[release/13.4] Unblock WinGet Manifest job on locked-down 1ES agents; update manifest tags - #17958
Merged
Jose Perez Rodriguez (joperezr) merged 3 commits intoJun 5, 2026
Conversation
The `🟣Install winget CLI` step on the WinGet Manifest job fails on the 1ES `1es-windows-2022` pool with: An attempt was made to access a socket in a way forbidden by its access permissions. (cdn.winget.microsoft.com:443) The step ran `Repair-WinGetPackageManager -Latest -Force -AllUsers` to (re)install the winget CLI, which downloads the Microsoft.DesktopAppInstaller MSIX from cdn.winget.microsoft.com. That CDN is not reachable from the locked-down 1ES pool, so the PowerShell step exits 1, `🟣Prepare WinGet manifests` is skipped, and `🔒 🟣Publish WinGet manifests` then fails because the manifest directory was never produced. The whole job aborts before any manifests reach the artifact share. This is the failure on release/13.4 builds 2989641, 2989822, 2990382, 2990509, 2990688. Replace the install/repair step with a probe-only step that records whether winget happens to be pre-installed on the image, and hardcode the downstream `prepare-manifest-artifact.ps1` call to `Offline` ValidationMode. The script tolerates a missing winget in Offline mode (logs a warning, still produces the manifest artifact) but hard-fails in Full mode — and Full mode is unreachable on this pool because winget cannot be installed. Drop the `skipUrlValidation` template parameter, the only callers (azure-pipelines.yml, azure-pipelines-unofficial.yml), and the `_PackagesPublished` variable composed only to feed it. Manifest validation is intentionally delegated to upstream `microsoft/winget-pkgs` CI — see the new "Validation model" section in eng/winget/README.md for what upstream checks (schema, binary AV scan, URL + SmartScreen, SHA256, install/uninstall in a clean VM). This matches the pattern used by every other Microsoft repo publishing to WinGet (PowerToys, terminal, winget-create itself, which also runs on the same 1ES `windows-2022` pool and likewise does not invoke winget in CI). End-to-end probe + prepare + publish path validated on internal build 2990922 (a sibling branch that exercised the WinGet Manifest job via a stage-condition override). Real-prod validation occurs when this lands on release/13.4 and the stage condition naturally includes it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The WinGet package template still categorized the Aspire CLI with the `dotnet` tag. Replace that tag with `csharp` and `typescript` so the package metadata better matches supported Aspire application languages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The 'Validation model' section originally implied the Aspire side does only generation + opportunistic `winget validate`. In fact `.github/workflows/prepare-installer-artifacts.yml` also runs `dogfood.ps1 -Force` (real `winget install --manifest` from the freshly built archive) plus a smoke test (`aspire new` + restore) against the installed shim on every PR. Document that. Clarify that the install-only path catches issues `winget validate` does not (SHA mismatch, broken `InstallerSwitches`, missing `Commands`), while the full install/uninstall round-trip remains an upstream-CI responsibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ankit Jain (radical)
requested review from
David Fowler (davidfowl),
Jose Perez Rodriguez (joperezr) and
Sébastien Ros (sebastienros)
June 5, 2026 17:19
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17958Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17958" |
Jose Perez Rodriguez (joperezr)
approved these changes
Jun 5, 2026
Jose Perez Rodriguez (joperezr)
deleted the
backport/pr-17913-to-release/13.4
branch
June 5, 2026 21:46
Contributor
Author
|
✅ No documentation update needed. docs_optional → No triggered signals (signal_count: 0); advisory All 6 changed files are under
This PR unblocks the WinGet Manifest CI job on locked-down 1ES agents by switching from installing winget to probing for a pre-installed one, and hardens the manifest tags — purely internal CI/build infrastructure with no user-facing behavior change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #17913 to release/13.4
/cc Ankit Jain (@radical)
Fixes #17953
Customer Impact
Testing
Risk
Regression?