From 4716b81b6e12b9b29f9363c63123d1e24be5f754 Mon Sep 17 00:00:00 2001 From: Jonathan Peppers Date: Mon, 10 Aug 2026 11:33:31 -0500 Subject: [PATCH 1/2] [ci] Prevent isolated NuGet access Use the supported NuGetAudit MSBuild property and prevent MAUI template creation from performing an implicit restore. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- build-tools/automation/azure-pipelines-internal.yaml | 6 +++--- build-tools/automation/azure-pipelines-public.yaml | 2 +- build-tools/automation/azure-pipelines.yaml | 2 +- build-tools/automation/yaml-templates/variables.yaml | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/build-tools/automation/azure-pipelines-internal.yaml b/build-tools/automation/azure-pipelines-internal.yaml index 8cdc19b6b09..b6e241828c9 100644 --- a/build-tools/automation/azure-pipelines-internal.yaml +++ b/build-tools/automation/azure-pipelines-internal.yaml @@ -59,8 +59,8 @@ variables: value: $[ format('{0}.{1}', format('{0:yyyyMMdd}', pipeline.startTime), counter(format('{0:yyyyMMdd}', pipeline.startTime), 1)) ] - name: DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE value: 'true' -- name: DOTNET_SDK_VULNERABILITY_CHECK_DISABLE - value: 'true' +- name: NuGetAudit + value: 'false' # Override for internal pipeline - name: DefaultJavaSdkMajorVersion value: 21 @@ -903,7 +903,7 @@ stages: - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml parameters: command: new - arguments: maui -o $(Build.StagingDirectory)/MauiTestProj + arguments: maui -o $(Build.StagingDirectory)/MauiTestProj --no-restore xaSourcePath: $(Build.SourcesDirectory)/android displayName: Create MAUI template continueOnError: false diff --git a/build-tools/automation/azure-pipelines-public.yaml b/build-tools/automation/azure-pipelines-public.yaml index 0b0f4e1a557..9d7efb48772 100644 --- a/build-tools/automation/azure-pipelines-public.yaml +++ b/build-tools/automation/azure-pipelines-public.yaml @@ -591,7 +591,7 @@ stages: - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml parameters: command: new - arguments: maui -o $(Build.StagingDirectory)/MauiTestProj + arguments: maui -o $(Build.StagingDirectory)/MauiTestProj --no-restore xaSourcePath: $(Build.SourcesDirectory)/android displayName: Create MAUI template continueOnError: false diff --git a/build-tools/automation/azure-pipelines.yaml b/build-tools/automation/azure-pipelines.yaml index d446d264b94..b20d0acdf68 100644 --- a/build-tools/automation/azure-pipelines.yaml +++ b/build-tools/automation/azure-pipelines.yaml @@ -207,7 +207,7 @@ extends: - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml@self parameters: command: new - arguments: maui -o $(Build.StagingDirectory)/MauiTestProj + arguments: maui -o $(Build.StagingDirectory)/MauiTestProj --no-restore xaSourcePath: $(Build.SourcesDirectory)/android displayName: Create MAUI template continueOnError: false diff --git a/build-tools/automation/yaml-templates/variables.yaml b/build-tools/automation/yaml-templates/variables.yaml index cc638e08919..4a26dc8d8fe 100644 --- a/build-tools/automation/yaml-templates/variables.yaml +++ b/build-tools/automation/yaml-templates/variables.yaml @@ -80,5 +80,5 @@ variables: # See https://devdiv.visualstudio.com/DevDiv/_git/Xamarin.yaml-templates/pullrequest/750402 - name: DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE value: 'true' -- name: DOTNET_SDK_VULNERABILITY_CHECK_DISABLE - value: 'true' +- name: NuGetAudit + value: 'false' From 40e973168f64b2f3160fee7984e2a007ec55461e Mon Sep 17 00:00:00 2001 From: Jonathan Peppers Date: Tue, 11 Aug 2026 10:43:17 -0500 Subject: [PATCH 2/2] [ci] Retain SDK vulnerability metadata guard Keep DOTNET_SDK_VULNERABILITY_CHECK_DISABLE alongside NuGetAudit because the .NET SDK and NuGet use them for separate background metadata and package advisory network paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 52401e09-952c-4060-8494-5c88aa2bbc61 --- build-tools/automation/azure-pipelines-internal.yaml | 2 ++ build-tools/automation/yaml-templates/variables.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/build-tools/automation/azure-pipelines-internal.yaml b/build-tools/automation/azure-pipelines-internal.yaml index b6e241828c9..90697db3759 100644 --- a/build-tools/automation/azure-pipelines-internal.yaml +++ b/build-tools/automation/azure-pipelines-internal.yaml @@ -59,6 +59,8 @@ variables: value: $[ format('{0}.{1}', format('{0:yyyyMMdd}', pipeline.startTime), counter(format('{0:yyyyMMdd}', pipeline.startTime), 1)) ] - name: DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE value: 'true' +- name: DOTNET_SDK_VULNERABILITY_CHECK_DISABLE + value: 'true' - name: NuGetAudit value: 'false' # Override for internal pipeline diff --git a/build-tools/automation/yaml-templates/variables.yaml b/build-tools/automation/yaml-templates/variables.yaml index 4a26dc8d8fe..431b75ff9f4 100644 --- a/build-tools/automation/yaml-templates/variables.yaml +++ b/build-tools/automation/yaml-templates/variables.yaml @@ -80,5 +80,7 @@ variables: # See https://devdiv.visualstudio.com/DevDiv/_git/Xamarin.yaml-templates/pullrequest/750402 - name: DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE value: 'true' +- name: DOTNET_SDK_VULNERABILITY_CHECK_DISABLE + value: 'true' - name: NuGetAudit value: 'false'