[main] Update dependencies from dotnet/arcade

eng/Version.Details.xml

@@ -3,9 +3,9 @@
   <ProductDependencies>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.25605.2">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26127.1">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>65e09c040143048211dcf6b2bd69336cbf27eec6</Sha>
+      <Sha>55c97a45af8fd75bc87e9e4b4f61aef3fead254d</Sha>
     </Dependency>
   </ToolsetDependencies>
 </Dependencies>

eng/common/core-templates/job/publish-build-assets.yml

@@ -80,7 +80,7 @@ jobs:
     # If it's not devdiv, it's dnceng
     ${{ if ne(variables['System.TeamProject'], 'DevDiv') }}:
       name: NetCore1ESPool-Publishing-Internal
-      image: windows.vs2019.amd64
+      image: windows.vs2022.amd64
       os: windows
   steps:
   - ${{ if eq(parameters.is1ESPipeline, '') }}:

eng/common/core-templates/job/renovate.yml

@@ -0,0 +1,135 @@
+# --------------------------------------------------------------------------------------
+# Renovate Bot Job Template
+# --------------------------------------------------------------------------------------
+# This Azure DevOps pipeline job template runs Renovate (https://docs.renovatebot.com/)
+# to automatically update dependencies in a GitHub repository.
+#
+# Renovate scans the repository for dependency files and creates pull requests to update
+# outdated dependencies based on the configuration specified in the renovateConfigPath
+# parameter.
+#
+# Usage:
+#   For each product repo wanting to make use of Renovate, this template is called from
+#   an internal Azure DevOps pipeline, typically with a schedule trigger, to check for
+#   and propose dependency updates.
+#
+# For more info, see https://github.com/dotnet/arcade/blob/main/Documentation/Renovate.md
+# --------------------------------------------------------------------------------------
+
+parameters:
+
+# Path to the Renovate configuration file within the repository.
+- name: renovateConfigPath
+  type: string
+  default: 'eng/renovate.json'
+
+# GitHub repository to run Renovate against, in the format 'owner/repo'.
+# This could technically be any repo but convention is to target the same
+# repo that contains the calling pipeline. The Renovate config file would
+# be co-located with the pipeline's repo and, in most cases, the config
+# file is specific to the repo being targeted.
+- name: gitHubRepo
+  type: string
+
+# List of base branches to target for Renovate PRs.
+# NOTE: The Renovate configuration file is always read from the branch where the
+# pipeline is run, NOT from the target branches specified here. If you need different
+# configurations for different branches, run the pipeline from each branch separately.
+- name: baseBranches
+  type: object
+  default:
+  - main
+
+# When true, Renovate will run in dry run mode, which previews changes without creating PRs.
+# See the 'Run Renovate' step log output for details of what would have been changed.
+- name: dryRun
+  type: boolean
+  default: false
+
+# By default, Renovate will not recreate a PR for a given dependency/version pair that was
+# previously closed. This allows opting in to always recreating PRs even if they were
+# previously closed.
+- name: forceRecreatePR
+  type: boolean
+  default: false
+
+# Pool configuration for the job.
+- name: pool
+  type: object
+  default:
+    name: NetCore1ESPool-Internal
+    image: build.azurelinux.3.amd64
+    os: linux
+
+jobs:
+- job: Renovate
+  displayName: Run Renovate
+  container: RenovateContainer
+  variables:
+  - group: dotnet-renovate-bot
+  # The Renovate version is automatically updated by https://github.com/dotnet/arcade/blob/main/azure-pipelines-renovate.yml.
+  # Changing the variable name here would require updating the name in https://github.com/dotnet/arcade/blob/main/eng/renovate.json as well.
+  - name: renovateVersion
+    value: '42'
+  - name: dryRunArg
+    ${{ if eq(parameters.dryRun, true) }}:
+      value: 'full'
+    ${{ else }}:
+      value: ''
+  - name: recreateWhenArg
+    ${{ if eq(parameters.forceRecreatePR, true) }}:
+      value: 'always'
+    ${{ else }}:
+      value: ''
+  pool: ${{ parameters.pool }}
+
+  templateContext:
+    outputParentDirectory: $(Build.ArtifactStagingDirectory)
+    outputs:
+    - output: pipelineArtifact
+      displayName: Publish Renovate Log
+      condition: succeededOrFailed()
+      targetPath: $(Build.ArtifactStagingDirectory)
+      artifactName: $(Agent.JobName)_Logs_Attempt$(System.JobAttempt)
+      sbomEnabled: false
+
+  steps:
+  - checkout: self
+    fetchDepth: 1
+
+  - script: renovate-config-validator $(Build.SourcesDirectory)/${{parameters.renovateConfigPath}}
+    displayName: Validate Renovate config
+    env:
+      LOG_LEVEL: info
+      LOG_FILE_LEVEL: debug
+      LOG_FILE: $(Build.ArtifactStagingDirectory)/renovate-config-validator.json
+
+  - script: |
+      . $(Build.SourcesDirectory)/eng/common/renovate.env
+      renovate
+    displayName: Run Renovate
+    env:
+      RENOVATE_FORK_TOKEN: $(BotAccount-dotnet-renovate-bot-PAT)
+      RENOVATE_TOKEN: $(BotAccount-dotnet-renovate-bot-PAT)
+      RENOVATE_REPOSITORIES: ${{parameters.gitHubRepo}}
+      RENOVATE_BASE_BRANCHES: ${{ convertToJson(parameters.baseBranches) }}
+      RENOVATE_DRY_RUN: $(dryRunArg)
+      RENOVATE_RECREATE_WHEN: $(recreateWhenArg)
+      LOG_LEVEL: info
+      LOG_FILE_LEVEL: debug
+      LOG_FILE: $(Build.ArtifactStagingDirectory)/renovate.json
+      RENOVATE_CONFIG_FILE: $(Build.SourcesDirectory)/${{parameters.renovateConfigPath}}
+
+  - script: |
+      echo "PRs created by Renovate:"
+      if [ -s "$(Build.ArtifactStagingDirectory)/renovate-log.json" ]; then
+        if ! jq -r 'select(.msg == "PR created" and .pr != null) | "https://github.com/\(.repository)/pull/\(.pr)"' "$(Build.ArtifactStagingDirectory)/renovate-log.json" | sort -u; then
+          echo "##vso[task.logissue type=warning]Failed to parse Renovate log file with jq."
+          echo "##vso[task.complete result=SucceededWithIssues]"
+        fi
+      else
+        echo "##vso[task.logissue type=warning]No Renovate log file found or file is empty."
+        echo "##vso[task.complete result=SucceededWithIssues]"
+      fi
+    displayName: List created PRs
+    condition: and(succeededOrFailed(), eq('${{ parameters.dryRun }}', false))

eng/common/core-templates/job/source-build.yml

@@ -60,19 +60,19 @@ jobs:
       pool:
         ${{ if eq(variables['System.TeamProject'], 'public') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')]
-          demands: ImageOverride -equals build.ubuntu.2204.amd64
+          demands: ImageOverride -equals build.azurelinux.3.amd64.open
         ${{ if eq(variables['System.TeamProject'], 'internal') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')]
-          image: 1es-azurelinux-3
+          image: build.azurelinux.3.amd64
           os: linux
     ${{ else }}:
       pool:
         ${{ if eq(variables['System.TeamProject'], 'public') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore-Svc-Public' ), False, 'NetCore-Public')]
-          demands: ImageOverride -equals Build.Ubuntu.2204.Amd64.Open
+          demands: ImageOverride -equals build.azurelinux.3.amd64.open
         ${{ if eq(variables['System.TeamProject'], 'internal') }}:
           name: $[replace(replace(eq(contains(coalesce(variables['System.PullRequest.TargetBranch'], variables['Build.SourceBranch'], 'refs/heads/main'), 'release'), 'true'), True, 'NetCore1ESPool-Svc-Internal'), False, 'NetCore1ESPool-Internal')]
-          demands: ImageOverride -equals Build.Ubuntu.2204.Amd64
+          demands: ImageOverride -equals build.azurelinux.3.amd64
   ${{ if ne(parameters.platform.pool, '') }}:
     pool: ${{ parameters.platform.pool }}
 

eng/common/core-templates/job/source-index-stage1.yml

@@ -25,10 +25,10 @@ jobs:
     pool:
       ${{ if eq(variables['System.TeamProject'], 'public') }}:
         name: $(DncEngPublicBuildPool)
-        image: windows.vs2026preview.scout.amd64.open
+        image: windows.vs2026.amd64.open
       ${{ if eq(variables['System.TeamProject'], 'internal') }}:
         name: $(DncEngInternalBuildPool)
-        image: windows.vs2026preview.scout.amd64
+        image: windows.vs2026.amd64
 
   steps:
   - ${{ if eq(parameters.is1ESPipeline, '') }}:

eng/common/core-templates/post-build/post-build.yml

@@ -127,11 +127,11 @@ stages:
         ${{ else }}:
           ${{ if eq(parameters.is1ESPipeline, true) }}:
             name: $(DncEngInternalBuildPool)
-            image: windows.vs2026preview.scout.amd64
+            image: windows.vs2026.amd64
             os: windows
           ${{ else }}:
             name: $(DncEngInternalBuildPool)
-            demands: ImageOverride -equals windows.vs2026preview.scout.amd64
+            demands: ImageOverride -equals windows.vs2026.amd64
 
       steps:
       - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
@@ -175,7 +175,7 @@ stages:
             os: windows
           ${{ else }}:
             name: $(DncEngInternalBuildPool)
-            demands: ImageOverride -equals windows.vs2026preview.scout.amd64
+            demands: ImageOverride -equals windows.vs2026.amd64
       steps:
       - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
         parameters:
@@ -236,7 +236,7 @@ stages:
             os: windows
           ${{ else }}:
             name: $(DncEngInternalBuildPool)
-            demands: ImageOverride -equals windows.vs2026preview.scout.amd64
+            demands: ImageOverride -equals windows.vs2026.amd64
       steps:
       - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
         parameters:
@@ -293,11 +293,11 @@ stages:
         ${{ else }}:
           ${{ if eq(parameters.is1ESPipeline, true) }}:
             name: NetCore1ESPool-Publishing-Internal
-            image: windows.vs2019.amd64
+            image: windows.vs2022.amd64
             os: windows
           ${{ else }}:
             name: NetCore1ESPool-Publishing-Internal
-            demands: ImageOverride -equals windows.vs2019.amd64
+            demands: ImageOverride -equals windows.vs2022.amd64
       steps:
       - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
         parameters:

eng/common/core-templates/stages/renovate.yml

@@ -0,0 +1,86 @@
+# --------------------------------------------------------------------------------------
+# Renovate Pipeline Template
+# --------------------------------------------------------------------------------------
+# This template provides a complete reusable pipeline definition for running Renovate
+# in a 1ES Official pipeline. Pipelines can extend from this template and only need
+# to pass the Renovate job parameters.
+#
+# For more info, see https://github.com/dotnet/arcade/blob/main/Documentation/Renovate.md
+# --------------------------------------------------------------------------------------
+
+parameters:
+
+# Path to the Renovate configuration file within the repository.
+- name: renovateConfigPath
+  type: string
+  default: 'eng/renovate.json'
+
+# GitHub repository to run Renovate against, in the format 'owner/repo'.
+- name: gitHubRepo
+  type: string
+
+# List of base branches to target for Renovate PRs.
+- name: baseBranches
+  type: object
+  default:
+  - main
+
+# When true, Renovate will run in dry run mode.
+- name: dryRun
+  type: boolean
+  default: false
+
+# When true, Renovate will recreate PRs even if they were previously closed.
+- name: forceRecreatePR
+  type: boolean
+  default: false
+
+# Pool configuration for the pipeline.
+- name: pool
+  type: object
+  default:
+    name: NetCore1ESPool-Internal
+    image: build.azurelinux.3.amd64
+    os: linux
+
+# Renovate version used in the container image tag.
+- name: renovateVersion
+  default: 43
+  type: number
+
+# Pool configuration for SDL analysis.
+- name: sdlPool
+  type: object
+  default:
+    name: NetCore1ESPool-Internal
+    image: 1es-windows-2022
+    os: windows
+
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    pool: ${{ parameters.pool }}
+    sdl:
+      sourceAnalysisPool: ${{ parameters.sdlPool }}
+    containers:
+      RenovateContainer:
+        image: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-3.0-renovate-${{ parameters.renovateVersion }}-amd64
+    stages:
+    - stage: Renovate
+      displayName: Run Renovate
+      jobs:
+      - template: /eng/common/core-templates/job/renovate.yml@self
+        parameters:
+          renovateConfigPath: ${{ parameters.renovateConfigPath }}
+          gitHubRepo: ${{ parameters.gitHubRepo }}
+          baseBranches: ${{ parameters.baseBranches }}
+          dryRun: ${{ parameters.dryRun }}
+          forceRecreatePR: ${{ parameters.forceRecreatePR }}
+          pool: ${{ parameters.pool }}

eng/common/core-templates/steps/install-microbuild-impl.yml

@@ -18,7 +18,7 @@ parameters:
     type: boolean
 
 steps:
-- ${{ if eq(parameters.enablePreviewMicrobuild, 'true') }}:
+- ${{ if eq(parameters.enablePreviewMicrobuild, true) }}:
     - task: MicroBuildSigningPluginPreview@4
       displayName: Install Preview MicroBuild plugin
       inputs: ${{ parameters.microbuildTaskInputs }}

eng/common/core-templates/steps/source-index-stage1-publish.yml

@@ -14,8 +14,8 @@ steps:
     workingDirectory: $(Agent.TempDirectory)
 
 - script: |
-    $(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version ${{parameters.sourceIndexProcessBinlogPackageVersion}} --source ${{parameters.SourceIndexPackageSource}} --tool-path $(Agent.TempDirectory)/.source-index/tools
-    $(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version ${{parameters.sourceIndexUploadPackageVersion}} --source ${{parameters.SourceIndexPackageSource}} --tool-path $(Agent.TempDirectory)/.source-index/tools
+    $(Agent.TempDirectory)/dotnet/dotnet tool install BinLogToSln --version ${{parameters.sourceIndexProcessBinlogPackageVersion}} --source ${{parameters.sourceIndexPackageSource}} --tool-path $(Agent.TempDirectory)/.source-index/tools
+    $(Agent.TempDirectory)/dotnet/dotnet tool install UploadIndexStage1 --version ${{parameters.sourceIndexUploadPackageVersion}} --source ${{parameters.sourceIndexPackageSource}} --tool-path $(Agent.TempDirectory)/.source-index/tools
   displayName: "Source Index: Download netsourceindex Tools"
   # Set working directory to temp directory so 'dotnet' doesn't try to use global.json and use the repo's sdk.
   workingDirectory: $(Agent.TempDirectory)

eng/common/cross/build-rootfs.sh

@@ -72,7 +72,7 @@ __AlpinePackages+=" krb5-dev"
 __AlpinePackages+=" openssl-dev"
 __AlpinePackages+=" zlib-dev"
 
-__FreeBSDBase="13.4-RELEASE"
+__FreeBSDBase="13.5-RELEASE"
 __FreeBSDPkg="1.21.3"
 __FreeBSDABI="13"
 __FreeBSDPackages="libunwind"
@@ -295,9 +295,7 @@ while :; do
             ;;
         noble) # Ubuntu 24.04
             __CodeName=noble
-            if [[ -z "$__LLDB_Package" ]]; then
-                __LLDB_Package="liblldb-19-dev"
-            fi
+            __LLDB_Package="liblldb-19-dev"
             ;;
         stretch) # Debian 9
             __CodeName=stretch
@@ -383,7 +381,7 @@ while :; do
             ;;
         freebsd14)
             __CodeName=freebsd
-            __FreeBSDBase="14.2-RELEASE"
+            __FreeBSDBase="14.3-RELEASE"
             __FreeBSDABI="14"
             __SkipUnmount=1
             ;;

eng/common/internal-feed-operations.ps1

@@ -26,7 +26,7 @@ function SetupCredProvider {
   $url = 'https://raw.githubusercontent.com/microsoft/artifacts-credprovider/master/helpers/installcredprovider.ps1'
 
   Write-Host "Writing the contents of 'installcredprovider.ps1' locally..."
-  Invoke-WebRequest $url -OutFile installcredprovider.ps1
+  Invoke-WebRequest $url -UseBasicParsing -OutFile installcredprovider.ps1
 
   Write-Host 'Installing plugin...'
   .\installcredprovider.ps1 -Force