[automated] Merge branch 'main' => 'release/dnup'

.github/copilot-instructions.md

@@ -31,12 +31,17 @@ Testing:
   - Test commands in the dogfood shell (e.g., `dnx --help`, `dotnet tool install --help`)
   - The dogfood script sets up PATH and environment to use the newly built SDK
 
+Investigating PR validation failures:
+1. Read the PR and its comments/reviews. Check for references to other PRs or issues where the problem might have already been solved.
+2. Use the `ci-analysis` skill (if available) to diagnose build failures.
+
 Output Considerations:
 - When considering how output should look, solicit advice from baronfel.
 
 Localization:
 - Avoid modifying .xlf files and instead prompt the user to update them using the `/t:UpdateXlf` target on MSBuild. Correctly automatically modified .xlf files have elements with state `needs-review-translation` or `new`.
 - Consider localizing strings in .resx files when possible.
+- When adding a new NETSDK error message in `src/Tasks/Common/Resources/Strings.resx`, assign the next available NETSDK code, append the entry at the end of the file, and update the trailing "latest message added" guard comment.
 
 Documentation:
 - Do not manually edit files under documentation/manpages/sdk as these are generated based on documentation and should not be manually modified.

.github/dependabot.yml

@@ -9,6 +9,10 @@ updates:
     labels:
       - "dependencies"
       - "dependabot: main"
+    ignore:
+      # arcade and helix are updated by the automated codeflow process
+      - dependency-name: "Microsoft.DotNet.Arcade.Sdk"
+      - dependency-name: "Microsoft.DotNet.Helix.Sdk"
 
   # - package-ecosystem: "nuget"
   #   directory: "/eng/dependabot"

.github/workflows/add-servicing-consider-label.yml

@@ -0,0 +1,86 @@
+name: Add Servicing-consider Label to PRs
+
+on:
+  # zizmor: ignore[dangerous-triggers] -- no PR code is checked out; only adds a label via API
+  pull_request_target:
+    types: [opened, reopened, ready_for_review]
+    branches:
+      - 'release/[0-9]*'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  add-servicing-label:
+    runs-on: ubuntu-latest
+    # Only run in the dotnet/sdk repository
+    if: github.repository == 'dotnet/sdk'
+
+    steps:
+      - name: Add Servicing-consider label if needed
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const prNumber = pr.number;
+
+            // Skip if the PR already has the Servicing-consider or Servicing-approved label
+            const labels = pr.labels.map(l => l.name);
+            if (labels.includes('Servicing-consider') || labels.includes('Servicing-approved')) {
+              console.log('PR already has a servicing label, skipping.');
+              return;
+            }
+
+            // Skip codeflow PRs: inter-branch merge flow and darc subscription PRs.
+            // Only skip known codeflow bot accounts; other bots (e.g. Dependabot) should
+            // still receive the label. Backport PRs carry the 'backport' label and are
+            // also exempt from this skip.
+            const author = pr.user.login;
+            const codeflowBots = ['dotnet-maestro[bot]', 'github-actions[bot]', 'dotnet-maestro'];
+            const isBackport = labels.includes('backport');
+            if (codeflowBots.includes(author) && !isBackport) {
+              console.log(`Skipping codeflow PR authored by bot: ${author}`);
+              return;
+            }
+
+            // Skip branding and internal-to-public flow PRs from vseanreesermsft
+            if (author === 'vseanreesermsft') {
+              console.log(`Skipping branding/internal-to-public PR authored by: ${author}`);
+              return;
+            }
+
+            // Fetch all changed files in the PR (paginated to handle large PRs)
+            let files = [];
+            let page = 1;
+            while (true) {
+              const { data: pageFiles } = await github.rest.pulls.listFiles({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber,
+                per_page: 100,
+                page: page
+              });
+              files = files.concat(pageFiles);
+              if (pageFiles.length < 100) break;
+              page++;
+            }
+
+            // Skip test-only PRs: all changed files are under test/ directories
+            const isTestOnly = files.length > 0 && files.every(file =>
+              file.filename.startsWith('test/')
+            );
+
+            if (isTestOnly) {
+              console.log('PR only contains test changes, skipping.');
+              return;
+            }
+
+            // Add the Servicing-consider label
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              labels: ['Servicing-consider']
+            });
+            console.log(`Added Servicing-consider label to PR #${prNumber}.`);

.vsts-ci.yml

@@ -9,6 +9,14 @@ trigger:
     - internal/release/*
     - exp/*
 
+schedules:
+- cron: '0 0 * * 0'
+  displayName: Weekly CodeQL/SDL build
+  branches:
+    include:
+    - main
+  always: true
+
 pr:
   branches:
     include:
@@ -91,6 +99,12 @@ extends:
     - stage: build
       displayName: Build
       jobs:
+      ############### HELIX JOB MONITOR ###############
+      - ${{ if or(eq(parameters.runTestBuild, true), eq(variables['Build.Reason'], 'PullRequest')) }}:
+        - template: /eng/common/core-templates/job/helix-job-monitor.yml@self
+          parameters:
+            helixAccessToken: $(HelixApiAccessToken)
+
       ############### WINDOWS ###############
       - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
         parameters:
@@ -109,7 +123,7 @@ extends:
           preSteps:
           - powershell: New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/artifacts/bin -Force
             displayName: Create artifacts/bin directory
-          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
+          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest'), ne(variables['Build.Reason'], 'BatchedCI')) }}:
             timeoutInMinutes: 180
             windowsJobParameterSets:
             ### OFFICIAL ###
@@ -164,7 +178,7 @@ extends:
             publishTaskPrefix: 1ES.
           populateInternalRuntimeVariables: true
           runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://ci.dot.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
-          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
+          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest'), ne(variables['Build.Reason'], 'BatchedCI')) }}:
             timeoutInMinutes: 90
             linuxJobParameterSets:
             ### OFFICIAL ###
@@ -247,7 +261,7 @@ extends:
             publishTaskPrefix: 1ES.
           populateInternalRuntimeVariables: true
           runtimeSourceProperties: /p:DotNetRuntimeSourceFeed=https://ci.dot.net/internal /p:DotNetRuntimeSourceFeedKey=$(dotnetbuilds-internal-container-read-token-base64)
-          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest')) }}:
+          ${{ if and(eq(parameters.runTestBuild, false), ne(variables['Build.Reason'], 'PullRequest'), ne(variables['Build.Reason'], 'BatchedCI')) }}:
             timeoutInMinutes: 90
             macOSJobParameterSets:
             ### OFFICIAL ###

.vsts-pr.yml

@@ -35,12 +35,6 @@ pr:
     - src/Installer/*
     - test/dotnetup.Tests/*
 
-parameters:
-- name: enableArm64Job
-  displayName: Enables the ARM64 job
-  type: boolean
-  default: true
-
 variables:
 - template: /eng/pipelines/templates/variables/sdk-defaults.yml
 # Variables used: DncEngPublicBuildPool
@@ -56,6 +50,9 @@ stages:
 - stage: build
   displayName: Build
   jobs:
+  ############### HELIX JOB MONITOR ###############
+  - template: /eng/common/core-templates/job/helix-job-monitor.yml
+
   ############### WINDOWS ###############
   - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml@self
     parameters:
@@ -81,20 +78,19 @@ stages:
         name: Azure Pipelines
         vmImage: macOS-latest
         os: macOS
-      helixTargetQueue: osx.15.amd64.open
-  ### ARM64 ###
-  - ${{ if eq(parameters.enableArm64Job, true) }}:
+      helixTargetQueue: osx.15.arm64.open
+  ### x64 (CI only) ###
+  - ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
     - template: /eng/pipelines/templates/jobs/sdk-job-matrix.yml
       parameters:
         pool:
           name: Azure Pipelines
           vmImage: macOS-latest
           os: macOS
-        helixTargetQueue: osx.15.arm64.open
+        helixTargetQueue: osx.15.amd64.open
         macOSJobParameterSets:
         - categoryName: TestBuild
-          targetArchitecture: arm64
-          runtimeIdentifier: osx-arm64
+          runtimeIdentifier: osx-x64
 
   ############### DOTNET-FORMAT ###############
   - template: /eng/dotnet-format/dotnet-format-integration.yml

Directory.Build.props

@@ -75,8 +75,10 @@
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
 
-  <!-- TODO: Re-enable NuGet Audit and fix alerts: https://github.com/dotnet/sdk/issues/51466 -->
-  <PropertyGroup>
+  <!-- Disable NuGet audit in official builds. MSBuild does not correctly handle
+       WarningsNotAsErrors for NuGet warnings (https://github.com/dotnet/msbuild/issues/10801),
+       so audit findings become errors via TreatWarningsAsErrors. -->
+  <PropertyGroup Condition="'$(OfficialBuild)' == 'true'">
     <NuGetAudit>false</NuGetAudit>
   </PropertyGroup>
 

documentation/general/eliminate-duplicate-files.md

@@ -30,6 +30,7 @@ The following data is the result of this analysis using the [SdkLayoutAnalyzer](
 The goal is for the vast majority if not all of the components within the SDK to depend on and use the same version of their dependencies.
 
 **Notes:**
+
 1. The baseline measurements in the following tables compare the complete .NET installation (including runtimes, packs, shared frameworks, host, etc.) versus just the SDK directory contents.
 1. Standard archive formats (zip and tar) do not automatically deduplicate identical files, each file is compressed independently, even when multiple files have identical content.
 This means that duplicate files consume space both on disk after extraction and within the compressed archive itself.
@@ -145,6 +146,7 @@ While the RPM protocol itself supports hard links, there are known issues in bot
 Additionally, our current build infrastructure (Arcade) does not support creating RPM packages with hard links ([dotnet/arcade#16453](https://github.com/dotnet/arcade/issues/16453)).
 
 Before we can confidently support hard links on Linux, we need to:
+
 1. Fix the Arcade infrastructure to support creating RPM packages with hard links
 2. Test comprehensively on the Linux distributions we target, particularly Azure Linux
 3. Work with distribution maintainers to ensure compatibility
@@ -153,6 +155,7 @@ Until this work is completed and validated, we will use symbolic links on non-Wi
 
 If we find that hard links cannot be used in RPM packages long term, one alternative to consider would be using hard links everywhere except RPM packages, which would continue using symbolic links.
 However, this approach has trade-offs that would need to be carefully evaluated:
+
 - **Con:** Different link types across acquisition channels adds complexity
 - **Con:** Distribution maintainers who create RPM packages from our source tarballs would need to translate hard links to symbolic links
 
@@ -162,8 +165,8 @@ A decision on this alternative approach will be made once the RPM packaging inve
 
 Hard links are generally preferred because they [offer performance advantages since no extra steps are needed to resolve the file path](https://www.linuxbash.sh/post/symbolic-links-ln-s-vs-hard-links), providing slightly better access time compared to symbolic links which require path resolution.
 
-
 **Key Benefits of File Links:**
+
 - **No runtime changes required** — Components continue to reference files using their existing paths. Both hard links and symbolic links are transparent to applications.
 - **Immediate disk savings** — Links reduce disk usage by the size of duplicate files.
 - **Tarball compatibility** — Tar format natively supports both hard links and symbolic links, preserving space savings in compressed archives.
@@ -201,6 +204,7 @@ The existing zip archives will continue to be published with duplicates during t
 **Phase 2: Migrate Acquisition Channels**
 
 In subsequent preview releases, we will migrate the acquisition channels under our control to use Windows tarballs:
+
 - **dotnet-install scripts** ([dotnet/install-scripts](https://github.com/dotnet/install-scripts)) — Update to prefer tarballs on Windows
 - **Azure DevOps .NET install task** ([microsoft/azure-pipelines-tasks](https://github.com/microsoft/azure-pipelines-tasks)) — Add tarball support for Windows agents
 - **GitHub Actions setup-dotnet** ([actions/setup-dotnet](https://github.com/actions/setup-dotnet)) — Add tarball extraction support for Windows
@@ -265,13 +269,15 @@ Tests will be created to ensure:
 A proof of concept for link-based deduplication was implemented, demonstrating the viability and effectiveness of the approach:
 
 **Implementation Details:**
+
 - A new MSBuild task `DeduplicateFilesWithHardLinks` was created to identify and replace duplicate files with links during SDK layout generation
 - Files are hashed to identify duplicates
 - The POC initially used hard links; the production implementation will use platform-specific link types (hard links on Windows, symbolic links on Linux/macOS)
 
 **Space Savings:**
 
 In a Linux x64 development build of .NET 11.0 SDK, the link-based approach achieved:
+
 - 131 MB reduction in disk size
 - 61 MB reduction in archive size
 
@@ -312,6 +318,7 @@ The analysis categorizes these groups as follows:
 **Linux x64 (10.0.100):**
 
 Group Categorization:
+
 - Groups differing by Core vs FX: 228
 - Groups with different FX versions: 3
 - Groups with different Core versions: 1
@@ -320,6 +327,7 @@ Group Categorization:
 - Groups with NetStandard + Core: 30
 
 Potential Savings (if duplicates were eliminated):
+
 - Different FX versions (keep lowest): 1.9 MB
 - Different Core versions (keep lowest): 0.1 MB
 - NetStandard + NetFx (keep NetStandard): 0.9 MB
@@ -354,6 +362,7 @@ This represents content that should be trimmed out entirely as it serves no purp
 
 In other cases, we ship content to support cross-platform development scenarios—for example, Windows-specific assemblies included in Linux SDKs to enable cross-compilation or multi-targeting scenarios.
 While this content does serve a purpose, it should be analyzed case-by-case to determine whether it should:
+
 - Ship in-box as part of the core SDK experience
 - Be available as optional packages that can be dynamically acquired when needed
 
@@ -365,6 +374,12 @@ Both of these content placement issues are outside the scope of the duplicate el
 However, they will likely be surfaced and made more visible as part of this effort.
 When identified, independent issues will be logged to address these concerns separately.
 
+### Windows Containers
+
+Windows containers do not support hard links, which blocks adoption of this feature for Windows container images.
+The impact of this limitation is modest: Windows containers have significantly fewer supported versions/SKUs than Linux, and Windows base image updates occur only once per month (Patch Tuesday), resulting in far fewer image rebuilds.
+As a result, the potential savings for Windows container images would be an order of magnitude less than Linux.
+
 ## Related
 
 - [Visual Studio de-duplication effort](https://microsoft.sharepoint.com/:w:/s/b3f10b15-fb59-4650-957a-2c632aa943ba/IQBR2aXv7jC8RatIyxJJNPCeAQxjDmLii-R65o0yUvOJatk?e=IcnsAG)
@@ -471,3 +486,43 @@ While the shared assembly location approach offers theoretical benefits in terms
 5. **Implementation Cost:** High development and maintenance burden compared to filesystem-level deduplication.
 
 The hard link approach was selected because it achieves the same disk and archive size benefits without requiring changes to component loading logic or risking behavioral changes in sensitive toolchain components.
+
+## Appendix: Docker Image Savings Analysis
+
+This section quantifies the downstream impact of deduplication on .NET Docker images.
+The estimates use .NET 10 as a representative single release to project per-release savings.
+The "In-Support" columns show the projected combined impact once three in-support versions all include this feature.
+The "All" columns show cumulative totals across all SDK images and pulls (in-support and EOL), illustrating savings that accrue over time.
+
+### Linux SDK Archive Size Reduction
+
+As of .NET 11.0 Preview 4, the Linux SDK archive is **56 MB smaller** as a result of this work.
+
+### Linux SDK Image Pull Bandwidth Savings
+
+| .NET 10 Pulls/Wk | In-Support Pulls/Wk | All Pulls/Wk | .NET 10 Saved (TB wk / yr) | In-Support Saved (TB wk / yr) | All Saved (TB wk / yr) |
+|------------------|---------------------|--------------|----------------------------|-------------------------------|------------------------|
+| 147,000          | 485,400             | 630,000      | 7.9 / 408.2                | 25.9 / 1348.0                 | 33.9 / 1749.6          |
+
+### Linux SDK Image Storage Savings
+
+| New .NET 10 Images/Mo | New In-Support Images/Mo | All Images | .NET 10 Saved (GB mo / yr) | In-Support Saved (GB mo / yr) | All Saved (GB) |
+|-----------------------|--------------------------|------------|----------------------------|-------------------------------|----------------|
+| 42.6                  | 130.5                    | 26,866     | 2.3 / 27.6                 | 7.1 / 85.6                    | 1,469.2        |
+
+---
+
+<sup>1</sup> "All" columns represent all SDK images ever published to MCR and all SDK image pulls per week, regardless of whether the .NET version is currently in support or end-of-life.
+
+<sup>2</sup> New images per month are driven by multiple sources: .NET servicing releases (Patch Tuesday) and base image updates. .NET images are rebuilt whenever an underlying base image (e.g., Ubuntu, Alpine) is updated.
+
+<sup>3</sup> Assuming saved storage is billed at the [ACR](https://azure.microsoft.com/en-us/pricing/details/container-registry/) additional storage rate of $0.00334/GB/day, the in-support storage savings of 7.1 GB/month translate to approximately **$0.71/month**. If every Linux SDK image ever shipped had included this feature, the total cumulative savings of ~1.5 TB would translate to roughly **$147/month**.
+
+### Key Takeaways
+
+- Over the .NET 10 LTS three-year support period, this saves approximately **1,224.6 TB** in bandwidth (408.2 TB/yr x 3) and **82.8 GB** in storage (27.6 GB/yr x 3).
+Those savings don't count previews, usage increase when the previous LTS (8.0) reaches end-of-life or pulls after EOL.
+- **Bandwidth savings are significant in absolute terms**, over 1,350 TB/year for in-support versions at 630,000 pulls per week.
+This is modest relative to the scale at which Azure operates, as indicated by its pricing.
+- **Storage savings are negligible.** Even if every Linux SDK image ever shipped had included this feature, the cumulative savings would be ~1.5 TB.
+- The primary value is **customer-facing**: every Linux SDK image pull is 56 MB smaller, resulting in faster downloads and reduced storage/higher density for users.