[main] Update common Docker engineering infrastructure with latest

eng/common/Install-DotNetSdk.ps1

@@ -37,7 +37,7 @@ $DotnetInstallScriptPath = Join-Path -Path $InstallPath -ChildPath $DotnetInstal
 
 if (!(Test-Path $DotnetInstallScriptPath)) {
     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;
-    & "$PSScriptRoot/Invoke-WithRetry.ps1" "Invoke-WebRequest 'https://dot.net/v1/$DotnetInstallScript' -OutFile $DotnetInstallScriptPath"
+    & "$PSScriptRoot/Invoke-WithRetry.ps1" "Invoke-WebRequest 'https://builds.dotnet.microsoft.com/dotnet/scripts/v1/$DotnetInstallScript' -OutFile $DotnetInstallScriptPath"
 }
 
 $DotnetChannel = "9.0"

eng/common/templates/1es-official.yml

@@ -42,6 +42,8 @@ extends:
   parameters:
     pool: ${{ parameters.pool }}
     sdl:
+      binskim:
+        enabled: true
       componentgovernance:
         ignoreDirectories: $(Build.SourcesDirectory)/versions
         whatIf: ${{ parameters.cgDryRun }}

eng/common/templates/1es-unofficial.yml

@@ -45,6 +45,8 @@ extends:
   parameters:
     pool: ${{ parameters.pool }}
     sdl:
+      binskim:
+        enabled: true
       componentgovernance:
         ignoreDirectories: $(Build.SourcesDirectory)/versions
         whatIf: true

eng/common/templates/stages/dotnet/build-and-test.yml

@@ -0,0 +1,120 @@
+# A wrapper template around the common build-test-publish-repo template with settings
+# specific to the .NET team's infrastructure.
+
+parameters:
+  linuxAmd64Pool: ""
+  isInternalServicingValidation: false
+
+  # Parameters for pre-build jobs
+  customGenerateMatrixInitSteps: []
+  customCopyBaseImagesInitSteps: []
+
+  # Build parameters
+  noCache: false
+  buildMatrixType: platformDependencyGraph
+  buildMatrixCustomBuildLegGroupArgs: ""
+  linuxAmdBuildJobTimeout: 60
+  linuxArmBuildJobTimeout: 60
+  windowsAmdBuildJobTimeout: 60
+  customBuildInitSteps: []
+
+  # Test parameters
+  testMatrixType: platformVersionedOs
+  testMatrixCustomBuildLegGroupArgs: ""
+  linuxAmdTestJobTimeout: 60
+  linuxArmTestJobTimeout: 60
+  windowsAmdTestJobTimeout: 60
+  customTestInitSteps: []
+
+  internalProjectName: null
+  publicProjectName: null
+
+stages:
+- template: /eng/common/templates/stages/build-and-test.yml@self
+  parameters:
+    noCache: ${{ parameters.noCache }}
+    internalProjectName: ${{ parameters.internalProjectName }}
+    publicProjectName: ${{ parameters.publicProjectName }}
+    isInternalServicingValidation: ${{ parameters.isInternalServicingValidation }}
+    customGenerateMatrixInitSteps: ${{ parameters.customGenerateMatrixInitSteps }}
+    buildMatrixCustomBuildLegGroupArgs: ${{ parameters.buildMatrixCustomBuildLegGroupArgs }}
+    testMatrixCustomBuildLegGroupArgs: ${{ parameters.testMatrixCustomBuildLegGroupArgs }}
+    customCopyBaseImagesInitSteps: ${{ parameters.customCopyBaseImagesInitSteps}}
+    customBuildInitSteps: ${{ parameters.customBuildInitSteps }}
+    customTestInitSteps: ${{ parameters.customTestInitSteps }}
+    windowsAmdBuildJobTimeout: ${{ parameters.windowsAmdBuildJobTimeout }}
+    windowsAmdTestJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
+    linuxAmdBuildJobTimeout: ${{ parameters.linuxAmdBuildJobTimeout }}
+    linuxArmBuildJobTimeout: ${{ parameters.linuxArmBuildJobTimeout }}
+    buildMatrixType: ${{ parameters.buildMatrixType }}
+    testMatrixType: ${{ parameters.testMatrixType }}
+
+    internalVersionsRepoRef: InternalVersionsRepo
+    publicVersionsRepoRef: PublicVersionsRepo
+
+    # Linux AMD64
+    linuxAmd64Pool:
+      ${{ if ne(parameters.linuxAmd64Pool, '') }}:
+        ${{ parameters.linuxAmd64Pool }}
+      ${{ elseif eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        vmImage: $(defaultLinuxAmd64PoolImage)
+      ${{ elseif eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        name: $(linuxAmd64InternalPoolName)
+        image: $(linuxAmd64InternalPoolImage)
+        os: linux
+
+    # Linux Arm64
+    linuxArm64Pool:
+      os: linux
+      hostArchitecture: Arm64
+      image: $(linuxArm64PoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        name: $(linuxArm64PublicPoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        name: $(linuxArm64InternalPoolName)
+
+    # Linux Arm32
+    linuxArm32Pool:
+      os: linux
+      hostArchitecture: Arm64
+      image: $(linuxArm32PoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        name: $(linuxArm32PublicPoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        name: $(linuxArm32InternalPoolName)
+
+    # Windows Server 2016
+    windows2016Pool:
+      os: windows
+      name: $(windowsServer2016PoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        image: $(windowsServer2016PublicPoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        image: $(windowsServer2016InternalPoolImage)
+
+    # Windows Server 2019 (1809)
+    windows1809Pool:
+      os: windows
+      name: $(windowsServer2019PoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        image: $(windowsServer2019PublicPoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        image: $(windowsServer2019InternalPoolImage)
+
+    # Windows Server 2022
+    windows2022Pool:
+      os: windows
+      name: $(windowsServer2022PoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        image: $(windowsServer2022PublicPoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        image: $(windowsServer2022InternalPoolImage)
+
+    # Windows Server 2025
+    windows2025Pool:
+      os: windows
+      name: $(windowsServer2025PoolName)
+      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        image: $(windowsServer2025PublicPoolImage)
+      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        image: $(windowsServer2025InternalPoolImage)

eng/common/templates/stages/dotnet/build-test-publish-repo.yml

@@ -1,135 +1,69 @@
-# A wrapper template around the common build-test-publish-repo template with settings
-# specific to the .NET team's infrastructure.
+# This template wraps the .NET-specific build-and-test and publish templates
 
 parameters:
+  linuxAmd64Pool: ""
+  isInternalServicingValidation: false
+
+  # Parameters for pre-build jobs
+  customGenerateMatrixInitSteps: []
+  customCopyBaseImagesInitSteps: []
+
+  # Build parameters
   noCache: false
-  internalProjectName: null
-  publicProjectName: null
+  buildMatrixType: platformDependencyGraph
   buildMatrixCustomBuildLegGroupArgs: ""
-  testMatrixCustomBuildLegGroupArgs: ""
-  customCopyBaseImagesInitSteps: []
-  customGenerateMatrixInitSteps: []
-  customBuildInitSteps: []
-  customTestInitSteps: []
-  customPublishInitSteps: []
-  windowsAmdBuildJobTimeout: 60
-  windowsAmdTestJobTimeout: 60
   linuxAmdBuildJobTimeout: 60
   linuxArmBuildJobTimeout: 60
-  linuxAmd64Pool: ""
-  buildMatrixType: platformDependencyGraph
+  windowsAmdBuildJobTimeout: 60
+  customBuildInitSteps: []
+
+  # Test parameters
   testMatrixType: platformVersionedOs
-  isInternalServicingValidation: false
+  testMatrixCustomBuildLegGroupArgs: ""
+  linuxAmdTestJobTimeout: 60
+  linuxArmTestJobTimeout: 60
+  windowsAmdTestJobTimeout: 60
+  customTestInitSteps: []
+
+  # Publish parameters
+  customPublishInitSteps: []
+
+  # Other common parameters
+  internalProjectName: null
+  publicProjectName: null
+
 
 stages:
-- template: /eng/common/templates/stages/build-test-publish-repo.yml@self
+- template: /eng/common/templates/stages/dotnet/build-and-test.yml@self
   parameters:
-    noCache: ${{ parameters.noCache }}
-    internalProjectName: ${{ parameters.internalProjectName }}
-    publicProjectName: ${{ parameters.publicProjectName }}
+    linuxAmd64Pool: ${{ parameters.linuxAmd64Pool }}
     isInternalServicingValidation: ${{ parameters.isInternalServicingValidation }}
+    # Pre-build
     customGenerateMatrixInitSteps: ${{ parameters.customGenerateMatrixInitSteps }}
+    customCopyBaseImagesInitSteps: ${{ parameters.customCopyBaseImagesInitSteps }}
+    # Build
+    noCache: ${{ parameters.noCache }}
+    buildMatrixType: ${{ parameters.buildMatrixType }}
     buildMatrixCustomBuildLegGroupArgs: ${{ parameters.buildMatrixCustomBuildLegGroupArgs }}
-    testMatrixCustomBuildLegGroupArgs: ${{ parameters.testMatrixCustomBuildLegGroupArgs }}
-    customCopyBaseImagesInitSteps: ${{ parameters.customCopyBaseImagesInitSteps}}
-    customBuildInitSteps: ${{ parameters.customBuildInitSteps }}
-    customTestInitSteps: ${{ parameters.customTestInitSteps }}
-    customPublishInitSteps:
-    - pwsh: |
-        # When reporting the repo name in the publish notification, we don't want to include
-        # the org part of the repo name (e.g. we want "dotnet-docker", not "dotnet-dotnet-docker").
-        # This also accounts for the different separators between AzDO and GitHub repo names.
-
-        $repoName = "$(Build.Repository.Name)"
-
-        $orgSeparatorIndex = $repoName.IndexOf("/")
-        if ($orgSeparatorIndex -eq -1) {
-          $orgSeparatorIndex = $repoName.IndexOf("-")
-        }
-
-        if ($orgSeparatorIndex -ge 0) {
-          $repoName = $repoName.Substring($orgSeparatorIndex + 1)
-        }
-        echo "##vso[task.setvariable variable=publishNotificationRepoName]$repoName"
-      displayName: "Set Custom Repo Name Var"
-    - ${{ parameters.customPublishInitSteps }}
-    windowsAmdBuildJobTimeout: ${{ parameters.windowsAmdBuildJobTimeout }}
-    windowsAmdTestJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
     linuxAmdBuildJobTimeout: ${{ parameters.linuxAmdBuildJobTimeout }}
     linuxArmBuildJobTimeout: ${{ parameters.linuxArmBuildJobTimeout }}
-    buildMatrixType: ${{ parameters.buildMatrixType }}
+    windowsAmdBuildJobTimeout: ${{ parameters.windowsAmdBuildJobTimeout }}
+    customBuildInitSteps: ${{ parameters.customBuildInitSteps }}
+    # Test
     testMatrixType: ${{ parameters.testMatrixType }}
+    testMatrixCustomBuildLegGroupArgs: ${{ parameters.testMatrixCustomBuildLegGroupArgs }}
+    linuxAmdTestJobTimeout: ${{ parameters.linuxAmdTestJobTimeout }}
+    linuxArmTestJobTimeout: ${{ parameters.linuxArmTestJobTimeout }}
+    windowsAmdTestJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
+    customTestInitSteps: ${{ parameters.customTestInitSteps }}
+    # Other
+    internalProjectName: ${{ parameters.internalProjectName }}
+    publicProjectName: ${{ parameters.publicProjectName }}
 
-    internalVersionsRepoRef: InternalVersionsRepo
-    publicVersionsRepoRef: PublicVersionsRepo
-
-    ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-      customPublishVariables:
-      - group: DotNet-AllOrgs-Darc-Pats
-
-    # Linux AMD64
-    linuxAmd64Pool:
-      ${{ if ne(parameters.linuxAmd64Pool, '') }}:
-        ${{ parameters.linuxAmd64Pool }}
-      ${{ elseif eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        vmImage: $(defaultLinuxAmd64PoolImage)
-      ${{ elseif eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        name: $(linuxAmd64InternalPoolName)
-        image: $(linuxAmd64InternalPoolImage)
-        os: linux
-
-    # Linux Arm64
-    linuxArm64Pool:
-      os: linux
-      hostArchitecture: Arm64
-      image: $(linuxArm64PoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        name: $(linuxArm64PublicPoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        name: $(linuxArm64InternalPoolName)
-
-    # Linux Arm32
-    linuxArm32Pool:
-      os: linux
-      hostArchitecture: Arm64
-      image: $(linuxArm32PoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        name: $(linuxArm32PublicPoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        name: $(linuxArm32InternalPoolName)
-
-    # Windows Server 2016
-    windows2016Pool:
-      os: windows
-      name: $(windowsServer2016PoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        image: $(windowsServer2016PublicPoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        image: $(windowsServer2016InternalPoolImage)
-
-    # Windows Server 2019 (1809)
-    windows1809Pool:
-      os: windows
-      name: $(windowsServer2019PoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        image: $(windowsServer2019PublicPoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        image: $(windowsServer2019InternalPoolImage)
-
-    # Windows Server 2022
-    windows2022Pool:
-      os: windows
-      name: $(windowsServer2022PoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        image: $(windowsServer2022PublicPoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        image: $(windowsServer2022InternalPoolImage)
-
-    # Windows Server 2025
-    windows2025Pool:
-      os: windows
-      name: $(windowsServer2025PoolName)
-      ${{ if eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
-        image: $(windowsServer2025PublicPoolImage)
-      ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
-        image: $(windowsServer2025InternalPoolImage)
+- template: /eng/common/templates/stages/dotnet/publish.yml@self
+  parameters:
+    pool: ${{ parameters.linuxAmd64Pool }}
+    isInternalServicingValidation: ${{ parameters.isInternalServicingValidation }}
+    customPublishInitSteps: ${{ parameters.customPublishInitSteps }}
+    internalProjectName: ${{ parameters.internalProjectName }}
+    publicProjectName: ${{ parameters.publicProjectName }}

eng/common/templates/stages/dotnet/publish.yml

@@ -0,0 +1,50 @@
+# This template wraps the common publish stage template with settings specific
+# to the .NET team's infrastructure.
+
+parameters:
+  internalProjectName: null
+  publicProjectName: null
+  pool: ""
+  isInternalServicingValidation: false
+  customPublishInitSteps: []
+
+stages:
+- template: /eng/common/templates/stages/publish.yml@self
+  parameters:
+    internalProjectName: ${{ parameters.internalProjectName }}
+    publicProjectName: ${{ parameters.publicProjectName }}
+    isInternalServicingValidation: ${{ parameters.isInternalServicingValidation }}
+
+    customPublishInitSteps:
+    - pwsh: |
+        # When reporting the repo name in the publish notification, we don't want to include
+        # the org part of the repo name (e.g. we want "dotnet-docker", not "dotnet-dotnet-docker").
+        # This also accounts for the different separators between AzDO and GitHub repo names.
+
+        $repoName = "$(Build.Repository.Name)"
+
+        $orgSeparatorIndex = $repoName.IndexOf("/")
+        if ($orgSeparatorIndex -eq -1) {
+          $orgSeparatorIndex = $repoName.IndexOf("-")
+        }
+
+        if ($orgSeparatorIndex -ge 0) {
+          $repoName = $repoName.Substring($orgSeparatorIndex + 1)
+        }
+        echo "##vso[task.setvariable variable=publishNotificationRepoName]$repoName"
+      displayName: "Set Custom Repo Name Var"
+    - ${{ parameters.customPublishInitSteps }}
+
+    ${{ if eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+      customPublishVariables:
+      - group: DotNet-AllOrgs-Darc-Pats
+
+    pool:
+      ${{ if ne(parameters.pool, '') }}:
+        ${{ parameters.pool }}
+      ${{ elseif eq(variables['System.TeamProject'], parameters.publicProjectName) }}:
+        vmImage: $(defaultLinuxAmd64PoolImage)
+      ${{ elseif eq(variables['System.TeamProject'], parameters.internalProjectName) }}:
+        name: $(linuxAmd64InternalPoolName)
+        image: $(linuxAmd64InternalPoolImage)
+        os: linux