Skip to content

Enable CFSClean* policies for dotnet-crank-ci-official pipeline #873

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LoopedBard3 merged 2 commits into from
Mar 23, 2026
Merged

Enable CFSClean* policies for dotnet-crank-ci-official pipeline #873

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b5b5637
Enable CFSClean* policies for dotnet-crank-ci-official pipeline
mmitche Mar 18, 2026
e90a147
Update crank to use dotnet-public feed instead of nuget.org
mmitche Mar 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions azure-pipelines.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ resources:
extends:
template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
parameters:
settings:
networkIsolationPolicy: Permissive, CFSClean, CFSClean2
sdl:
sourceAnalysisPool:
name: $(DncEngInternalBuildPool)
Expand Down
13 changes: 11 additions & 2 deletions src/Microsoft.Crank.Agent/Startup.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ public class Startup
private static readonly string _dotnetInstallShUrl = "https://dot.net/v1/dotnet-install.sh";
private static readonly string _dotnetInstallPs1Url = "https://dot.net/v1/dotnet-install.ps1";
private static readonly string _perfviewUrl = $"https://github.com/Microsoft/perfview/releases/download/{PerfViewVersion}/PerfView.exe";
private static readonly string _ultraUrl = $"https://www.nuget.org/api/v2/package/ultra/{UltraVersion}";
private static readonly string _ultraUrl = $"https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/flat2/ultra/{UltraVersion}/ultra.{UltraVersion}.nupkg";

private static readonly string _aspnet8FlatContainerUrl = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet8/nuget/v3/flat2/Microsoft.AspNetCore.App.Runtime.linux-x64/index.json";
private static readonly string _aspnet9FlatContainerUrl = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/flat2/Microsoft.AspNetCore.App.Runtime.linux-x64/index.json";
Expand Down Expand Up @@ -4156,7 +4156,9 @@ internal static void PatchNuGetConfig(string benchmarkedApp)
configPath = Path.Combine(benchmarkedApp, "NuGet.config");
doc = new XDocument(
new XElement("configuration",
new XElement("packageSources")
new XElement("packageSources",
new XElement("clear")
)
Comment on lines +4159 to +4161
Copy link

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding to the generated NuGet.config prevents inheriting machine/user-level sources, which can change restore behavior for benchmarked apps that rely on those sources. If this is intended only for CFSClean/CFSClean2 runs, consider gating this behavior behind a build/environment flag (or explicitly add the required upstream sources here) so permissive/local runs don’t unexpectedly lose access to needed feeds.

Copilot uses AI. Check for mistakes.
)
);
Log.Info($"Creating new NuGet.config at {configPath}");
Expand All @@ -4177,6 +4179,12 @@ internal static void PatchNuGetConfig(string benchmarkedApp)
root.Add(packageSources);
}

// Ensure <clear /> is present to prevent inheriting nuget.org from machine/user-level configs
if (packageSources.Element("clear") == null)
{
packageSources.AddFirst(new XElement("clear"));
}

// Track which source keys we actually add (for packageSourceMapping)
var addedSourceKeys = new List<string>();

Expand Down Expand Up @@ -6376,6 +6384,7 @@ public static async Task EnsureDotnetInstallExistsAsync()
File.WriteAllText(rootNugetConfig, @"<?xml version=""1.0"" encoding=""utf-8""?>
<configuration>
<packageSources>
<clear />
Copy link
Copy Markdown
Member

@sebastienros sebastienros Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should be fine since this is added to the root folder

<add key=""dotnet11"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet11/nuget/v3/index.json"" />
<add key=""dotnet11-transport"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet11-transport/nuget/v3/index.json"" />
<add key=""dotnet10"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json"" />
Expand Down
2 changes: 1 addition & 1 deletion src/Microsoft.Crank.Controller/VersionChecker.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ namespace Microsoft.Crank.Controller
public static class VersionChecker
{
static TimeSpan CacheTimeout = TimeSpan.FromDays(1);
static string PackageVersionUrl = "https://api.nuget.org/v3-flatcontainer/microsoft.crank.controller/index.json";
static string PackageVersionUrl = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/flat2/microsoft.crank.controller/index.json";
Copy link
Copy Markdown
Member

@sebastienros sebastienros Mar 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dotnet tool which is installed from nuget.org is checking the nuget feed for new versions in order to display a warning. Should we care here?

Copy link
Copy Markdown
Member Author

@mmitche mmitche Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's installed from nuget.org...wouldn't there not ever be a newer package anyway?


public static async Task CheckUpdateAsync(HttpClient client)
{
Expand Down
Loading