From 1ddcf9e71b6393335f60151442163a9b0a59cfc0 Mon Sep 17 00:00:00 2001 From: Wiktor Kopec Date: Wed, 14 Oct 2026 11:08:07 -0700 Subject: [PATCH 1/2] Migrate MicroBuild pool and block PowerShell Gallery access Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d6d0d6e-106e-4224-8dee-1b789b21b8ce --- build/yaml/jobs/codeanalysis/antimalware.yaml | 2 +- build/yaml/jobs/codeanalysis/apiscan.yaml | 2 +- build/yaml/jobs/codeanalysis/binskim.yaml | 2 +- build/yaml/jobs/codeanalysis/buildanalyzer.yaml | 2 +- build/yaml/jobs/codeanalysis/policheck.yaml | 2 +- build/yaml/jobs/codeanalysis/psscriptanalyzer.yaml | 2 +- build/yaml/jobs/linux/packages.yaml | 2 +- build/yaml/jobs/postpackage.yaml | 2 +- build/yaml/jobs/windows/binaries.yaml | 2 +- build/yaml/jobs/windows/packages.yaml | 2 +- build/yaml/jobs/windows/tests.yaml | 2 +- build/yaml/pipelines/build_images.yaml | 2 +- build/yaml/pipelines/ci_internal.yaml | 4 ++-- build/yaml/pipelines/pr_internal.yaml | 4 ++-- build/yaml/pipelines/release.yaml | 4 ++-- build/yaml/pipelines/signed.yaml | 6 ++++-- build/yaml/stages/release.yaml | 6 +++--- build/yaml/steps/windows/binaries.yaml | 2 +- build/yaml/steps/windows/packages.yaml | 2 +- 19 files changed, 27 insertions(+), 25 deletions(-) diff --git a/build/yaml/jobs/codeanalysis/antimalware.yaml b/build/yaml/jobs/codeanalysis/antimalware.yaml index fb6b3df2..15098ad5 100644 --- a/build/yaml/jobs/codeanalysis/antimalware.yaml +++ b/build/yaml/jobs/codeanalysis/antimalware.yaml @@ -8,7 +8,7 @@ jobs: displayName: Code Analysis - AntiMalware pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable workspace: clean: all diff --git a/build/yaml/jobs/codeanalysis/apiscan.yaml b/build/yaml/jobs/codeanalysis/apiscan.yaml index 060812a0..a8cbb312 100644 --- a/build/yaml/jobs/codeanalysis/apiscan.yaml +++ b/build/yaml/jobs/codeanalysis/apiscan.yaml @@ -13,7 +13,7 @@ jobs: # No dependencies. Requires Build Stages to ensure that binaries are built pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - visualstudio diff --git a/build/yaml/jobs/codeanalysis/binskim.yaml b/build/yaml/jobs/codeanalysis/binskim.yaml index 4a79d02f..77fb7779 100644 --- a/build/yaml/jobs/codeanalysis/binskim.yaml +++ b/build/yaml/jobs/codeanalysis/binskim.yaml @@ -11,7 +11,7 @@ jobs: # No dependencies. Requires Build Stages to ensure that binaries are built pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable workspace: clean: all diff --git a/build/yaml/jobs/codeanalysis/buildanalyzer.yaml b/build/yaml/jobs/codeanalysis/buildanalyzer.yaml index 9e9b2d11..53083ce0 100644 --- a/build/yaml/jobs/codeanalysis/buildanalyzer.yaml +++ b/build/yaml/jobs/codeanalysis/buildanalyzer.yaml @@ -14,7 +14,7 @@ jobs: displayName: Run build analyzer (${{ parameters.Analyzer }}, ${{ parameters.Platform }}) pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - vstest diff --git a/build/yaml/jobs/codeanalysis/policheck.yaml b/build/yaml/jobs/codeanalysis/policheck.yaml index 318ddbad..8bcdae64 100644 --- a/build/yaml/jobs/codeanalysis/policheck.yaml +++ b/build/yaml/jobs/codeanalysis/policheck.yaml @@ -9,7 +9,7 @@ jobs: displayName: Code Analysis - PoliCheck pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable workspace: clean: all diff --git a/build/yaml/jobs/codeanalysis/psscriptanalyzer.yaml b/build/yaml/jobs/codeanalysis/psscriptanalyzer.yaml index 71c2c9f8..c3b7e9ae 100644 --- a/build/yaml/jobs/codeanalysis/psscriptanalyzer.yaml +++ b/build/yaml/jobs/codeanalysis/psscriptanalyzer.yaml @@ -9,7 +9,7 @@ jobs: displayName: Code Analysis - PSScriptAnalyzer pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable workspace: clean: all diff --git a/build/yaml/jobs/linux/packages.yaml b/build/yaml/jobs/linux/packages.yaml index 68fe9274..d23c71e6 100644 --- a/build/yaml/jobs/linux/packages.yaml +++ b/build/yaml/jobs/linux/packages.yaml @@ -20,7 +20,7 @@ jobs: pool: ${{ if eq('true', parameters.IsMicroBuildInternal) }}: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - vstest diff --git a/build/yaml/jobs/postpackage.yaml b/build/yaml/jobs/postpackage.yaml index 3aa682a7..b38812b6 100644 --- a/build/yaml/jobs/postpackage.yaml +++ b/build/yaml/jobs/postpackage.yaml @@ -14,7 +14,7 @@ jobs: Packaging.EnableSBOMSigning: true pool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable workspace: clean: outputs diff --git a/build/yaml/jobs/windows/binaries.yaml b/build/yaml/jobs/windows/binaries.yaml index 6e9b767d..1303f5fb 100644 --- a/build/yaml/jobs/windows/binaries.yaml +++ b/build/yaml/jobs/windows/binaries.yaml @@ -25,7 +25,7 @@ jobs: pool: ${{ if eq('true', parameters.IsMicroBuildInternal) }}: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - vstest diff --git a/build/yaml/jobs/windows/packages.yaml b/build/yaml/jobs/windows/packages.yaml index c10b3886..b58c706b 100644 --- a/build/yaml/jobs/windows/packages.yaml +++ b/build/yaml/jobs/windows/packages.yaml @@ -19,7 +19,7 @@ jobs: ${{ insert }}: ${{ parameters.MatrixStrategy }} pool: ${{ if eq('true', parameters.IsMicroBuildInternal) }}: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - vstest diff --git a/build/yaml/jobs/windows/tests.yaml b/build/yaml/jobs/windows/tests.yaml index 36548f35..27dd6045 100644 --- a/build/yaml/jobs/windows/tests.yaml +++ b/build/yaml/jobs/windows/tests.yaml @@ -18,7 +18,7 @@ jobs: pool: ${{ if eq('true', parameters.IsMicroBuildInternal) }}: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable demands: - msbuild - vstest diff --git a/build/yaml/pipelines/build_images.yaml b/build/yaml/pipelines/build_images.yaml index 9cca2244..3ce31f20 100644 --- a/build/yaml/pipelines/build_images.yaml +++ b/build/yaml/pipelines/build_images.yaml @@ -44,7 +44,7 @@ extends: sdl: sourceAnalysisPool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows stages: diff --git a/build/yaml/pipelines/ci_internal.yaml b/build/yaml/pipelines/ci_internal.yaml index 5b68ca64..6d473e6b 100644 --- a/build/yaml/pipelines/ci_internal.yaml +++ b/build/yaml/pipelines/ci_internal.yaml @@ -22,11 +22,11 @@ extends: template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate parameters: pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows sdl: sourceAnalysisPool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows binskim: enabled: false diff --git a/build/yaml/pipelines/pr_internal.yaml b/build/yaml/pipelines/pr_internal.yaml index adac3b9e..6c448325 100644 --- a/build/yaml/pipelines/pr_internal.yaml +++ b/build/yaml/pipelines/pr_internal.yaml @@ -22,11 +22,11 @@ extends: template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate parameters: pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows sdl: sourceAnalysisPool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows binskim: enabled: false diff --git a/build/yaml/pipelines/release.yaml b/build/yaml/pipelines/release.yaml index 1599ad59..f85f5e25 100644 --- a/build/yaml/pipelines/release.yaml +++ b/build/yaml/pipelines/release.yaml @@ -79,11 +79,11 @@ extends: template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates parameters: pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows sdl: sourceAnalysisPool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows # This pipeline only consumes already-signed/scanned artifacts and publishes them. binskim: diff --git a/build/yaml/pipelines/signed.yaml b/build/yaml/pipelines/signed.yaml index cb7d4b07..d2d95202 100644 --- a/build/yaml/pipelines/signed.yaml +++ b/build/yaml/pipelines/signed.yaml @@ -21,12 +21,14 @@ resources: extends: template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate parameters: + settings: + networkIsolationPolicy: Permissive,CFSClean2 pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows sdl: sourceAnalysisPool: - name: VSEngSS-MicroBuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows binskim: scanOutputDirectoryOnly: true # BinSkim will complain about VC.Tools not being Spectre compliant, but we use that for builds. This toggles for BinSkim to only scan the output files/folders. diff --git a/build/yaml/stages/release.yaml b/build/yaml/stages/release.yaml index b7ca0948..4be5d120 100644 --- a/build/yaml/stages/release.yaml +++ b/build/yaml/stages/release.yaml @@ -35,7 +35,7 @@ stages: displayName: Approval gate (internal NuGet feed) environment: CLRIE-Release-Internal-NuGet-Feed pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows templateContext: type: releaseJob @@ -55,7 +55,7 @@ stages: displayName: Publish NuGets to internal InstrumentationEngine Feed dependsOn: ApprovalGate pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows templateContext: inputs: @@ -98,7 +98,7 @@ stages: condition: eq(variables['PromoteToRelease'], 'True') environment: CLRIE-Release-Promote-Internal-NuGet-Feed pool: - name: VSEngSS-Microbuild2022-1ES + name: VSEng-MicroBuildVSStable os: windows templateContext: type: releaseJob diff --git a/build/yaml/steps/windows/binaries.yaml b/build/yaml/steps/windows/binaries.yaml index d73039ab..445c1a2d 100644 --- a/build/yaml/steps/windows/binaries.yaml +++ b/build/yaml/steps/windows/binaries.yaml @@ -27,7 +27,7 @@ steps: displayName: 'Build InstrumentationEngine.sln' inputs: solution: InstrumentationEngine.sln - msbuildVersion: 17.0 + msbuildVersion: latest platform: $(Platform) configuration: $(Configuration) msbuildArguments: /bl:"$(Build.ArtifactStagingDirectory)\logs\Build_Windows_$(Platform)_$(Configuration).binlog" diff --git a/build/yaml/steps/windows/packages.yaml b/build/yaml/steps/windows/packages.yaml index 7085c356..79b2c4ec 100644 --- a/build/yaml/steps/windows/packages.yaml +++ b/build/yaml/steps/windows/packages.yaml @@ -22,7 +22,7 @@ steps: displayName: 'Build solution InstrumentationEngine.Packages.sln $(Platform)' inputs: solution: src/InstrumentationEngine.Packages.sln - msbuildVersion: 17.0 + msbuildVersion: latest platform: $(Platform) configuration: $(Configuration) msbuildArguments: '/p:InputBinCfgRoot="${{ parameters.WindowsBinRoot }}" /bl:"$(Build.ArtifactStagingDirectory)\logs\Package_Windows_$(LogPlatform)_$(Configuration).binlog"' \ No newline at end of file From 5969e26016db735586566d397e3b5544cddf46f5 Mon Sep 17 00:00:00 2001 From: Wiktor Kopec Date: Wed, 14 Oct 2026 13:24:04 -0700 Subject: [PATCH 2/2] Use latest Visual Studio test runner on MicroBuild pool Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e92655f9-c1e6-4485-abb6-b6f59acb3e44 --- build/yaml/steps/windows/vstest.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/build/yaml/steps/windows/vstest.yaml b/build/yaml/steps/windows/vstest.yaml index ada91b7c..bc48f970 100644 --- a/build/yaml/steps/windows/vstest.yaml +++ b/build/yaml/steps/windows/vstest.yaml @@ -8,11 +8,10 @@ parameters: RunTitle: '' steps: -# https://github.com/microsoft/azure-pipelines-tasks/issues/15537 -# Don't specify VsTestVersion -- task: VSTest@2 +- task: VSTest@3 displayName: 'Run Tests: $(Platform)\${{ parameters.SubFolder }}*Tests*.dll' inputs: + vsTestVersion: latest testAssemblyVer2: '${{ parameters.SubFolder }}*Tests*.dll' searchFolder: '$(Build.ArtifactStagingDirectory)\binaries-windows-$(Configuration)\$(Platform)' runInParallel: false