From e7864a003474241a532d42fcf396636f04247dd4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Feb 2026 08:17:04 -0600 Subject: [PATCH 1/4] Bump to mono/debugger-libs/main@e7fbb71 (#10803) Bumps [external/debugger-libs](https://github.com/mono/debugger-libs) from `f257277` to `e7fbb71`. - [Commits](https://github.com/mono/debugger-libs/compare/f2572777467b3dc19a2febc3642a87bd737b8bc0...e7fbb713d156d11193ed404783ad6fe9c4042a6d) --- updated-dependencies: - dependency-name: external/debugger-libs dependency-version: e7fbb713d156d11193ed404783ad6fe9c4042a6d dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- external/debugger-libs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/debugger-libs b/external/debugger-libs index f2572777467..e7fbb713d15 160000 --- a/external/debugger-libs +++ b/external/debugger-libs @@ -1 +1 @@ -Subproject commit f2572777467b3dc19a2febc3642a87bd737b8bc0 +Subproject commit e7fbb713d156d11193ed404783ad6fe9c4042a6d From 19b324fd2ea7135cab52780f11bf5645171fa703 Mon Sep 17 00:00:00 2001 From: Jonathan Peppers Date: Tue, 25 Aug 2026 17:55:10 -0500 Subject: [PATCH 2/4] [tests] Use approved feed for analyzer references (#12520) Roslyn analyzer tests acquire `Microsoft.NETCore.App.Ref` at test runtime. The testing library ignored the repository `NuGet.config` and contacted public NuGet infrastructure, producing CFS network-isolation violations on `main`. Copy the repository NuGet configuration beside the test assembly and configure the analyzer, code-fix, and refactoring verifier types to use it. Runtime reference package acquisition now uses the approved Azure Artifacts feeds already defined by the repository. The reported `ci.dot.net` and `shavamanifest*.azureedge.net` destinations are aliases associated with the same Azure Front Door event as the `testhost.exe` NuGet request. `asmconfigfiles-prod.azure-api.net` is intentionally unchanged because it originates from the pipeline-injected Geneva `ConfigDownloader.exe` and requires infrastructure remediation outside this repository. Validation: `dotnet test src\Microsoft.Android.Sdk.Analysis\Tests\Microsoft.Android.Sdk.Analysis.Tests.csproj -c Release -p:RestoreConfigFile=NuGet.config` (16 passed, 1 skipped). A fresh temporary package cache confirmed `Microsoft.NETCore.App.Ref.3.1.0.nupkg` was acquired through the copied approved-feed configuration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj | 3 +++ .../Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs | 2 ++ .../Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs | 3 ++- .../Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs | 2 ++ .../Tests/Verifiers/CSharpVerifierHelper.cs | 5 +++++ 5 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj b/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj index 9c1ac59b358..1160f499c72 100644 --- a/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj +++ b/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj @@ -20,6 +20,9 @@ + + PreserveNewest + diff --git a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs index 4a82bed3d48..ca37d954819 100644 --- a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs +++ b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs @@ -16,6 +16,8 @@ public class Test : CSharpAnalyzerTest public List Analyzers => analyzers; public Test () { + ReferenceAssemblies = CSharpVerifierHelper.DefaultReferenceAssemblies; + SolutionTransforms.Add ((solution, projectId) => { var project = solution.GetProject (projectId); var compilationOptions = project.CompilationOptions; diff --git a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs index 310409b7090..141f5934b28 100644 --- a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs +++ b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs @@ -11,6 +11,8 @@ public class Test : CSharpCodeFixTest { public Test () { + ReferenceAssemblies = CSharpVerifierHelper.DefaultReferenceAssemblies; + SolutionTransforms.Add ((solution, projectId) => { var compilationOptions = solution.GetProject (projectId).CompilationOptions; compilationOptions = compilationOptions.WithSpecificDiagnosticOptions ( @@ -22,4 +24,3 @@ public Test () } } } - diff --git a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs index 7beb164e48f..5e1db64cb44 100644 --- a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs +++ b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs @@ -8,6 +8,8 @@ public class Test : CSharpCodeRefactoringTest { public Test () { + ReferenceAssemblies = CSharpVerifierHelper.DefaultReferenceAssemblies; + SolutionTransforms.Add ((solution, projectId) => { var compilationOptions = solution.GetProject (projectId).CompilationOptions; compilationOptions = compilationOptions.WithSpecificDiagnosticOptions ( diff --git a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpVerifierHelper.cs b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpVerifierHelper.cs index bdeb56f1724..3a2b1eae3ac 100644 --- a/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpVerifierHelper.cs +++ b/src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpVerifierHelper.cs @@ -1,10 +1,15 @@ using Microsoft.CodeAnalysis; using Microsoft.CodeAnalysis.CSharp; +using Microsoft.CodeAnalysis.Testing; using System; using System.Collections.Immutable; +using System.IO; internal static class CSharpVerifierHelper { + internal static ReferenceAssemblies DefaultReferenceAssemblies { get; } = + ReferenceAssemblies.Default.WithNuGetConfigFilePath (Path.Combine (AppContext.BaseDirectory, "NuGet.config")); + /// /// By default, the compiler reports diagnostics for nullable reference types at /// , and the analyzer test framework defaults to only validating From a9bf988fd6e03bc9f660ac4145647a9f56265a54 Mon Sep 17 00:00:00 2001 From: Jonathan Peppers Date: Wed, 2 Sep 2026 16:08:55 -0500 Subject: [PATCH 3/4] [ci] Enable CFSClean network isolation (#12643) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - set `networkIsolationPolicy: Permissive,CFSClean` in the shared DevDiv production/PR pipeline entry point - set the same policy in the separate dnceng/internal production pipeline entry point - retain `Permissive` so Android SDK/NDK traffic remains available - rely on centrally required `CFSClean2` and `CFSClean3` instead of listing them in repository YAML - replace `capital P` with `uppercase P` in an sdkmanager parsing comment to avoid a PoliCheck geopolitical false positive without changing behavior | Definition | YAML entry point | 1ES template path | | --- | --- | --- | | DevDiv `11410` — Xamarin.Android | `build-tools/automation/azure-pipelines.yaml` | Official | | DevDiv `12278` — Xamarin.Android-PR | `build-tools/automation/azure-pipelines.yaml` | Unofficial | | dnceng/internal `1644` — dotnet-android-internal | `build-tools/automation/azure-pipelines-internal.yaml` | Official | The dnceng/internal definition is independent of the DevDiv definitions, so both YAML entry points require an explicit setting. `dotnet-android-tools-official` (`1596`) belongs to the separate `dotnet-android-tools` repository and is not in scope. Public, nightly, API-docs, and Renovate definitions are also unchanged. This PR is opened from a branch in the main `dotnet/android` repository so trusted/full definitions can validate the submitted commit. The earlier fork PR was closed. S360 tracks Xamarin.Android (`devdiv/11410`) and Xamarin.Android-PR (`devdiv/12278`). Direct `api.nuget.org` access is classified as a `CFSClean` violation. This change applies the policy without weakening it or adding a public-NuGet allowlist. Final commit: `b63ae9fd6`. The pipeline validation builds below ran against implementation commit `2cc30f604c5742141d9cccff57311614362e99c2`; the final commit changes only comment wording to resolve the resulting PoliCheck false positive. - [Xamarin.Android build 15184305](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15184305&view=results): `Permissive` and `CFSClean` came from `PipelineArguments`; `CFSClean2` and `CFSClean3` came from `PerPipelineRequiredConfig`. Windows Android preparation succeeded. The run reached a 20-minute Mac .NET timeout after its build/tests had otherwise succeeded; its PoliCheck failure is addressed by the final comment-only commit. - [Xamarin.Android-PR build 15184306](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15184306&view=results): the same policy/source composition was applied. `Prepare Solution` downloaded 15 Android archives from `dl.google.com`, including `android-ndk-r28c-windows.zip`, and completed successfully with no network-isolation block. Its PoliCheck failure is addressed by the final comment-only commit. - [dotnet-android-internal build 3064262](https://dev.azure.com/dnceng/internal/_build/results?buildId=3064262&view=results): the same policy/source composition was applied. Its Linux Android archive cache restored successfully, and `make jenkins` actively built native Android targets with the cached SDK CMake and NDK Clang toolchain with no network-isolation or acquisition errors. Expanded `Start Network Isolation` logs for all three definitions report: `Policies=[(Permissive:PipelineArguments), (CFSClean:PipelineArguments), ... (CFSClean2:PerPipelineRequiredConfig), (CFSClean3:PerPipelineRequiredConfig)]` The policy composition and required Android dependency acquisition checks pass; the final comment-only fix removes the observed PoliCheck false positive. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- build-tools/automation/azure-pipelines.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml index 571a8443945..f04552ae25e 100644 --- a/build-tools/automation/azure-pipelines.yaml +++ b/build-tools/automation/azure-pipelines.yaml @@ -83,6 +83,7 @@ extends: suppression: suppressionFile: $(Build.SourcesDirectory)\.gdn\.gdnsuppress settings: + networkIsolationPolicy: Permissive,CFSClean skipBuildTagsForGitHubPullRequests: true stages: - template: /build-tools/automation/yaml-templates/build-macos.yaml@self From d2971fad3b9b0cca3d9250b80d8f8684c5ff9fda Mon Sep 17 00:00:00 2001 From: Jonathan Peppers Date: Wed, 2 Sep 2026 16:23:19 -0500 Subject: [PATCH 4/4] [tests] Route Xamarin.Build.Download Maven downloads through mirror (#12544) ## Summary - update the test Xamarin.Build.Download pin from 0.11.4 to 0.11.6 - expose `XamarinBuildDownloadGoogleMavenRepository` repository-wide through the shared Azure Pipelines variables template - route eligible Google Maven downloads through dnceng's `dotnet-public-maven` feed - directly pin the Google Play Services test that would otherwise resolve XBD 0.11.4 transitively The XBD implementation only rewrites URLs beginning with `https://dl.google.com/dl/android/maven2/`; Android SDK/NDK and partial ZIP URLs such as `dl-ssl.google.com/android/repository/...` remain unchanged. ## Validation - parsed the shared pipeline variables YAML - verified an uppercase Azure Pipelines-style environment variable reaches nested `dotnet msbuild` as `$(XamarinBuildDownloadGoogleMavenRepository)` - built `xa-prep-tasks` and `Xamarin.ProjectTools` - inspected the relevant NuGet dependency graphs to identify transitive XBD consumers - migrated Xamarin.Build.Download 0.11.6 through the quarantine feed and verified it is available on dnceng `dotnet-public` Implementation reference: https://github.com/dotnet/android-libraries/commit/4fe06d57f3ef7905fab0257d7246c97464d29e74 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- build-tools/automation/yaml-templates/variables.yaml | 3 +++ .../Tests/Xamarin.Android.Build.Tests/BuildTest2.cs | 1 + .../Tests/Xamarin.ProjectTools/Android/KnownPackages.cs | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/build-tools/automation/yaml-templates/variables.yaml b/build-tools/automation/yaml-templates/variables.yaml index 23efd8699c9..5bc61d88ff5 100644 --- a/build-tools/automation/yaml-templates/variables.yaml +++ b/build-tools/automation/yaml-templates/variables.yaml @@ -80,6 +80,9 @@ variables: value: true - name: DOTNET_GENERATE_ASPNET_CERTIFICATE value: false +# XBD Google Maven mirror support: https://github.com/dotnet/android-libraries/commit/4fe06d57f3ef7905fab0257d7246c97464d29e74 +- name: XamarinBuildDownloadGoogleMavenRepository + value: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-maven/maven/v1 # Fix network isolation requirements # See https://devdiv.visualstudio.com/DevDiv/_git/Xamarin.yaml-templates/pullrequest/750402 - name: DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE diff --git a/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest2.cs b/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest2.cs index 94cc8fa27a6..27501ae7768 100644 --- a/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest2.cs +++ b/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest2.cs @@ -658,6 +658,7 @@ public void DuplicateRJavaOutput () new Package { Id = "Xamarin.GooglePlayServices.Base", Version = "118.2.0.5" }, new Package { Id = "Xamarin.GooglePlayServices.Basement", Version = "118.2.0.5" }, new Package { Id = "Xamarin.GooglePlayServices.Tasks", Version = "118.0.2.6" }, + KnownPackages.Xamarin_Build_Download, } }; using (var b = CreateApkBuilder ()) { diff --git a/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Android/KnownPackages.cs b/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Android/KnownPackages.cs index 11b95dcc3a7..615f3ff32b5 100644 --- a/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Android/KnownPackages.cs +++ b/src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Android/KnownPackages.cs @@ -127,7 +127,7 @@ public static class KnownPackages }; public static Package Xamarin_Build_Download = new Package { Id = "Xamarin.Build.Download", - Version = "0.11.4", + Version = "0.11.6", }; public static Package NuGet_Build_Packaging = new Package { Id = "NuGet.Build.Packaging",