Merge branch 'microsoft:main' into client-assertion

Author: dongle-the-gadget

.github/dependabot.yml

@@ -5,3 +5,5 @@ updates:
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -10,8 +10,8 @@ on:
     branches: [ "main" ]
 
 jobs:
-  build-nuget-and-tests:
-    name: Build Nuget and Run Tests
+  build-and-test:
+    name: Build and Run Tests
     strategy:
       fail-fast: false
       matrix:
@@ -20,13 +20,13 @@ jobs:
     permissions:
       checks: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
-        dotnet-version: 9.0.x
+        dotnet-version: 10.0.x
     - name: Install and Configure Keyring
       if: ${{ matrix.os == 'ubuntu-latest' }}
       run: |
@@ -43,36 +43,27 @@ jobs:
       run: dotnet restore MSStore.CLI.sln /p:Configuration=Release
     - name: Build
       run: dotnet build MSStore.CLI.sln --no-restore /p:Configuration=Release
-    - name: Test net9.0
-      run: dotnet run --project MSStore.CLI.UnitTests -f net9.0 --no-build -c Release --coverage --coverage-output-format cobertura --report-trx --results-directory ./TestResults
-    - name: Test net9.0-windows10.0.17763.0
+    - name: Test net10.0
+      run: dotnet run --project MSStore.CLI.UnitTests -f net10.0 --no-build -c Release --coverage --coverage-output-format cobertura --report-trx --results-directory ./TestResults
+    - name: Test net10.0-windows10.0.17763.0
       if: ${{ matrix.os == 'windows-latest' }}
-      run: dotnet run --project MSStore.CLI.UnitTests -f net9.0-windows10.0.17763.0 --no-build -c Release --coverage --coverage-output-format cobertura --report-trx --results-directory ./TestResults
+      run: dotnet run --project MSStore.CLI.UnitTests -f net10.0-windows10.0.17763.0 --no-build -c Release --coverage --coverage-output-format cobertura --report-trx --results-directory ./TestResults
     - name: Publish test results
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: test-results-${{ matrix.os }}
         path: TestResults/*.trx
     - name: Install ReportGenerator
-      run: dotnet tool install --global dotnet-reportgenerator-globaltool --version 5.4.11
+      run: dotnet tool install --global dotnet-reportgenerator-globaltool --version 5.5.1
     - name: Merge code coverage files
       run: reportgenerator "-reports:${{ github.workspace }}/**/*.cobertura.xml" "-targetdir:${{ github.workspace }}/report" "-reporttypes:Cobertura" "-filefilters:-*GenerationContext*.g.cs"
     - name: Publish code coverage results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: Cobertura-${{ matrix.os }}
         path: ${{ github.workspace }}/report/Cobertura.xml
     # TODO: Publish github comment with code coverage
-    - name: Pack NuGet
-      if: ${{ matrix.os == 'ubuntu-latest' }}
-      run: dotnet pack MSStore.API --no-build -c Release
-    - name: Upload Artifact - NuGet
-      if: ${{ matrix.os == 'ubuntu-latest' }}
-      uses: actions/upload-artifact@v4
-      with:
-        name: NuGet
-        path: MSStore.API/bin/Release/*.nupkg
 
   build-cli:
     strategy:
@@ -84,38 +75,43 @@ jobs:
         include:
           - os: windows-latest
             dotnet-os: win
-            dotnet-framework: net9.0-windows10.0.17763.0
+            dotnet-framework: net10.0-windows10.0.17763.0
           - os: ubuntu-latest
             dotnet-os: linux
-            dotnet-framework: net9.0
+            dotnet-framework: net10.0
           - os: macos-latest
             dotnet-os: osx
-            dotnet-framework: net9.0
+            dotnet-framework: net10.0
     runs-on: ${{ matrix.os }}
 
     name: Build CLI - ${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
-        dotnet-version: 9.0.x
+        dotnet-version: 10.0.x
     - name: Add msbuild to PATH
       if: ${{ matrix.os == 'windows-latest' }}
-      uses: microsoft/setup-msbuild@v2
+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
     - name: Install NBGV tool
       run: dotnet tool install --tool-path . nbgv
     - name: Set Version
       run: ./nbgv cloud
-    - name: Restore CLI
-      run: dotnet restore MSStore.CLI -r ${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }} /p:Configuration=Release /p:PublishReadyToRun=true
-    - name: Build CLI
-      run: dotnet build MSStore.CLI --no-restore --no-self-contained -r ${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }} -f ${{ matrix.dotnet-framework }} /p:Configuration=Release
+    - name: Install linux-arm64 NativeAOT toolchain
+      if: ${{ matrix.os == 'ubuntu-latest' && matrix.dotnet-arch == 'arm64' }}
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y \
+          clang llvm lld \
+          binutils-aarch64-linux-gnu \
+          gcc-aarch64-linux-gnu g++-aarch64-linux-gnu \
+          libc6-dev-arm64-cross
     - name: Publish SelfContained CLI
-      run: dotnet publish MSStore.CLI --no-build --no-self-contained -r ${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }} -f ${{ matrix.dotnet-framework }} /p:Configuration=Release /p:PublishProfile=${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }}
+      run: dotnet publish MSStore.CLI --self-contained -r ${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }} -f ${{ matrix.dotnet-framework }} /p:Configuration=Release /p:PublishProfile=${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }}
     - run: |
          New-Item -ItemType File -Path ".\MSStore.CLI.MSIX\obj\${{ matrix.dotnet-arch }}\appxmanifest.xml" -Force
          Copy-Item ".\MSStore.CLI.MSIX\Package.appxmanifest" -Destination ".\MSStore.CLI.MSIX\obj\${{ matrix.dotnet-arch }}\appxmanifest.xml" -Force
@@ -135,13 +131,13 @@ jobs:
       run: ."C:\Program Files (x86)\Windows Kits\10\App Certification Kit\SignTool.exe" sign /fd SHA256 /a /f .\MSStore.CLI.MSIX\MSStore.CLI.MSIX_TemporaryKey.pfx ${{ github.workspace }}/MSStore.CLI.MSIX/AppPackages/${{ matrix.dotnet-arch }}/MSStore.CLI.MSIX_${{ env.GitBuildVersionSimple }}.0_${{ matrix.dotnet-arch }}_Test.msix
     - name: Upload Artifact - CLI
       if: ${{ !env.ACT }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: CLI-${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }}
         path: ${{ github.workspace }}/MSStore.CLI/bin/Release/${{ matrix.dotnet-framework }}/${{ matrix.dotnet-os }}-${{ matrix.dotnet-arch }}/publish/**/*
     - name: Upload Artifact - MSIX
       if: ${{ matrix.os == 'windows-latest' && !env.ACT }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: CLI-MSIX-${{ matrix.dotnet-arch }}
         path: ${{ github.workspace }}/MSStore.CLI.MSIX/AppPackages/${{ matrix.dotnet-arch }}/MSStore.CLI.MSIX_${{ env.GitBuildVersionSimple }}.0_${{ matrix.dotnet-arch }}_Test.msix

.github/workflows/test-report.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Display test results
-      uses: dorny/test-reporter@v1
+      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       with:
         artifact: test-results-${{ matrix.os }}
         name: Test - Results - ${{ matrix.os }}

.pipelines/build.yml

@@ -16,11 +16,6 @@ parameters:
     type: object
     default:
       - Release
-  - name: buildPlatforms
-    type: object
-    default:
-      - x64
-      - arm64
   - name: pools
     type: object
     default:
@@ -49,7 +44,7 @@ extends:
       credscan:
         suppressionsFile: '$(System.DefaultWorkingDirectory)/.pipelines/CredScanSuppressions.json'
       binSkim:
-        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net9.0\MSStore.API.dll'
+        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net10.0\MSStore.API.dll'
     stages:
       - stage: Build_And_Run_CodeQL
         jobs:
@@ -63,17 +58,15 @@ extends:
               steps:
               - checkout: self
               - task: UseDotNet@2
-                displayName: Setup .NET 9
+                displayName: Setup .NET 10
                 inputs:
-                  version: 9.0.x
+                  version: 10.0.x
               - script: mv -f $(Build.SourcesDirectory)/.pipelines/release-nuget.config ./nuget.config
                 displayName: Add release package source
               - task: NuGetAuthenticate@1
               - script: dotnet restore MSStore.CLI.sln /p:Configuration=${{ dotnet_config }}
                 displayName: Restore dependencies
-              - template: ./.pipelines/templates/build-nuget.yaml@self
+              - template: ./.pipelines/templates/build-and-tests.yaml@self
                 parameters:
                   dotnet_configuration: ${{ dotnet_config }}
-                  AgentOS: $(Agent.OS)
-                  DoEsrp: false
-                  signingIdentity: {}
+                  AgentOS: $(Agent.OS)

.pipelines/code-inspector.yaml

@@ -35,7 +35,7 @@ extends:
       credscan:
         suppressionsFile: '$(System.DefaultWorkingDirectory)/.pipelines/CredScanSuppressions.json'
       binSkim:
-        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net9.0\MSStore.API.dll'
+        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net10.0\MSStore.API.dll'
     stages:
     - stage: codeInspector
       displayName: Code Inspector

.pipelines/publish_release.yml

@@ -173,9 +173,6 @@ extends:
     - stage: HomeBrew
       displayName: MacOS HomeBrew Deployment
       dependsOn: GitHub_Release_And_MSStore
-      variables:
-      - name: GitHubPAT
-        value: $(GitHubPAT)
       jobs:
       - job: PreDeploymentApprovalJob
         displayName: Pre-Deployment Approval
@@ -195,8 +192,10 @@ extends:
         steps:
         - task: CmdLine@2
           displayName: Checkout HomeBrew Repo
+          env:
+            GITHUB_PAT: $(GitHubPAT)
           inputs:
-            script: git clone https://oauth2:$(GitHubPAT)@github.com/microsoft/homebrew-msstore-cli.git $(Pipeline.Workspace)\homebrew-msstore-cli
+            script: git clone https://oauth2:%GITHUB_PAT%@github.com/microsoft/homebrew-msstore-cli.git $(Pipeline.Workspace)\homebrew-msstore-cli
         - task: DownloadGitHubRelease@0
           displayName: Download GitHub Release
           inputs:

.pipelines/release.yml

@@ -40,17 +40,17 @@ parameters:
       image: windows-latest
       os: windows
       dotnet_runtime: win
-      dotnet_framework: net9.0-windows10.0.17763.0
+      dotnet_framework: net10.0-windows10.0.17763.0
     - name: Azure-Pipelines-1ESPT-ExDShared
       image: ubuntu-latest
       os: linux
       dotnet_runtime: linux
-      dotnet_framework: net9.0
+      dotnet_framework: net10.0
     - name: Azure Pipelines
       image: macos-latest
       os: macOS
       dotnet_runtime: osx
-      dotnet_framework: net9.0
+      dotnet_framework: net10.0
 
 name: 0.0.$(Date:yyMM).$(Date:dd)$(Rev:rr)
 
@@ -69,51 +69,36 @@ extends:
       credscan:
         suppressionsFile: '$(System.DefaultWorkingDirectory)/.pipelines/CredScanSuppressions.json'
       binSkim:
-        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net9.0\MSStore.API.dll'
+        AnalyzeTargetGlob: '$(System.DefaultWorkingDirectory)\MSStore.API\bin\**\net10.0\MSStore.API.dll'
     stages:
-      - stage: NuGet
+      - stage: Build_And_Tests
         jobs:
         - ${{ each pool in parameters.pools }}:
           - ${{ each dotnet_config in parameters.dotnet_configurations }}:
-            - job: Build_Nuget_And_Tests_${{ pool.os }}_${{ dotnet_config }}
-              displayName: Build Nuget and Run Tests (${{ pool.os }}_${{ dotnet_config }})
+            - job: Build_And_Tests_${{ pool.os }}_${{ dotnet_config }}
+              displayName: Build and Run Tests (${{ pool.os }}_${{ dotnet_config }})
               pool:
                 name: ${{ pool.name }}
                 image: ${{ pool.image }}
                 os: ${{ pool.os }}
               steps:
               - checkout: self
               - task: UseDotNet@2
-                displayName: Setup .NET 9
+                displayName: Setup .NET 10
                 inputs:
-                  version: 9.0.x
-              - ${{ if eq(parameters.DoEsrp, 'true') }}:
-                - task: UseDotNet@2
-                  displayName: Setup .NET 6.0 (For ESRP Task)
-                  condition: startsWith(variables['Agent.OS'], 'Linux')
-                  inputs:
-                    packageType: runtime
-                    version: 6.0.x
+                  version: 10.0.x
               - script: mv -f $(Build.SourcesDirectory)/.pipelines/release-nuget.config ./nuget.config
                 displayName: Add release package source
               - task: NuGetAuthenticate@1
               - script: dotnet restore MSStore.CLI.sln /p:Configuration=${{ dotnet_config }}
                 displayName: Restore dependencies
-              - template: ./.pipelines/templates/build-nuget.yaml@self
-                parameters:
-                  dotnet_configuration: ${{ dotnet_config }}
-                  AgentOS: $(Agent.OS)
-                  DoEsrp: ${{ parameters.DoEsrp }}
-                  signingIdentity: ${{ parameters.signingIdentity }}
-              - template: ./.pipelines/templates/pack-nuget.yaml@self
+              - template: ./.pipelines/templates/build-and-tests.yaml@self
                 parameters:
                   dotnet_configuration: ${{ dotnet_config }}
                   AgentOS: $(Agent.OS)
-                  DoEsrp: ${{ parameters.DoEsrp }}
-                  signingIdentity: ${{ parameters.signingIdentity }}
 
       - stage: CLI
-        dependsOn: NuGet
+        dependsOn: Build_And_Tests
         jobs:
         - ${{ each pool in parameters.pools }}:
           - ${{ each dotnet_config in parameters.dotnet_configurations }}:
@@ -128,9 +113,9 @@ extends:
                 - checkout: self
                   persistCredentials: true
                 - task: UseDotNet@2
-                  displayName: Setup .NET 9
+                  displayName: Setup .NET 10
                   inputs:
-                    version: 9.0.x
+                    version: 10.0.x
                 - ${{ if eq(parameters.DoEsrp, 'true') }}:
                   - task: UseDotNet@2
                     displayName: Setup .NET 6.0 (For ESRP Task)
@@ -150,7 +135,7 @@ extends:
                     xmlTargetFiles: ''
                     xmlTransformationRules: ''
                 - task: NuGetAuthenticate@1
-                - script: dotnet restore MSStore.CLI -r ${{ pool.dotnet_runtime }}-${{ platform }} /p:Configuration=${{ dotnet_config }} /p:PublishReadyToRun=true
+                - script: dotnet restore MSStore.CLI -r ${{ pool.dotnet_runtime }}-${{ platform }} /p:Configuration=${{ dotnet_config }}
                   displayName: Restore CLI
                 - template: ./.pipelines/templates/build-cli.yaml@self
                   parameters: