mono · mattleibow · Sep 1, 2026 · Sep 1, 2026
diff --git a/.gitignore b/.gitignore
@@ -6,6 +6,8 @@
 # Repository-specific files
 output/
 .DS_Store
+tools/
+.nuget/
 
 # Generated documentation files
 docs/llms.txt
@@ -34,6 +36,10 @@ bld/
 [Oo]bj/
 [Ll]og/
 
+# Arcade repository-local toolsets and package cache
+/.dotnet/
+/.packages/
+
 # Visual Studio 2015 cache/options directory
 .vs/
 # Uncomment if you have tasks that create the project's static files in wwwroot

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # SkiaSharp.Extended
 
-[![Build Status](https://dev.azure.com/devdiv/DevDiv/_apis/build/status/Xamarin/Components/SkiaSharp.Extended?branchName=main)](https://dev.azure.com/devdiv/DevDiv/_build/latest?definitionId=10846&branchName=main)  [![Build Status](https://dev.azure.com/xamarin/public/_apis/build/status/mono/SkiaSharp/SkiaSharp.Extended%20(Public)?branchName=main)](https://dev.azure.com/xamarin/public/_build/latest?definitionId=6&branchName=main)
+[![Build Status](https://dev.azure.com/dnceng-public/public/_apis/build/status/346?branchName=main)](https://dev.azure.com/dnceng-public/public/_build?definitionId=346&branchName=main)
 
 **SkiaSharp.Extended** is a collection some cool libraries that may be
 useful to some apps. There are several repositories that may have

diff --git a/azure-pipelines-public.yml b/azure-pipelines-public.yml
@@ -45,10 +45,32 @@ jobs:
     displayName: Pack
     steps:
       - template: /scripts/azure-pipelines-steps-prepare.yml@self
+      - pwsh: ./scripts/infra/tests/SetBuildVariables.Tests.ps1
+        displayName: Validate build identity
+      - pwsh: ./scripts/infra/tests/AssembleArcadeAssets.Tests.ps1
+        displayName: Validate Arcade asset assembly
       - pwsh: dotnet cake --target=pack
         displayName: Pack NuGet packages
-      - publish: output
-        artifact: pack
+      - pwsh: ./scripts/infra/assemble-arcade-assets.ps1 -OutputRoot ./output
+        displayName: Assemble Arcade assets
+      - publish: output/nugets
+        artifact: nuget
+        condition: always()
+        displayName: Upload NuGet packages
+      - publish: output/arcade-assets/Shipping
+        artifact: arcade_shipping
+        condition: always()
+        displayName: Upload Arcade Shipping assets
+      - publish: output/arcade-assets/NonShipping
+        artifact: arcade_nonshipping
+        condition: always()
+        displayName: Upload Arcade NonShipping assets
+      - publish: output/pdbs
+        artifact: PdbArtifacts
+        condition: always()
+        displayName: Upload loose PDBs
+      - publish: output/binlogs
+        artifact: pack_logs
         condition: always()
         displayName: Upload Logs
 

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -2,118 +2,158 @@ trigger:
   branches:
     include:
       - main
+      - release/*
+  paths:
+    exclude:
+      - .github/**
+      - docs/**
+      - README.md
 
 pr: none
 
+schedules:
+  - cron: "0 0 * * *"
+    displayName: Daily main build
+    branches:
+      include:
+        - main
+    always: true
+
 parameters:
   - name: buildAgent
-    displayName: 'The build agent to use'
+    displayName: 'The Windows build agent configuration'
     type: object
     default:
-      name: Maui-1ESPT
-      image: 1ESPT-Windows2022
-      os: windows
+      pool:
+        name: NetCore1ESPool-Internal
+        image: 1es-windows-2022
+        os: windows
+  - name: packageLabel
+    displayName: 'Package label'
+    type: string
+    default: preview
+    values:
+      - preview
+      - stable
   - name: runApiScan
-    displayName: 'Run API Scan'
+    displayName: 'Run API Scan for this build'
     type: boolean
     default: false
   - name: forceRealSigning
-    displayName: 'Ignore all logic and force Real signing on binaries'
+    displayName: 'Force real signing on a trusted feature build'
+    type: boolean
+    default: false
+  - name: registerInBar
+    displayName: 'Register a forced real-sign build in BAR'
     type: boolean
     default: false
 
 variables:
   - template: /scripts/azure-pipelines-variables.yml@self
+  - name: PREVIEW_LABEL
+    value: ${{ parameters.packageLabel }}
 
 resources:
   repositories:
-    - repository: yaml-templates
-      type: git
-      name: DevDiv/Xamarin.yaml-templates
-      ref: refs/heads/main
-    - repository: 1ESTemplates
+    - repository: 1ESPipelineTemplates
       type: git
-      name: 1ESPipelineTemplates/MicroBuildTemplate
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@1ESTemplates
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
-    pool: ${{ parameters.buildAgent }}
+    pool: ${{ parameters.buildAgent.pool }}
+    settings:
+      networkIsolationMode: Audit
     customBuildTags:
       - ES365AIMigrationTooling
     sdl:
-      sourceRepositoriesToScan:
-        exclude:
-        - repository: yaml-templates
+      armory:
+        break: true
       binskim:
         enabled: true
-        break: false
+        break: true
+      codeql:
+        compiled:
+          enabled: true
+        enabledOnNonDefaultBranches: true
       codeInspector:
         enabled: true
       credscan:
         enabled: true
+        break: true
+      eslint:
+        break: true
       policheck:
         enabled: true
+        break: true
+      psscriptanalyzer:
+        enabled: true
+        break: true
       spotBugs:
         enabled: false
       tsa:
         enabled: true
         configFile: $(Build.SourcesDirectory)/.config/tsaoptions.json
     stages:
-
-      - stage: build
-        displayName: Build
+      - stage: package
+        displayName: Build and package
         jobs:
-          - job: build
-            displayName: Build
+          - job: package
+            displayName: Build and package NuGets
+            timeoutInMinutes: 180
             templateContext:
-              outputParentDirectory: 'output'
+              outputParentDirectory: output
               outputs:
                 - output: pipelineArtifact
-                  displayName: 'Upload NuGets'
-                  artifactName: 'nuget'
-                  targetPath: 'output/nugets'
+                  displayName: Publish NuGet packages
+                  artifactName: nuget
+                  targetPath: output/nugets
+                - output: pipelineArtifact
+                  displayName: Publish Arcade Shipping assets
+                  artifactName: arcade_shipping
+                  targetPath: output/arcade-assets/Shipping
+                - output: pipelineArtifact
+                  displayName: Publish Arcade NonShipping assets
+                  artifactName: arcade_nonshipping
+                  targetPath: output/arcade-assets/NonShipping
+                - output: pipelineArtifact
+                  displayName: Publish loose PDBs
+                  artifactName: PdbArtifacts
+                  targetPath: output/pdbs
+                  isProduction: false
+                - output: pipelineArtifact
+                  displayName: Publish package logs
+                  artifactName: package_logs
+                  targetPath: output/binlogs
+                  condition: always()
+                  isProduction: false
             steps:
               - template: /scripts/azure-pipelines-steps-prepare.yml@self
+              - pwsh: ./scripts/infra/tests/SetBuildVariables.Tests.ps1
+                displayName: Validate build identity
+              - pwsh: ./scripts/infra/tests/AssembleArcadeAssets.Tests.ps1
+                displayName: Validate Arcade asset assembly
               - pwsh: dotnet cake --target=pack
                 displayName: Pack NuGets
+              - pwsh: ./scripts/infra/assemble-arcade-assets.ps1 -OutputRoot ./output
+                displayName: Assemble Arcade assets
 
-      - stage: signing
-        displayName: Sign NuGets
-        dependsOn: build
-        jobs:
-          - template: sign-artifacts/jobs/v4.yml@yaml-templates
-            parameters:
-              usePipelineArtifactTasks: true
-              checkoutType: 'self'
-              ${{ if or(eq(parameters.forceRealSigning, 'true'), eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/')) }}:
-                signType: 'Real'
-              ${{ else }}:
-                signType: 'Test'
-
-      - ${{ if or(eq(parameters.runApiScan, 'true'), and(eq(variables['Build.Reason'], 'Schedule'), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/')))) }}:
-        - template: security/apiscan/v0.yml@yaml-templates
+      - ${{ if and(eq(variables['System.TeamProject'], 'internal'), ne(variables['Build.Reason'], 'PullRequest'), not(startsWith(variables['Build.SourceBranch'], 'refs/pull/'))) }}:
+        - template: /scripts/azure-pipelines-stages-signing.yml@self
           parameters:
-            windowsPoolName: ${{ parameters.buildAgent.name }}
-            windowsImageOverride: ${{ parameters.buildAgent.image }}
-            timeoutInMinutes: 480
-            tsaConfigFile: $(Build.SourcesDirectory)/.config/tsaoptions.json
-            tsaUploadEnabled: true
-            stageDependsOn:
-             - build
-            scanArtifacts:
-             - nuget
-            apiScanSoftwareName: SkiaSharp
-            apiScanSoftwareVersionNum: 3
-            apiScanAuthConnectionString: 'runAs=App;AppId=$(ApiScanClientId)'
-            preScanSteps:
-              - pwsh: |
-                  $nupkgs = (Get-ChildItem "$(Build.ArtifactStagingDirectory)\binaries-to-scan\*\*.*nupkg")
-                  foreach ($nupkg in $nupkgs) {
-                    $filename = $nupkg.Name.TrimEnd('.nupkg')
-                    $dest = "$(Build.ArtifactStagingDirectory)\binaries-to-scan\nuget_symbols-extracted\$filename"
-                    Write-Host "Extracting '$nupkg' to '$dest'..."
-                    Expand-Archive $nupkg $dest
-                    Remove-Item $nupkg
-                  }
-                displayName: Extract all the .nupkg files
+            buildAgent: ${{ parameters.buildAgent }}
+            ${{ if or(eq(parameters.forceRealSigning, 'true'), eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/')) }}:
+              useRealSigning: true
+            ${{ else }}:
+              useRealSigning: false
+            ${{ if or(and(eq(parameters.forceRealSigning, 'true'), eq(parameters.registerInBar, 'true')), eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/')) }}:
+              publishAssets: true
+            ${{ else }}:
+              publishAssets: false
+
+        - ${{ if or(eq(parameters.runApiScan, 'true'), and(eq(variables['Build.SourceBranch'], 'refs/heads/main'), eq(variables['Build.Reason'], 'Schedule'))) }}:
+          - template: /scripts/azure-pipelines-stages-apiscan.yml@self
+            parameters:
+              buildAgent: ${{ parameters.buildAgent }}
diff --git a/build.cake b/build.cake
@@ -45,32 +45,25 @@ Task("build")
 Task("pack")
 	.Does(() =>
 {
-	DotNetPack("./scripts/SkiaSharp.Extended-Pack.slnf", new DotNetPackSettings
+	var outputDirectory = OUTPUT_ROOT.Combine("nugets");
+	CleanDirectory(outputDirectory);
+
+	var settings = new DotNetPackSettings
 	{
 		Configuration = CONFIGURATION,
 		MSBuildSettings = new DotNetMSBuildSettings()
 			.EnableBinaryLogger(OUTPUT_ROOT.Combine("binlogs").CombineWithFilePath("pack.binlog").FullPath),
-		OutputDirectory = OUTPUT_ROOT.Combine("nugets"),
+		OutputDirectory = outputDirectory,
 		ArgumentCustomization = AppendForwardingLogger
-	});
-
-	var preview = PREVIEW_LABEL;
-	if (!string.IsNullOrEmpty(BUILD_NUMBER))
+	};
+	if (!string.Equals(PREVIEW_LABEL, "stable", StringComparison.OrdinalIgnoreCase))
 	{
-		preview += $".{BUILD_NUMBER}";
+		settings.VersionSuffix = string.IsNullOrEmpty(BUILD_NUMBER)
+			? PREVIEW_LABEL
+			: $"{PREVIEW_LABEL}.{BUILD_NUMBER}";
 	}
 
-	DotNetPack("./scripts/SkiaSharp.Extended-Pack.slnf", new DotNetPackSettings
-	{
-		Configuration = CONFIGURATION,
-		MSBuildSettings = new DotNetMSBuildSettings()
-			.EnableBinaryLogger(OUTPUT_ROOT.Combine("binlogs").CombineWithFilePath("pack-preview.binlog").FullPath),
-		OutputDirectory = OUTPUT_ROOT.Combine("nugets"),
-		VersionSuffix = preview,
-		ArgumentCustomization = AppendForwardingLogger
-	});
-
-	CopyFileToDirectory("./source/SignList.xml", "./output/nugets");
+	DotNetPack("./scripts/SkiaSharp.Extended-Pack.slnf", settings);
 });
 
 Task("test")

diff --git a/eng/Build.props b/eng/Build.props
@@ -0,0 +1,8 @@
+<Project>
+  <PropertyGroup>
+    <RestoreUsingNuGetTargets>false</RestoreUsingNuGetTargets>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectToBuild Include="$(MSBuildThisFileDirectory)NoBuild.proj" />
+  </ItemGroup>
+</Project>
diff --git a/eng/NoBuild.proj b/eng/NoBuild.proj
@@ -0,0 +1,3 @@
+<Project>
+  <Target Name="Restore" />
+</Project>
diff --git a/eng/Publishing.props b/eng/Publishing.props
@@ -0,0 +1,15 @@
+<Project>
+  <PropertyGroup>
+    <PublishingVersion>3</PublishingVersion>
+    <AutoGenerateSymbolPackages>false</AutoGenerateSymbolPackages>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Artifact Include="$(ArtifactsShippingPackagesDir)**\*.nupkg"
+              Kind="Package" />
+    <Artifact Include="$(ArtifactsShippingPackagesDir)**\*.snupkg"
+              Kind="Blob"
+              RelativeBlobPath="assets/symbols/%(Filename)%(Extension)"
+              ManifestArtifactData="NonShipping=false;Category=SNORPKEG;" />
+  </ItemGroup>
+</Project>
diff --git a/eng/SignCheckExclusionsFile.txt b/eng/SignCheckExclusionsFile.txt
@@ -0,0 +1,2 @@
+;; No signable payloads are intentionally excluded.
+;; Keep this file so Arcade SignCheck remains fail-closed when exclusions are added.
diff --git a/eng/Signing.props b/eng/Signing.props
@@ -0,0 +1,26 @@
+<Project>
+  <PropertyGroup>
+    <EnableDefaultArtifacts>false</EnableDefaultArtifacts>
+    <UseDotNetCertificate>false</UseDotNetCertificate>
+    <DoStrongNameCheck>false</DoStrongNameCheck>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <ItemsToSign Remove="@(ItemsToSign)" />
+    <StrongNameSignInfo Remove="@(StrongNameSignInfo)" />
+    <FileSignInfo Remove="@(FileSignInfo)" />
+    <FileExtensionSignInfo Remove="@(FileExtensionSignInfo)" />
+
+    <ItemsToSign Include="$(ArtifactsShippingPackagesDir)**\*.nupkg" />
+    <ItemsToSign Include="$(ArtifactsShippingPackagesDir)**\*.snupkg" />
+
+    <FileExtensionSignInfo Include=".nupkg;.snupkg" CertificateName="NuGet" />
+
+    <FirstPartyFile Include="SkiaSharp.Extended.dll" />
+    <FirstPartyFile Include="SkiaSharp.Extended.UI.dll" />
+
+    <FileSignInfo Include="@(FirstPartyFile)" CertificateName="Microsoft400" />
+
+    <ItemsToSkip3rdPartyCheck Include="@(FirstPartyFile)" />
+  </ItemGroup>
+</Project>
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		;; No signable payloads are intentionally excluded.
		;; Keep this file so Arcade SignCheck remains fail-closed when exclusions are added.