Merge latest Library.Template

.config/dotnet-tools.json

@@ -10,7 +10,7 @@
       "rollForward": false
     },
     "dotnet-coverage": {
-      "version": "17.13.1",
+      "version": "17.14.2",
       "commands": [
         "dotnet-coverage"
       ],
@@ -24,7 +24,7 @@
       "rollForward": false
     },
     "docfx": {
-      "version": "2.78.2",
+      "version": "2.78.3",
       "commands": [
         "docfx"
       ],

.devcontainer/Dockerfile

@@ -1,5 +1,5 @@
 # Refer to https://hub.docker.com/_/microsoft-dotnet-sdk for available versions
-FROM mcr.microsoft.com/dotnet/sdk:9.0.102-noble
+FROM mcr.microsoft.com/dotnet/sdk:9.0.202-noble@sha256:332e0362dd210a10348d436a5fb7f87aeec28c2c53ac2c3c2659e57c22294d0e
 
 # Installing mono makes `dotnet test` work without errors even for net472.
 # But installing it takes a long time, so it's excluded by default.

.github/actions/publish-artifacts/action.yaml

@@ -14,46 +14,46 @@ runs:
 
   - name: 📢 Upload project.assets.json files
     if: always()
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: projectAssetsJson-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/projectAssetsJson
     continue-on-error: true
   - name: 📢 Upload variables
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: variables-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/Variables
     continue-on-error: true
   - name: 📢 Upload build_logs
     if: always()
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: build_logs-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/build_logs
     continue-on-error: true
   - name: 📢 Upload testResults
     if: always()
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: testResults-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/testResults
     continue-on-error: true
   - name: 📢 Upload coverageResults
     if: always()
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: coverageResults-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/coverageResults
     continue-on-error: true
   - name: 📢 Upload symbols
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: symbols-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/symbols
     continue-on-error: true
   - name: 📢 Upload deployables
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
     with:
       name: deployables-${{ runner.os }}
       path: ${{ runner.temp }}/_artifacts/deployables

.github/renovate.json

@@ -1,52 +1,8 @@
 {
 	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
-	"extends": ["config:recommended"],
-	"semanticCommits": "disabled",
-	"labels": ["dependencies"],
-	"packageRules": [
-		{
-			"matchPackageNames": ["nbgv", "nerdbank.gitversioning"],
-			"groupName": "nbgv and nerdbank.gitversioning updates"
-		},
-		{
-			"matchPackageNames": ["xunit*"],
-			"groupName": "xunit"
-		},
-		{
-			"matchDatasources": ["dotnet-version", "docker"],
-			"matchDepNames": ["dotnet-sdk", "mcr.microsoft.com/dotnet/sdk"],
-			"groupName": "Dockerfile and global.json updates"
-		},
-		{
-			"matchPackageNames": ["*"],
-			"allowedVersions": "!/-g[a-f0-9]+$/"
-		},
-		{
-			"matchPackageNames": [
-				"System.Collections.Immutable",
-				"System.Composition*",
-				"System.Diagnostics.DiagnosticSource",
-				"System.IO.Pipelines",
-				"System.Reflection.Metadata",
-				"System.Text.Json",
-				"System.Threading.Tasks.Dataflow",
-				"Microsoft.Bcl.AsyncInterfaces"
-			],
-			"allowedVersions": "<9.0",
-			"groupName": "Included in .NET runtime"
-		},
-		{
-			"matchPackageNames": ["Microsoft.VisualStudio.Internal.MicroBuild*"],
-			"groupName": "microbuild"
-		},
-		{
-			"matchPackageNames": ["Microsoft.VisualStudio.*"],
-			"groupName": "Visual Studio SDK"
-		},
-		{
-			"matchPackageNames": ["Microsoft.VisualStudio.*"],
-			"matchUpdateTypes": ["patch"],
-			"enabled": false
-		}
-	]
+	"extends": [
+		"github>microsoft/vs-renovate-presets:microbuild",
+		"github>microsoft/vs-renovate-presets:vs_main_dependencies"
+	],
+	"packageRules": []
 }

.github/workflows/docs.yml

@@ -25,7 +25,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
     - name: ⚙ Install prerequisites
@@ -35,10 +35,10 @@ jobs:
       name: 📚 Generate documentation
 
     - name: Upload artifact
-      uses: actions/upload-pages-artifact@v3
+      uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
       with:
         path: docfx/_site
 
     - name: Deploy to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@v4
+      uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/libtemplate-update.yml

@@ -17,7 +17,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 

Directory.Packages.props

@@ -35,8 +35,7 @@
     <GlobalPackageReference Include="CSharpIsNullAnalyzer" Version="0.1.593" />
     <GlobalPackageReference Include="DotNetAnalyzers.DocumentationAnalyzers" Version="1.0.0-beta.59" />
     <GlobalPackageReference Include="Microsoft.VisualStudio.Internal.MicroBuild.VisualStudio" Version="$(MicroBuildVersion)" />
-    <!-- The condition works around https://github.com/dotnet/sdk/issues/44951 -->
-    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.7.115" Condition="!('$(TF_BUILD)'=='true' and '$(dotnetformat)'=='true')" />
+    <GlobalPackageReference Include="Nerdbank.GitVersioning" Version="3.7.115" />
     <GlobalPackageReference Include="PolySharp" Version="1.15.0" />
     <GlobalPackageReference Include="StyleCop.Analyzers.Unstable" Version="1.2.0.556" />
   </ItemGroup>

azure-pipelines/build.yml

@@ -71,6 +71,10 @@ parameters:
   type: boolean
   default: true
 
+- name: PublishCodeCoverage
+  type: boolean
+  default: true
+
 # Whether this is a special one-off build for inserting into VS for a validation insertion PR (that will never be merged).
 - name: SkipCodesignVerify
   type: boolean
@@ -194,7 +198,7 @@ jobs:
       IsOptProf: ${{ parameters.IsOptProf }}
 
   - ${{ if and(parameters.EnableDotNetFormatCheck, not(parameters.EnableLinuxBuild)) }}:
-    - script: dotnet format --verify-no-changes
+    - script: dotnet format --verify-no-changes --no-restore
       displayName: 💅 Verify formatted code
       env:
         dotnetformat: true # part of a workaround for https://github.com/dotnet/sdk/issues/44951
@@ -236,7 +240,7 @@ jobs:
           Is1ESPT: ${{ parameters.Is1ESPT }}
           RunTests: ${{ parameters.RunTests }}
       - ${{ if parameters.EnableDotNetFormatCheck }}:
-        - script: dotnet format --verify-no-changes
+        - script: dotnet format --verify-no-changes --no-restore
           displayName: 💅 Verify formatted code
           env:
             dotnetformat: true # part of a workaround for https://github.com/dotnet/sdk/issues/44951
@@ -299,7 +303,7 @@ jobs:
       parameters:
         EnableLinuxBuild: ${{ parameters.EnableLinuxBuild }}
         EnableMacOSBuild: ${{ parameters.EnableMacOSBuild }}
-    - ${{ if parameters.RunTests }}:
+    - ${{ if and(parameters.RunTests, parameters.PublishCodeCoverage) }}:
       - template: publish-codecoverage.yml
         parameters:
           EnableLinuxBuild: ${{ parameters.EnableLinuxBuild }}

azure-pipelines/dotnet.yml

@@ -8,7 +8,7 @@ parameters:
 
 steps:
 
-- script: dotnet build -t:build,pack --no-restore -c $(BuildConfiguration) -warnAsError -warnNotAsError:NU1901,NU1902,NU1903,NU1904 /bl:"$(Build.ArtifactStagingDirectory)/build_logs/build.binlog"
+- script: dotnet build -t:build,pack --no-restore -c $(BuildConfiguration) -warnAsError -warnNotAsError:NU1901,NU1902,NU1903,NU1904,LOCTASK002 /bl:"$(Build.ArtifactStagingDirectory)/build_logs/build.binlog"
   displayName: 🛠 dotnet build
 
 - ${{ if not(parameters.IsOptProf) }}:

azure-pipelines/official.yml

@@ -28,6 +28,10 @@ parameters:
   displayName: Include APIScan with compliance tools
   type: boolean
   default: true
+- name: PublishCodeCoverage
+  displayName: Publish code coverage
+  type: boolean
+  default: true
 
 resources:
   repositories:
@@ -47,14 +51,14 @@ extends:
       codeSignValidation:
         enabled: true
         break: true
-        additionalTargetsGlobPattern: -|Variables-*\*.ps1;-|APIScanInputs-*\**;-|test_symbols-*\**;-|MicroBuild\**
+        additionalTargetsGlobPattern: -|Variables-*\*.ps1;-|LocBin-*\**;-|APIScanInputs-*\**;-|test_symbols-*\**;-|MicroBuild\**
       policheck:
         enabled: true
         exclusionsFile: $(System.DefaultWorkingDirectory)\azure-pipelines\PoliCheckExclusions.xml
       suppression:
         suppressionFile: $(System.DefaultWorkingDirectory)\azure-pipelines\falsepositives.gdnsuppress
       sbom:
-        enabled: true
+        enabled: false # Skip 1ES SBOM because microbuild has our own sbom system
     stages:
     - stage: Build
       variables:
@@ -78,6 +82,7 @@ extends:
             os: macOS
           EnableMacOSBuild: ${{ parameters.EnableMacOSBuild }}
           RunTests: ${{ parameters.RunTests }}
+          PublishCodeCoverage: ${{ parameters.PublishCodeCoverage }}
     - template: /azure-pipelines/prepare-insertion-stages.yml@self
       parameters:
         RealSign: true

azure-pipelines/unofficial.yml

@@ -36,6 +36,10 @@ parameters:
   displayName: Enable Production SDL
   type: boolean
   default: false
+- name: PublishCodeCoverage
+  displayName: Publish code coverage
+  type: boolean
+  default: true
 
 resources:
   repositories:
@@ -64,7 +68,7 @@ extends:
         enabled: ${{ parameters.EnableProductionSDL }}
         exclusionsFile: $(System.DefaultWorkingDirectory)\azure-pipelines\PoliCheckExclusions.xml
       sbom:
-        enabled: ${{ parameters.EnableProductionSDL }}
+        enabled: false # Skip 1ES SBOM because microbuild has our own sbom system
     stages:
     - stage: Build
       variables:
@@ -88,3 +92,4 @@ extends:
             os: macOS
           EnableMacOSBuild: ${{ parameters.EnableMacOSBuild }}
           RunTests: ${{ parameters.RunTests }}
+          PublishCodeCoverage: ${{ parameters.PublishCodeCoverage }}

azure-pipelines/vs-insertion.yml

@@ -32,6 +32,8 @@ extends:
       - job: insertion
         displayName: VS insertion
         pool: VSEngSS-MicroBuild2022-1ES
+        templateContext:
+          outputParentDirectory: $(Pipeline.Workspace)/CI
         steps:
         - checkout: none
         - powershell: Write-Host "##vso[build.updatebuildnumber]$(resources.pipeline.CI.runName)"