog
 
-      - name: Show disk usage after build
-        if: ${{ always() }}
-        run: |-
-          df -h
-          du -d 1 -h ~/.nuget/packages
-          du -d 1 -h ${{ github.workspace }}
-          du -d 1 -h ${{ github.workspace }}/artifacts
+      - name: Check if any test requires NuGets
+        id: check_nugets
+        run: |
+          RUNSHEET='${{ steps.generate_tests_matrix.outputs.runsheet }}'
+          if echo "$RUNSHEET" | jq -e 'any(.[]; .requiresNugets == true)' > /dev/null 2>&1; then
+            echo "requiresNugets=true" >> $GITHUB_OUTPUT
+          else
+            echo "requiresNugets=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Upload logs, and test results
         if: ${{ always() }}
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: logs-runsheet
           path: |
+            ${{ github.workspace }}/artifacts/BeforeBuildProps.props
             ${{ github.workspace }}/artifacts/log/*/runsheet.binlog
             ${{ github.workspace }}/artifacts/log/*/TestLogs/**
             ${{ github.workspace }}/artifacts/tmp/*/combined_runsheet.json
           retention-days: 5
 
   build_packages:
     name: Build packages
-    if: ${{ github.repository_owner == 'dotnet' }}
+    needs: [generate_tests_matrix]
+    if: ${{ github.repository_owner == 'dotnet' && needs.generate_tests_matrix.outputs.requiresNugets == 'true' }}
     uses: ./.github/workflows/build-packages.yml
 
   run_tests:
@@ -100,7 +108,7 @@ jobs:
       fail-fast: false
       matrix:
         tests: ${{ fromJson(needs.generate_tests_matrix.outputs.runsheet) }}
-    if: ${{ github.repository_owner == 'dotnet' }}
+    if: ${{ github.repository_owner == 'dotnet' && !cancelled() && !failure() }}
     uses: ./.github/workflows/run-tests.yml
     with:
       testShortName: ${{ matrix.tests.project }}
@@ -176,7 +184,19 @@ jobs:
       - name: Fail if any dependency failed
         # 'skipped' can be when a transitive dependency fails and the dependent job gets 'skipped'.
         # For example, one of setup_* jobs failing and the Integration test jobs getting 'skipped'
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }}
+        # Note: build_packages being skipped is expected when requiresNugets is false, so we check it separately
+        if: >-
+          ${{
+            always() && (
+              needs.generate_tests_matrix.result == 'failure' ||
+              needs.generate_tests_matrix.result == 'cancelled' ||
+              needs.run_tests.result == 'failure' ||
+              needs.run_tests.result == 'cancelled' ||
+              needs.run_tests.result == 'skipped' ||
+              (needs.build_packages.result == 'failure') ||
+              (needs.build_packages.result == 'cancelled')
+            )
+          }}
         run: |
           echo "One or more dependent jobs failed."
           exit 1

.github/workflows/tests-outerloop.yml

@@ -35,6 +35,7 @@ jobs:
     uses: ./.github/workflows/specialized-test-runner.yml
     with:
       testRunnerName: "OuterloopTestRunsheetBuilder"
+      attributeName: "OuterloopTest"
       extraRunSheetBuilderArgs: "-p:RunOuterloopTests=true"
       extraTestArgs: "--filter-trait outerloop=true"
       enablePlaywrightInstall: true

.github/workflows/tests-quarantine.yml

@@ -14,7 +14,8 @@ on:
   workflow_dispatch:
 
   schedule:
-    - cron: '0 2,14 * * *'  # Twice daily at 02:00 and 14:00 UTC
+    # Run every 4 hours
+    - cron: '0 */4 * * *'
 
   # TEMPORARILY DISABLED pull_request trigger due to #12143 (disk space issues): https://github.com/dotnet/aspire/issues/12143
   # pull_request:
@@ -35,6 +36,7 @@ jobs:
     uses: ./.github/workflows/specialized-test-runner.yml
     with:
       testRunnerName: "QuarantinedTestRunsheetBuilder"
+      attributeName: "QuarantinedTest"
       extraRunSheetBuilderArgs: "-p:RunQuarantinedTests=true"
       extraTestArgs: "--filter-trait quarantined=true"
       enablePlaywrightInstall: true

.github/workflows/tests.yml

@@ -191,7 +191,7 @@ jobs:
       - name: Run tests
         run: yarn test
       - name: Package VSIX
-        run: npx @vscode/vsce package --yarn --pre-release -o out/aspire-extension.vsix
+        run: npx @vscode/vsce@3.7.1 package --yarn --pre-release -o out/aspire-extension.vsix
       - name: Upload VSIX
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:

.gitignore

@@ -124,12 +124,18 @@ config.ps1
 # Node.js modules
 node_modules/
 
+# Maven build outputs
+target/
+dependency-reduced-pom.xml
+
 # Ignore cache created with the Angular CLI.
 .angular/
 
 # Python Compile Outputs
 
 *.pyc
+*.egg-info/
+/playground/python/**/build
 
 # IntelliJ
 .idea/