Skip to content

Backmerge release/13.2 to main#14863

Merged
radical merged 20 commits intomainfrom
ankj/backmerge-13.2-to-main
Mar 3, 2026
Merged

Backmerge release/13.2 to main#14863
radical merged 20 commits intomainfrom
ankj/backmerge-13.2-to-main

Conversation

@radical
Copy link
Member

@radical radical commented Mar 3, 2026

Description

Backmerge release/13.2 into main.

Conflict Resolution

All 7 conflicts were in the VS Code extension (extension/src/), resolved by taking release/13.2's version (superset of main's changes):

File Resolution
extension/src/commands/add.ts Take release/13.2: adds editorCommandProvider param + appHostArgs
extension/src/commands/deploy.ts Take release/13.2: adds editorCommandProvider param + appHostArgs
extension/src/commands/publish.ts Take release/13.2: adds editorCommandProvider param + appHostArgs
extension/src/commands/update.ts Take release/13.2: adds editorCommandProvider param + appHostArgs + new updateSelfCommand
extension/src/extension.ts Take release/13.2: adds welcome view context, tree view polling, expanded subscriptions
extension/src/loc/strings.ts Take release/13.2: adds selectDirectoryTitle / selectFileTitle
extension/src/utils/AspireTerminalProvider.ts Take release/13.2: adds additionalArgs parameter

.github/workflows/ci.yml was auto-resolved via rerere (patterns_file refactor from #14748).

Relevant PRs (CC for review)

All conflicts originated from VS Code extension changes by @adamint:

CC: @adamint for review of the conflict resolutions.

JamesNK and others added 11 commits March 2, 2026 07:58
* Many telemetry commands improvements

* Clean up

* Test cleanup

* Test cleanup
* Detect CLI at default install paths when not on PATH (#14545)

Check default installation directories (~/.aspire/bin, ~/.dotnet/tools) when the
Aspire CLI is not found on the system PATH. If found at a default location, the
VS Code setting is auto-updated. If later found on PATH, the setting is cleared.

Resolution order: configured custom path > system PATH > default install paths.

Fixes #14235

* Fix JSON-RPC error on disconnect and auto-restart Aspire debug session on AppHost restart (#14548)

* Fix JSON-RPC error on disconnect and auto-restart debug session on AppHost restart

* Update extension/src/debugger/AspireDebugSession.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update extension/src/debugger/AspireDebugSession.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Update the command table in extension/README.md to be consistent with
the actual command titles registered in package.nls.json:

- Fix 'Configure launch.json' -> 'Configure launch.json file'
- Fix 'Manage configuration settings' -> 'Extension settings'
- Add missing commands: Initialize Aspire, Open local/global Aspire settings
- Remove outdated Available/Preview availability column
Add PromptForFilePathAsync to IInteractionService that uses native OS file
pickers when the VS Code extension supports the file-pickers.v1 capability.
Falls back to PromptForStringAsync for older extensions or console mode.

Call sites updated: AgentInitCommand, NewCommand, ProjectUpdater.

Fixes #12758

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Pass open AppHost to CLI commands via --project flag

When the user has an AppHost file open in the editor or configured in
.aspire/settings.json, the extension now passes --project <path> to CLI
commands that support it (deploy, publish, add, update).

Fixes #11024

* Address review feedback: proper arg escaping, raw tokens, tighter AppHost heuristic

* Fix --project to --apphost and update tests for sync getAspireCliExecutablePath

- Change CLI flag from --project to --apphost to match current CLI interface
- Rename getProjectArgs to getAppHostArgs for consistency
- Tests already updated to stub vscode.workspace.getConfiguration instead of resolveCliPath
…e view (#14848)

* Add Aspire Activity Bar panel with running apphosts tree view

- Add Aspire sidebar panel in VS Code with running AppHosts tree view
- Extend 'aspire ps --format json --resources' to include per-AppHost resource data
- Show resources (with state, type, endpoints) as collapsible tree items
- Backward-compatible: falls back gracefully if CLI doesn't support --resources
- Visibility-based polling (only fetches when panel is visible)
- Add SVG icon, localized strings, and unit tests

* Add error welcome view, updateSelf command, initial visibility polling, and spawn error handling

- Show welcome view with upgrade prompt when CLI is missing or too old
- Add 'Update Aspire CLI' command (aspire update --self)
- Start polling immediately if tree view is already visible on creation
- Handle spawn errors (ENOENT) to prevent polling from getting stuck
- Change dashboard icon to link-external for clickable items
- Remove unused InfoMessageItem in favor of viewsWelcome-based error display

* Add Stop and View Logs context menu actions for AppHosts and Resources

- Stop AppHost: right-click context menu runs 'aspire stop --project <path>'
- Stop Resource: right-click context menu runs 'aspire stop <name> --project <path>'
- View Logs: right-click context menu runs 'aspire logs <name> --project <path> --follow'
- All commands hidden from command palette (tree-only actions)
- Localized all new command titles

* Add resource management commands and fix RPC race condition

- Add Start, Restart, Stop resource and Stop apphost context menu actions
- Add View logs context menu for streaming resource logs
- Add Execute command... context menu with quick pick for resource commands
- Fix RPC race condition: register interaction service endpoints before
  connection.listen() to prevent unhandled 'displayEmptyLine' errors
- Fix RPC client factory to use lazy debugSessionId reference
- Use --apphost flag (primary) instead of --project (legacy alias)
- Normalize casing: 'apphost' (lowercase h) in user-facing strings

* Remove unused string constants from strings.ts

* Add Aspire brand purple and semantic colors to tree view icons

- Register custom 'aspire.brandPurple' color (#512BD4 light, #7455DD dark)
- Color apphost and resources group icons with Aspire purple
- Color resource state icons: green for success, yellow for warning,
  red for error, purple for other active states

* Simplify tree provider, fix resource state icons and conditional commands

- Merge duplicate detail item classes into single DetailItem
- Extract _runResourceCommand helper for stop/start/restart/logs
- Store appHostPid directly on ResourceItem instead of parsing ID string
- Remove no-op resourceEndpointLabel wrapper
- Fix resource state icons to use exact PascalCase state values from KnownResourceStates
- Respect stateStyle overrides for health check warnings/errors on Running resources
- Show Start/Stop/Restart context menus only when resource has those commands available
- Reduce polling interval from 5s to 3s
* Display status in more places in CLI

* Update

* Update

* Update

* Update

* Add status to templates

* Fix emoji
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Include --disableProductStyleUrl in Azurite command line when running Azure Storage as an emulator. This is necessary because when a Container resource references the Storage emulator it gets a URL like storage.dev.internal:10000. Using a URL like this conflicts between the Storage SDK and the emulator because the Storage SDK sees port 10000 and uses path-style URLs. But the emulator rejects them because it expects "product-style" URLs.

Fix #14044
… file (#14748)

* feat: add CI trigger patterns file

Extract the CI-skip glob patterns into eng/testing/github-ci-trigger-patterns.txt
so that pattern maintenance is decoupled from the workflow definition.
Changing this file alone will not trigger CI, avoiding the chicken-and-egg
problem of the patterns being inlined in ci.yml.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: read glob patterns from file in check-changed-files action

Replace the inline regex patterns input with a patterns_file input that
points to a file of glob patterns. Add a glob_to_regex() function that
converts glob syntax (**, *, literal dot) to anchored ERE regexes.

The action now:
- reads patterns from a file, skipping comments and blank lines
- converts each glob to an anchored regex before matching
- escapes regex metacharacters (. + ? [ ] ( ) |) in glob literals

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: use patterns_file in CI workflow

Replace the inline regex patterns block in ci.yml with a single
patterns_file reference to eng/testing/github-ci-trigger-patterns.txt.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: add CI trigger patterns documentation

Explain the patterns file, its glob syntax, how to add new patterns,
and how the check-changed-files action converts globs to ERE regexes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Ankit Jain <radical@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings March 3, 2026 01:12
@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14863

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14863"

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Backmerges release/13.2 into main, primarily bringing forward VS Code extension conflict resolutions plus related CLI/Dashboard/test updates that landed on the release branch.

Changes:

  • VS Code extension: adds file picker prompting support, apphost argument passing, and a new “Running apphosts” Activity Bar tree view + update-self command.
  • CLI/Dashboard: improves telemetry/log/span output formatting and ordering, adds ps --resources JSON support, and introduces additional status/progress messaging.
  • CI: moves GitHub CI trigger patterns into eng/testing/github-ci-trigger-patterns.txt and updates the workflow/action to consume it.

Reviewed changes

Copilot reviewed 154 out of 163 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
tests/Aspire.Hosting.Azure.Tests/AzureStorageExtensionsTests.cs Updates emulator arg assertions for Azurite flag.
tests/Aspire.Dashboard.Tests/TelemetryRepositoryTests/TelemetryRepositoryTests.cs Adds test for chronological ordering of initial span snapshot.
tests/Aspire.Cli.Tests/Utils/CliTestHelper.cs Registers ResourceColorMap for CLI command tests.
tests/Aspire.Cli.Tests/TestServices/TestExtensionInteractionService.cs Adds PromptForFilePathAsync test implementation.
tests/Aspire.Cli.Tests/TestServices/TestExtensionBackchannel.cs Adds backchannel hook for file picker prompting.
tests/Aspire.Cli.Tests/TestServices/TestConsoleInteractionService.cs Adds PromptForFilePathAsync test implementation.
tests/Aspire.Cli.Tests/Templating/DotNetTemplateFactoryTests.cs Updates interaction service stub with PromptForFilePathAsync.
tests/Aspire.Cli.Tests/Commands/UpdateCommandTests.cs Extends wrapper interaction service with PromptForFilePathAsync.
tests/Aspire.Cli.Tests/Commands/TelemetryTestHelper.cs Adds shared helper for telemetry command tests + mock HTTP/backchannel.
tests/Aspire.Cli.Tests/Commands/TelemetrySpansCommandTests.cs Adds spans command tests for output/name resolution.
tests/Aspire.Cli.Tests/Commands/TelemetryLogsCommandTests.cs Adds logs command tests for output/name resolution.
tests/Aspire.Cli.Tests/Commands/PublishCommandPromptingIntegrationTests.cs Adds PromptForFilePathAsync to test interaction service.
tests/Aspire.Cli.Tests/Commands/PsCommandTests.cs Adds tests for ps --resources JSON behavior.
tests/Aspire.Cli.Tests/Commands/NewCommandTests.cs Adds test ensuring default output path normalization.
src/Shared/TimeProviderExtensions.cs Generalizes time conversion extensions to TimeProvider.
src/Shared/Otlp/Serialization/OtlpResourceJson.cs Adds GetServiceInstanceId() helper.
src/Shared/Otlp/OtlpHelpers.cs Removes nano timestamp formatter (moved to shared console formatting).
src/Shared/FormatHelpers.cs Adds console time formatter + switches APIs to TimeProvider.
src/Aspire.Hosting.Azure.Storage/AzureStorageExtensions.cs Adds Azurite --disableProductStyleUrl arg for emulator URLs.
src/Aspire.Dashboard/Otlp/Storage/TelemetryRepository.Watchers.cs Ensures initial span snapshot is ordered by StartTime.
src/Aspire.Dashboard/Aspire.Dashboard.csproj Links shared FormatHelpers/TimeProviderExtensions into Dashboard.
src/Aspire.Cli/Utils/ExtensionHelper.cs Adds file-pickers.v1 capability constant.
src/Aspire.Cli/Templating/DotNetTemplateFactory.cs Uses emoji param for status instead of embedding markup in status text.
src/Aspire.Cli/Templating/CliTemplateFactory.TypeScriptStarterTemplate.cs Normalizes output path and wraps creation/npm install in status UI.
src/Aspire.Cli/Templating/CliTemplateFactory.EmptyTemplate.cs Normalizes output path and wraps creation in status UI.
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.zh-Hant.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.zh-Hans.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.tr.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.ru.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.pt-BR.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.pl.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.ko.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.ja.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.it.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.fr.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.es.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.de.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/UpdateCommandStrings.cs.xlf Adds new update-status strings (untranslated placeholders).
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.zh-Hant.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.zh-Hans.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.tr.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ru.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.pt-BR.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.pl.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ko.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ja.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.it.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.fr.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.es.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.de.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.cs.xlf Renames telemetry headers (Name/Timestamp) localization entries.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.zh-Hant.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.zh-Hans.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.tr.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.ru.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.pt-BR.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.pl.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.ko.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.ja.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.it.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.fr.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.es.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.de.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/PsCommandStrings.cs.xlf Adds --resources option description localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.zh-Hant.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.zh-Hans.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.tr.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.ru.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.pt-BR.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.pl.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.ko.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.ja.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.it.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.fr.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.es.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.de.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/NewCommandStrings.cs.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.zh-Hant.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.zh-Hans.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.tr.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.ru.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.pt-BR.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.pl.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.ko.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.ja.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.it.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.fr.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.es.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.de.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/InitCommandStrings.cs.xlf Adds “Resolving template version…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.zh-Hant.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.zh-Hans.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.tr.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.ru.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.pt-BR.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.pl.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.ko.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.ja.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.it.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.fr.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.es.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.de.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/xlf/AddCommandStrings.cs.xlf Adds “Checking for running instances…” localization entry.
src/Aspire.Cli/Resources/UpdateCommandStrings.resx Adds update progress/status strings.
src/Aspire.Cli/Resources/UpdateCommandStrings.Designer.cs Adds strongly-typed accessors for new update strings.
src/Aspire.Cli/Resources/TelemetryCommandStrings.resx Renames telemetry headers to Name/Timestamp.
src/Aspire.Cli/Resources/TelemetryCommandStrings.Designer.cs Updates strongly-typed accessors for renamed headers.
src/Aspire.Cli/Resources/PsCommandStrings.resx Adds --resources option description.
src/Aspire.Cli/Resources/PsCommandStrings.Designer.cs Adds strongly-typed accessor for ResourcesOptionDescription.
src/Aspire.Cli/Resources/NewCommandStrings.resx Adds “Resolving template version…” string.
src/Aspire.Cli/Resources/NewCommandStrings.Designer.cs Adds strongly-typed accessor for ResolvingTemplateVersion.
src/Aspire.Cli/Resources/InitCommandStrings.resx Adds “Resolving template version…” string.
src/Aspire.Cli/Resources/InitCommandStrings.Designer.cs Adds strongly-typed accessor for ResolvingTemplateVersion.
src/Aspire.Cli/Resources/AddCommandStrings.resx Adds “Checking for running instances…” string.
src/Aspire.Cli/Resources/AddCommandStrings.Designer.cs Adds strongly-typed accessor for CheckingForRunningInstances.
src/Aspire.Cli/Projects/ProjectUpdater.cs Uses file picker prompt + wraps update steps in status UI.
src/Aspire.Cli/Projects/GuestAppHostProject.cs Wraps SDK regeneration in status UI + adds completion message.
src/Aspire.Cli/Program.cs Registers ResourceColorMap and shared TimeProvider in DI.
src/Aspire.Cli/Interaction/KnownEmojis.cs Adds Ice emoji constant.
src/Aspire.Cli/Interaction/IInteractionService.cs Adds PromptForFilePathAsync API.
src/Aspire.Cli/Interaction/ExtensionInteractionService.cs Implements file picker prompting via extension capability.
src/Aspire.Cli/Interaction/ConsoleInteractionService.cs Adds console fallback PromptForFilePathAsync.
src/Aspire.Cli/Commands/UpdateCommand.cs Adds status UI for checking/extracting updates and channels fetch.
src/Aspire.Cli/Commands/TelemetrySpansCommand.cs Improves span output formatting, ordering, and resource naming.
src/Aspire.Cli/Commands/TelemetryLogsCommand.cs Improves log output formatting, severity text, and resource naming.
src/Aspire.Cli/Commands/TelemetryCommandHelpers.cs Adds helpers for severity text + resource name resolution + no-data output via interaction service.
src/Aspire.Cli/Commands/RunCommand.cs Wraps running-instance check/stop in status UI.
src/Aspire.Cli/Commands/PsCommand.cs Adds --resources option and emits resources in JSON when requested.
src/Aspire.Cli/Commands/NewCommand.cs Adds status UI for template version resolution + uses file picker for output path.
src/Aspire.Cli/Commands/LogsCommand.cs Switches to DI ResourceColorMap instance.
src/Aspire.Cli/Commands/InitCommand.cs Adds status UI for template version resolution.
src/Aspire.Cli/Commands/DescribeCommand.cs Switches to DI ResourceColorMap instance.
src/Aspire.Cli/Commands/AgentInitCommand.cs Uses file picker prompt for workspace root directory.
src/Aspire.Cli/Commands/AddCommand.cs Wraps running-instance check/stop in status UI.
src/Aspire.Cli/Backchannel/ExtensionBackchannel.cs Adds file picker prompt RPC method.
src/Aspire.Cli/Aspire.Cli.csproj Links shared FormatHelpers/TimeProviderExtensions into CLI.
extension/src/utils/appHostArgs.ts Adds helper to pass resolved apphost arg to CLI commands.
extension/src/utils/AspireTerminalProvider.ts Adds support for appending quoted additional CLI args.
extension/src/server/interactionService.ts Adds VS Code native file picker prompting endpoint.
extension/src/server/AspireRpcServer.ts Registers interaction endpoints before listen() to avoid race.
extension/src/loc/strings.ts Adds UI strings for panel + file picker titles.
extension/src/extension.ts Registers new update-self command + running apphosts tree view and polling.
extension/src/editor/AspireEditorCommandProvider.ts Exposes getAppHostPath() and expands apphost detection.
extension/src/commands/update.ts Passes apphost args; adds updateSelfCommand.
extension/src/commands/publish.ts Passes apphost args.
extension/src/commands/deploy.ts Passes apphost args.
extension/src/commands/add.ts Passes apphost args.
extension/src/capabilities.ts Adds file-pickers.v1 capability.
extension/schemas/aspire-settings.schema.json Formatting-only newline change.
extension/schemas/aspire-global-settings.schema.json Formatting-only newline change.
extension/resources/aspire-activity-bar.svg Adds activity bar icon asset.
extension/package.nls.json Adds localized strings for panel + commands + file picker titles.
extension/package.json Adds Aspire activity bar container/view + commands/menus/colors.
extension/loc/xlf/aspire-vscode.xlf Adds localization entries for new extension UI strings.
extension/README.md Updates documented command list.
eng/testing/github-ci-trigger-patterns.txt Adds skippable-file glob list for GitHub CI.
docs/ci/ci-trigger-patterns.md Documents the CI trigger patterns mechanism and syntax.
.github/workflows/ci.yml Switches to patterns_file input.
.github/actions/check-changed-files/action.yml Refactors action to read glob patterns from file and convert to regex.
Files not reviewed (6)
  • src/Aspire.Cli/Resources/AddCommandStrings.Designer.cs: Language not supported
  • src/Aspire.Cli/Resources/InitCommandStrings.Designer.cs: Language not supported
  • src/Aspire.Cli/Resources/NewCommandStrings.Designer.cs: Language not supported
  • src/Aspire.Cli/Resources/PsCommandStrings.Designer.cs: Language not supported
  • src/Aspire.Cli/Resources/TelemetryCommandStrings.Designer.cs: Language not supported
  • src/Aspire.Cli/Resources/UpdateCommandStrings.Designer.cs: Language not supported

Comment on lines +173 to +186
async promptForFilePath(promptText: string, defaultValue: string | null, directory: boolean): Promise<string | null> {
extensionLogOutputChannel.info(`Prompting for file path: ${promptText}, directory: ${directory}, default: ${defaultValue ?? 'null'}`);

const defaultUri = defaultValue ? vscode.Uri.file(defaultValue) : undefined;
const openLabel = directory ? selectDirectoryTitle : selectFileTitle;

const result = await vscode.window.showOpenDialog({
canSelectFiles: !directory,
canSelectFolders: directory,
canSelectMany: false,
defaultUri,
openLabel,
title: formatText(promptText),
});
Copy link

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

promptForFilePath builds defaultUri via vscode.Uri.file(defaultValue), but callers (e.g., CLI new/init flows) can pass relative defaults like ./MyApp. VS Code’s Uri.file expects an absolute filesystem path, so this can throw or open the dialog in an unintended location. Consider only setting defaultUri when the path is absolute, or resolve relative paths against an appropriate base (workspace folder / working directory) before calling Uri.file.

Copilot uses AI. Check for mistakes.
@github-actions
Copy link
Contributor

github-actions bot commented Mar 3, 2026

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 7a05783:

Test Recording
AddPackageInteractiveWhileAppHostRunningDetached ▶️ View Recording
AddPackageWhileAppHostRunningDetached ▶️ View Recording
AgentCommands_AllHelpOutputs_AreCorrect ▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig ▶️ View Recording
AgentInitCommand_WithMalformedMcpJson_ShowsErrorAndExitsNonZero ▶️ View Recording
AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps ▶️ View Recording
Banner_DisplayedOnFirstRun ▶️ View Recording
Banner_DisplayedWithExplicitFlag ▶️ View Recording
CreateAndDeployToDockerCompose ▶️ View Recording
CreateAndDeployToDockerComposeInteractive ▶️ View Recording
CreateAndPublishToKubernetes ▶️ View Recording
CreateAndRunAspireStarterProject ▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle ▶️ View Recording
CreateAndRunJsReactProject ▶️ View Recording
CreateAndRunPythonReactProject ▶️ View Recording
CreateAndRunTypeScriptStarterProject ▶️ View Recording
CreateEmptyAppHostProject ▶️ View Recording
CreateStartAndStopAspireProject ▶️ View Recording
CreateStartWaitAndStopAspireProject ▶️ View Recording
CreateTypeScriptAppHostWithViteApp ▶️ View Recording
DescribeCommandResolvesReplicaNames ▶️ View Recording
DescribeCommandShowsRunningResources ▶️ View Recording
DetachFormatJsonProducesValidJson ▶️ View Recording
DoctorCommand_DetectsDeprecatedAgentConfig ▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted ▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted ▶️ View Recording
LogsCommandShowsResourceLogs ▶️ View Recording
PsCommandListsRunningAppHost ▶️ View Recording
PsFormatJsonOutputsOnlyJsonToStdout ▶️ View Recording
SecretCrudOnDotNetAppHost ▶️ View Recording
SecretCrudOnTypeScriptAppHost ▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels ▶️ View Recording
StopAllAppHostsFromAppHostDirectory ▶️ View Recording
StopAllAppHostsFromUnrelatedDirectory ▶️ View Recording
StopNonInteractiveMultipleAppHostsShowsError ❌ Upload failed
StopNonInteractiveSingleAppHost ❌ Upload failed
StopWithNoRunningAppHostExitsSuccessfully ❌ Upload failed

📹 Recordings uploaded automatically from CI run #22632578072

@radical radical enabled auto-merge March 3, 2026 02:26
@radical radical disabled auto-merge March 3, 2026 02:30
@radical radical requested a review from maddymontaquila March 3, 2026 02:30
radical and others added 7 commits March 2, 2026 23:36
…lelization (#14858)

* Add ExtractTestPartitions tool and CI test matrix scripts

Add tooling for automated CI test splitting and matrix generation:

- ExtractTestPartitions: .NET tool that scans test assemblies for
  [Trait("Partition", "N")] attributes to discover test partitions
- split-test-projects-for-ci.ps1: discovers partitions from assemblies
  and generates per-project partition JSON files
- build-test-matrix.ps1: builds a canonical test matrix JSON from
  per-project metadata files
- expand-test-matrix-github.ps1: expands the canonical matrix into
  GitHub Actions format with per-OS job entries
- split-test-matrix-by-deps.ps1: splits the expanded matrix by
  dependency type (no-nugets, requires-nugets, requires-cli-archive)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Replace TestRunsheetBuilder with TestEnumerationRunsheetBuilder

Replace the old per-OS runsheet generation with a new metadata-driven
approach:

- Add TestEnumerationRunsheetBuilder.targets: generates per-project
  .tests-metadata.json files during build, containing project metadata
  (supported OSes, timeouts, dependencies, split configuration)
- Update AfterSolutionBuild.targets: add _GenerateCanonicalMatrixJson
  target that invokes build-test-matrix.ps1 to produce a canonical
  test matrix from the metadata files
- Update Testing.props: add default timeout values and _ShortName
  computation for CI display names
- Update tests/Directory.Build.targets: replace ExtractTestClassNames
  with GenerateTestPartitionsForCI target, add _ShouldArchiveTests
  logic after Testing.targets import
- Remove TestRunsheetBuilder.targets and GetTestProjects.proj

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Configure test projects for unified CI splitting infrastructure

Update test project files to use the new TestEnumerationRunsheetBuilder:

- Aspire.Hosting.Tests: enable SplitTestsOnCI with partition-based
  splitting via TestClassNamePrefixForCI
- Aspire.Cli.EndToEnd.Tests: migrate from ExtractTestClassNamesForHelix
  to SplitTestsOnCI, add RequiresCliArchive property
- Aspire.Deployment.EndToEnd.Tests: migrate to SplitTestsOnCI, enable
  RunOnGithubActionsLinux (controlled by OnlyDeploymentTests filter)
- Aspire.EndToEnd.Tests: add RequiresNugets property
- Aspire.Templates.Tests: migrate to SplitTestsOnCI, add RequiresNugets,
  RequiresTestSdk, EnablePlaywrightInstall, and timeout properties
- Aspire.Playground.Tests: remove obsolete TestRunnerPreCommand

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Simplify CI workflows to use unified test matrix

Rework the CI test orchestration to use a single, unified test matrix:

- enumerate-tests action: replace per-category build steps with a
  single build using TestEnumerationRunsheetBuilder, then expand via
  expand-test-matrix-github.ps1. Output a single all_tests matrix.
- tests.yml: collapse 3 per-OS setup jobs into 1, replace 9
  category×OS job groups with 4 dependency-based groups (no-nugets,
  no-nugets-overflow, requires-nugets, requires-cli-archive)
- deployment-tests.yml: use the unified enumerate-tests action with
  OnlyDeploymentTests=true, consume all_tests output
- run-tests.yml: pass through testProjectPath, timeouts, and
  extraTestArgs from matrix entries
- Remove tests-runner.yml (superseded by run-tests.yml)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update Helix targets to consume new partitions JSON format

Update send-to-helix-templatestests.targets to read test class names
from the new .tests-partitions.json format (produced by
GenerateTestPartitionsForCI) instead of the old .tests.list format.
Strip the 'class:' prefix from partition entries for compatibility
with the existing Helix work item generation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add Infrastructure.Tests for CI tooling validation

Add a new test project that validates the CI test splitting
infrastructure:

- ExtractTestPartitionsTests: tests the ExtractTestPartitions tool
  using dynamically-generated mock assemblies with various trait
  and attribute configurations
- BuildTestMatrixTests: validates build-test-matrix.ps1 canonical
  matrix generation from metadata files
- ExpandTestMatrixGitHubTests: validates expand-test-matrix-github.ps1
  GitHub Actions matrix expansion
- SplitTestMatrixByDepsTests: validates split-test-matrix-by-deps.ps1
  dependency-based matrix splitting
- SplitTestProjectsTests: validates split-test-projects-for-ci.ps1
  partition discovery
- Shared TestDataBuilder and PowerShellCommand helpers

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add CI testing documentation and rebalance-tests skill

- docs/ci/TestingOnCI.md: comprehensive documentation covering the
  test splitting architecture, MSBuild properties, matrix generation
  pipeline, and how to add/rebalance test partitions
- .github/skills/rebalance-tests/SKILL.md: agent skill for analyzing
  CI build timings, downloading TRX files, computing optimal partition
  assignments via greedy bin-packing, and applying changes
- Update CLI E2E testing SKILL.md and README.md to reference the
  unified TestEnumerationRunsheetBuilder infrastructure

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add partition traits to Aspire.Hosting.Tests for CI parallelization

Add [Trait("Partition", "N")] attributes to 118 test classes in
Aspire.Hosting.Tests, distributing them across 6 partitions. This
enables the CI infrastructure to split this large test project into
parallel jobs, reducing wall-clock test time.

Partition assignments are balanced by estimated test duration using
greedy bin-packing across the partitions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Remove rebalance-tests skill

Will be developed separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix ExtractTestPartitions race condition and remove silent fallback

- Make build/run failures of ExtractTestPartitions hard errors instead of
  silently falling back to class-based splitting
- Pre-build the tool in enumerate-tests action before parallel test matrix
  generation to eliminate file locking race condition

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix CLI E2E tests: add missing PR env vars to nuget-dependent test steps

The GITHUB_PR_NUMBER, GITHUB_PR_HEAD_SHA, and GH_TOKEN environment
variables were only set on the non-nuget test steps, but CLI E2E tests
have requiresNugets=true and always run via the nuget-dependent path.
This caused 'aspire: command not found' because the install script
could not authenticate or identify the PR to download artifacts from.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix GenerateTestPartitionsForCI running during GitHub Actions test execution

The GenerateTestPartitionsForCI target was firing during test execution jobs
in run-tests.yml because PrepareForHelix=true (passed for archiving) combined
with RunOnAzdoHelix=true (default) satisfied the condition. This caused
split-test-projects-for-ci.ps1 to run and fail since ExtractTestPartitions
wasn't built in that job.

Add IsGitHubActionsRunner!=true to the PrepareForHelix branch so partition
generation only runs via GenerateCIPartitions=true on GitHub Actions
(set by the enumerate-tests action) and via PrepareForHelix on AzDo Helix.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix RepoRoot path quoting for Windows in GenerateTestPartitionsForCI

On Windows, RepoRoot ends with backslash (e.g. D:\a\_work\1\s\). When
wrapped in quotes for the PowerShell command, the trailing backslash
escapes the closing quote, embedding a literal quote character in the
path. TrimEnd the backslash before quoting to fix this.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update eng/TestEnumerationRunsheetBuilder/TestEnumerationRunsheetBuilder.targets

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update eng/TestEnumerationRunsheetBuilder/TestEnumerationRunsheetBuilder.targets

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* chore: trigger CI build for issue #14819 investigation

Whitespace change to trigger CI pipeline and E2E test execution
for reproducing the flaky DetachFormatJsonProducesValidJson test.

Fixes #14819

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix flaky E2E test: retry MSBuild evaluation on empty output

When dotnet msbuild -getProperty/-getItem returns exit code 0 but
produces no stdout output (likely due to MSBuild server contention
when another AppHost process is running), JsonDocument.Parse would
throw 'The input does not contain any JSON tokens', crashing the
aspire run --detach --format json command.

This fix adds retry logic (up to 3 attempts with increasing delay)
for this specific case, making the project discovery more resilient
to concurrent MSBuild operations.

Fixes #14819

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Mitch Denny <mitch@mitchdeny.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add polyglot exports for AppContainers

* Update exports

* Fix tests

* Add test for new behaviors

* Fix cancellation token wrappers in polyglot SDKs

Avoid generating/ registering CancellationToken as a handle wrapper in Go, Java, and Rust generators, and update snapshots.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Replace Playwright MCP server with Playwright CLI installation

Replace the Playwright MCP server configuration in `aspire agent init` with a
secure Playwright CLI installation workflow. Instead of writing MCP server
configuration to each agent environment's config file, the new approach:

- Resolves the @playwright/cli package version from npm registry
- Downloads the package tarball via `npm pack`
- Verifies supply chain integrity (SHA-512 SRI hash comparison)
- Runs `npm audit signatures` for provenance verification
- Installs globally from the verified tarball
- Runs `playwright-cli install --skills` to generate skill files

New abstractions:
- INpmRunner/NpmRunner: npm CLI command runner (resolve, pack, audit, install)
- IPlaywrightCliRunner/PlaywrightCliRunner: playwright-cli command runner
- PlaywrightCliInstaller: orchestrates the secure install flow

This removes ~400 lines of per-scanner MCP config writing code (different JSON
formats for VS Code, Claude Code, Copilot CLI, and OpenCode) and replaces it
with a single global CLI install.

Fixes #14430

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Pin Playwright CLI version range to 0.1.1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add npm provenance verification and break-glass config

- Add INpmProvenanceChecker/NpmProvenanceChecker for SLSA attestation verification
- Return rich ProvenanceVerificationResult with gate-specific outcome enum
- Fix AuditSignaturesAsync with temp-project approach for global tools
- Add disablePlaywrightCliPackageValidation break-glass config option
- Add security design document (docs/specs/safe-npm-tool-install.md)
- Verify SRI integrity, Sigstore attestations, and source repository provenance

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix markdownlint: add language to fenced code block

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Improve version resolution and provenance verification

- Change version range from exact 0.1.1 to >=0.1.1 for future versions
- Add playwrightCliVersion config override for pinning specific versions
- Verify workflow path (.github/workflows/publish.yml) in provenance
- Verify SLSA build type (GitHub Actions) to confirm OIDC token issuer
- Add BuildType to NpmProvenanceData, WorkflowMismatch and
  BuildTypeMismatch outcomes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add tests for version pinning and default version range

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add E2E test for Playwright CLI installation via agent init

Verifies the full lifecycle: project creation, aspire agent init with
Claude Code environment, Playwright CLI installation with npm provenance
verification, and skill file generation.

Marked as OuterloopTest since it requires npm and network access.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Show status spinner during Playwright CLI installation

Wrap the installation work in IInteractionService.ShowStatusAsync to
display a spinner with 'Installing Playwright CLI...' status text while
the npm operations are in progress.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Mirror playwright-cli skill files to all detected agent environments

After playwright-cli install --skills creates files in .claude/skills/,
the installer now mirrors the playwright-cli skill directory to all
other detected agent environment skill directories (.github/skills/,
.opencode/skill/, etc.) so every configured environment has identical
skill files. Stale files in target directories are also removed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update security design doc to match implementation

- Step 4 now documents all three provenance gates: source repository,
  workflow path, and build type (with OIDC issuer implication)
- Added table of verified fields with expected values
- Updated implementation constants to include new fields
- Added configuration section documenting break-glass keys
- Updated verification diagram with workflow/build type checks
- Step 7 now documents skill file mirroring across environments
- Future improvements reflects experimental Sigstore branch status

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Verify workflow ref matches package version in provenance

Add Gate 6 to provenance verification: check that the workflow ref
(git tag) in the SLSA attestation matches refs/tags/v{version}. This
ensures the build was triggered from the expected release tag, not
an arbitrary branch or commit.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Use callback-based workflow ref validation in provenance checker

Make the workflow ref validation configurable per-package by accepting a
Func<WorkflowRefInfo, bool> callback instead of hardcoding the
refs/tags/v{version} format. The ref is parsed into a WorkflowRefInfo
record (Raw, Kind, Name) and the caller decides what's valid.

PlaywrightCliInstaller validates Kind=tags and Name=v{version}.
Other packages can use different tag conventions without modifying
the provenance checker.

Addresses review feedback from DamianEdwards.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Replace npm provenance checking with Sigstore verification

Use the Sigstore and Tuf NuGet packages (0.2.0) to cryptographically
verify npm attestation bundles in-process, replacing the previous
approach of shelling out to 'npm audit signatures'.

- Add SigstoreNpmProvenanceChecker implementing INpmProvenanceChecker
  using SigstoreVerifier with CertificateIdentity.ForGitHubActions
- Remove the npm audit signatures step from PlaywrightCliInstaller
- Keep existing NpmProvenanceChecker but no longer register in DI
- Add optional sriIntegrity parameter to INpmProvenanceChecker for
  digest-based bundle verification
- Update safe-npm-tool-install.md spec to reflect new verification flow
- Temporarily add nuget.org to NuGet.config for Sigstore/Tuf packages

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Refactor SigstoreNpmProvenanceChecker for clarity

Break the monolithic VerifyProvenanceAsync method into focused methods:
- FetchAttestationJsonAsync: fetches attestation JSON from npm registry
- ParseAttestation: parses JSON in a single pass, extracting both the
  Sigstore bundle and provenance data (eliminates duplicate JSON parsing)
- ParseProvenanceFromStatement: extracts provenance fields from in-toto statement
- VerifySigstoreBundleAsync: cryptographic Sigstore verification
- VerifyProvenanceFields: field-level provenance checks (source repo,
  workflow, build type, workflow ref)

Removes dependency on NpmProvenanceChecker.ParseProvenance() which was
re-parsing the same JSON and iterating attestations a second time.

Adds NpmAttestationParseResult type to carry both bundle and provenance
data from a single parse pass.

Adds comprehensive unit tests for ParseAttestation, ParseProvenanceFromStatement,
and VerifyProvenanceFields covering success and failure cases.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add libsodium to nuget-org package source mapping

libsodium is a transitive dependency of NSec.Cryptography (used by Sigstore)
and needs to be mapped to the nuget-org source for CI restore to succeed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Mitch Denny <mitch@mitchdeny.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mitchdenny and others added 2 commits March 3, 2026 23:39
NOTE: Merging to unblock build.

* Remove temporary nuget.org feed from NuGet.config

Remove the temporary nuget-org package source and its package source
mapping entries (Sigstore, Tuf, NSec.Cryptography, libsodium). These
packages will be resolved from the normal internal feeds (dotnet-public,
dotnet-eng) which have wildcard pattern mappings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update Sigstore and Tuf packages to 0.3.0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Mitch Denny <mitch@mitchdeny.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@radical radical requested a review from mitchdenny as a code owner March 3, 2026 16:28
@radical radical merged commit 42c456d into main Mar 3, 2026
758 of 761 checks passed
@radical radical deleted the ankj/backmerge-13.2-to-main branch March 3, 2026 18:43
@dotnet-policy-service dotnet-policy-service bot added this to the 13.3 milestone Mar 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants