Merge the microbuild branch from https://github.com/aarnott/Library.Template

Specifically, this merges [5e856e2 from that repo](AArnott/Library.Template@5e856e2).

Author: AArnott

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # Refer to https://hub.docker.com/_/microsoft-dotnet-sdk for available versions
-FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble@sha256:332e0362dd210a10348d436a5fb7f87aeec28c2c53ac2c3c2659e57c22294d0e
+FROM mcr.microsoft.com/dotnet/sdk:9.0.203-noble@sha256:2c9a4956a61fc45d9111fb36ec9fb86932e4842af9eb9bc9306bf8757f53674d
 
 # Installing mono makes `dotnet test` work without errors even for net472.
 # But installing it takes a long time, so it's excluded by default.

CONTRIBUTING.md

@@ -87,3 +87,17 @@ Configuration is in the `.github/renovate.json` file.
 When changing the renovate.json file, follow [these validation steps](https://docs.renovatebot.com/config-validation/).
 
 If Renovate is not creating pull requests when you expect it to, check that the [Renovate GitHub App](https://github.com/apps/renovate) is configured for your account or repo.
+
+## Merging latest from Library.Template
+
+### Maintaining your repo based on this template
+
+The best way to keep your repo in sync with Library.Template's evolving features and best practices is to periodically merge the template into your repo:
+`
+```ps1
+git fetch
+git checkout origin/main
+.\tools\MergeFrom-Template.ps1
+# resolve any conflicts, then commit the merge commit.
+git push origin -u HEAD
+```

Directory.Build.props

@@ -35,6 +35,11 @@
     <SymbolPackageFormat>snupkg</SymbolPackageFormat>
   </PropertyGroup>
 
+  <PropertyGroup>
+    <LangVersion Condition="'$(MSBuildProjectExtension)'=='.csproj'">13</LangVersion>
+    <LangVersion Condition="'$(MSBuildProjectExtension)'=='.vbproj'">16.9</LangVersion>
+  </PropertyGroup>
+
   <ItemGroup>
     <None Include="$(RepoRootPath)obj/NOTICE" Pack="true" PackagePath="" Visible="false" Condition=" Exists('$(RepoRootPath)obj/NOTICE') " />
   </ItemGroup>
@@ -53,4 +58,6 @@
       <PackageReleaseNotes Condition="'$(RepositoryUrl)'!=''">$(RepositoryUrl)/releases/tag/v$(Version)</PackageReleaseNotes>
     </PropertyGroup>
   </Target>
+
+  <Import Project="azure-pipelines\NuGetSbom.props" />
 </Project>

Directory.Build.targets

@@ -1,13 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project>
-  <PropertyGroup>
-    <LangVersion Condition="'$(Language)'=='C#'">13</LangVersion>
-    <LangVersion Condition="'$(Language)'=='VB'">16.9</LangVersion>
-  </PropertyGroup>
   <ItemGroup>
     <!-- Avoid compile error about missing namespace when combining ImplicitUsings with .NET Framework target frameworks. -->
     <Using Remove="System.Net.Http" Condition="'$(TargetFrameworkIdentifier)'=='.NETFramework'" />
   </ItemGroup>
-
-  <Import Project="azure-pipelines\NuGetSbom.targets" Condition="'$(IsPackable)'!='false'" />
 </Project>

azure-pipelines/NuGetSbom.props

@@ -0,0 +1,6 @@
+<Project>
+  <PropertyGroup>
+    <GenerateSBOMThisProject>true</GenerateSBOMThisProject>
+    <UseMicroBuildSbomPluginVersion>2</UseMicroBuildSbomPluginVersion>
+  </PropertyGroup>
+</Project>

azure-pipelines/NuGetSbom.targets

@@ -200,8 +200,6 @@ jobs:
   - ${{ if and(parameters.EnableDotNetFormatCheck, not(parameters.EnableLinuxBuild)) }}:
     - script: dotnet format --verify-no-changes --no-restore
       displayName: 💅 Verify formatted code
-      env:
-        dotnetformat: true # part of a workaround for https://github.com/dotnet/sdk/issues/44951
 
   - ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
     - template: microbuild.after.yml
@@ -242,8 +240,6 @@ jobs:
       - ${{ if parameters.EnableDotNetFormatCheck }}:
         - script: dotnet format --verify-no-changes --no-restore
           displayName: 💅 Verify formatted code
-          env:
-            dotnetformat: true # part of a workaround for https://github.com/dotnet/sdk/issues/44951
 
   - ${{ if parameters.EnableMacOSBuild }}:
     - job: macOS
@@ -285,6 +281,12 @@ jobs:
     condition: succeededOrFailed()
     ${{ if eq(variables['system.collectionId'], '011b8bdf-6d56-4f87-be0d-0092136884d9') }}:
       templateContext:
+        ${{ if not(parameters.RealSign) }}:
+          mb:
+            signing: # if the build is test-signed, install the signing plugin so that CSVTestSignPolicy.xml is available
+              enabled: true
+              zipSources: false
+              signType: test
         outputParentDirectory: $(Build.ArtifactStagingDirectory)
         outputs:
           - output: pipelineArtifact

azure-pipelines/build.yml

@@ -9,7 +9,7 @@ parameters:
   type: boolean
 
 steps:
-- ${{ if not(parameters.SkipCodesignVerify) }}: # skip CodesignVerify on validation builds because we don't even test-sign nupkg's.
+- ${{ if not(parameters.SkipCodesignVerify) }}:
   - task: MicroBuildCodesignVerify@3
     displayName: 🔍 Verify Signed Files
     inputs:

azure-pipelines/microbuild.after.yml

@@ -18,6 +18,8 @@ stages:
       - job: symbol_archive
         displayName: Archive symbols
         pool: VSEngSS-MicroBuild2022-1ES
+        variables:
+          ONEES_ENFORCED_CODEQL_ENABLED: false # CodeQL runs on build stages, we don't need it here
         steps:
         - checkout: none
         - download: current
@@ -72,6 +74,8 @@ stages:
             ${{ else }}:
               nuGetFeedType: internal
               publishVstsFeed: vs-impl # Leave this as-is, since non-signed builds must not be pushed to public feeds.
+        variables:
+          ONEES_ENFORCED_CODEQL_ENABLED: false # CodeQL runs on build stages, we don't need it here
         steps:
         - checkout: none
         - download: current

azure-pipelines/prepare-insertion-stages.yml

@@ -32,10 +32,9 @@ extends:
     stages:
     - stage: Build
       variables:
-        DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
-        NUGET_PACKAGES: $(Agent.TempDirectory)/.nuget/packages/
-        BuildConfiguration: Release
-        SkipCodesignVerify: true
+      - template: /azure-pipelines/BuildStageVariables.yml@self
+      - name: SkipCodesignVerify
+        value: true
 
       jobs:
       - template: /azure-pipelines/build.yml@self