Migrate CI to dnceng with API Scan, signing, and BAR publishing

[mattleibow]

Description

Migrate SkiaSharp CI from the legacy DevDiv chain to two repository-owned dnceng/internal pipelines:

• Build (1642): Prepare → Native → Package → signing, with independent API Scan and BAR registration/validation stage templates.
• Tests (1630): consumes the exact Build run identity and runs managed/platform/sample tests.

Public CI (345) remains one unsigned Native+Package+Tests build and excludes the internal signing/compliance/publishing block.

Security remains fail-closed: CodeQL, AntiMalware, CredScan, PoliCheck, ARMory, ESLint, PSScriptAnalyzer, secret scanning, BinSkim, Component Governance, TSA, PostAnalysis, Note-level API Scan enforcement, and default 1ES network-isolation enforcement.

JavaScript uses explicit NoSignJS package/path policy, byte-identical payload verification, and the signed NuGet as the supported distribution boundary.

Package versions follow Arcade identity. OfficialBuildId is yyyyMMdd.revision; prerelease packages use Arcade short-date.revision. PREVIEW_LABEL=stable on an internal release/* branch produces exact packages with DotNetFinalVersionKind=release; Arcade V3 marks them stable for isolated feeds.

Signing trust is branch-driven: main/release use real signing; other branches test-sign unless forceRealSigning. Forced signing does not register a BAR unless registerInBar is also selected. API Scan runs only for scheduled main builds or explicit runApiScan. BAR validation is independent of API Scan and CI does not promote a channel automatically.

Signing, API Scan, and BAR publishing are direct stage templates so future jobs can be added within each stage. The Build root has one shared stage-composer entry.

The repository, native containers, workloads, and Arcade use stable .NET SDK 10.0.400. The WinUI C++/WinRT projection deliberately remains on SDK 10.0.108, installed side-by-side, because VS MSBuild 17.x cannot load SDK 10.0.2xx+. NuGet.org publication and release-skill migration remain out of scope.

Azure counterpart: dnceng PR 63954.

Related issues

N/A.

Required skia PR

None.

Areas affected

• Managed API (binding/)
• Native / C API (externals/skia/src/c, include/c)
• Generated P/Invoke bindings
• Native dependency or Skia update
• Views & integrations
• Rendering output / visual behavior
• Performance
• Tests
• Build, packaging, or CI
• Documentation or samples

Changes

None — CI-only; no public API, C API, native source, or product behavior change.

Testing

• Canonical tip: d80b0ec394cbdaf79172f0d82623e4ed847370a8 on GitHub and dnceng.
• Generated eng/common is byte-identical to Arcade BAR 327135 (11.0.0-beta.26414.2).
• Test-sign Build 3050801 succeeded.
• Real-sign/API builds 3050803 and 3050903 passed ESRP signing, payload fidelity, trusted-signature validation, API Scan, and manifest generation.
• Identity, prerelease staging, signing, cache coverage, JSON/YAML syntax, Arcade bootstrap, workload-set, and stage-template checks pass locally.
• Public run 1558142 proved both failure modes: Linux/WASM containers still had SDK 10.0.108, while WinUI required 10.0.108 but only 10.0.400 was installed. Containers now use 10.0.400; WinUI installs 10.0.108 alongside it, with regression coverage for both contracts.
• All GitHub review threads were evaluated, fixed, answered, and resolved.
• Replacement PR/public runs for the corrected tip are pending.

Actual remaining gates:

1. Pass replacement internal PR and public CI runs under default network-isolation enforcement.
2. If Enforce reports blocked endpoints, run one manual feature-branch Audit build and request only those exact endpoints. If Enforce passes, skip Audit.
3. Remove the temporary auditNetworkIsolation parameter and pass replacement PR/public checks on that final configuration.
4. Pass one final Enforce Build 1642 on the exact tip with real signing, API Scan, BAR registration, and Arcade validation.
5. Pass the automatically connected Tests 1630 run for that exact Build.
6. Exercise the exact-stable release/* package path, or explicitly defer/remove that behavior before merge; it currently has unit/local manifest evidence only.
7. Obtain human review.

Permanent Maestro channels, General Testing promotion, 1ES default-branch baselines, definition 1641 retirement, the pre-existing Component Governance alert, and release-skill migration are follow-up operations, not merge gates for this pipeline PR.

Checklist

• Tests added or updated
• Changes above lists all public API and behavioral changes (none — CI-only)
• New/changed public API? N/A
• Native change? N/A

[Copilot]

Pull request overview

Migrates SkiaSharp’s CI from the legacy DevDiv chain to repository-owned dnceng/internal pipelines, adding first-class stage templates for signing, API Scan, and BAR publish/validation while keeping public CI unsigned and excluding internal compliance/publishing.

Changes:

• Introduces dedicated stage templates for internal signing (signing), API Scan (api_scan), and BAR publishing/validation (publish_build_assets + post-build validation), composed via a single shared stages template.
• Adds PowerShell tooling + tests for (a) deterministic build identity/version derivation and (b) signed-NuGet payload fidelity verification aligned with eng/Signing.props policy.
• Updates SDK/tooling baseline to .NET SDK 10.0.400 and adjusts packaging/version-suffix behavior for exact-release vs prerelease builds.

Reviewed changes

Copilot reviewed 38 out of 38 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/infra/signing/verify-signed-packages.ps1	New verifier to compare unsigned vs signed NuGet payloads and enforce signing policy expectations.
scripts/infra/signing/tests/Signing.Tests.ps1	New local regression tests for signing policy classification, exclusions, and payload fidelity checks.
scripts/infra/signing/README.md	Documentation for signing stage architecture, policy, artifact flow, and local checks.
scripts/infra/signing/NuGetPayload.psm1	New module to inventory nested NuGet/zip payloads and derive signing policy assignments.
scripts/infra/shared/shared.cake	Updates version-suffix computation (Arcade final version kind) and removes feature-preview suffix logic.
scripts/infra/security/APIScanSurrogates.in.xml	Expands surrogate mappings to cover additional ARM64 scenarios and WinUI surrogate binaries.
scripts/infra/package/tests/StagePrereleasePackages.Tests.ps1	New tests validating prerelease package selection/staging rules for BAR preview publishing.
scripts/infra/package/stage-prerelease-packages.ps1	New script to stage only allowed prerelease packages (rejects exact stable and unsupported labels).
scripts/infra/package/SignList.xml	Removes legacy signing input list (superseded by Arcade signing policy in eng/Signing.props).
scripts/infra/package/nuget.cake	Ensures a single coherent package family per build and forwards VersionSuffix consistently.
scripts/infra/native/wasm/docker/Dockerfile	Adjusts dotnet-install usage for the WASM build container and pins default SDK version.
scripts/infra/native/shared/tests/SetBuildVariables.Tests.ps1	New tests for build identity normalization (PR/main/release/resource-trigger) and pipeline wiring invariants.
scripts/infra/native/shared/set-build-variables.ps1	Rewrites build identity logic around Arcade OfficialBuildId + normalized PR/branch/commit handling.
scripts/infra/caching/repo-deps.json	Updates caching dependency coverage and adds a signing job cache scope.
scripts/azure-templates-variables.yml	Moves BUILD_NUMBER derivation to runtime and adds Arcade OfficialBuildId + final version kind variables.
scripts/azure-templates-stages.yml	Refactors stage composition for build/test/complete roles and adds internal-only signing/API scan/BAR stages.
scripts/azure-templates-stages-test.yml	Updates split-pipeline logic to use buildPipelineType instead of isSplitPipeline.
scripts/azure-templates-stages-signing.yml	New internal signing stage using Arcade official job template + payload verification + manifest generation.
scripts/azure-templates-stages-publish.yml	New BAR registration + validation stages (Arcade V3 publishing).
scripts/azure-templates-stages-prepare.yml	Adds pipeline-time execution of the new identity + prerelease staging tests and cache config validation.
scripts/azure-templates-stages-package.yml	Removes split-pipeline native reupload/signing blocks; forwards --dotNetFinalVersionKind and stages preview artifacts via script.
scripts/azure-templates-stages-native-windows.yml	Makes Win32 MSVC native builds unconditional (no longer gated by legacy DevDiv project checks).
scripts/azure-templates-stages-native-merge.yml	Makes MSVC native artifact merge unconditional.
scripts/azure-templates-stages-native-linux.yml	Minor cleanup (trailing whitespace removal).
scripts/azure-templates-stages-apiscan.yml	New standalone API Scan stage that consumes pipeline artifacts and runs APIScan/TSA/PostAnalysis.
scripts/azure-template-fake-1es.yml	Improves public-template adapter comment and refactors job property expansion for templateContext outputs.
scripts/azure-pipelines-tests.yml	Repoints tests pipeline resource to the new package pipeline and fixes host pool OS metadata.
scripts/azure-pipelines-package.yml	Converts to dnceng 1ES official template with enforced SDL breaks, network isolation, and new stage composition parameters.
scripts/azure-pipelines-native.yml	Removes legacy native-only pipeline definition (replaced by new build pipeline).
scripts/azure-pipelines-complete-internal.yml	Removes legacy internal complete pipeline (replaced by new build/test split plus public complete).
global.json	Bumps repo SDK/tooling to .NET SDK 10.0.400.
eng/Signing.props	New Arcade signing policy source of truth (explicit basenames, NoSignJS enabled).
eng/SignCheckExclusionsFile.txt	New SignCheck DO-NOT-SIGN exclusions matching JS payload policy.
eng/Publishing.props	New Arcade publishing policy separating preview vs exact-release package views.
documentation/dev/versioning.md	Updates versioning guidance to Arcade identity and exact-release sentinel behavior.
documentation/dev/updating-dotnet-version.md	Updates SDK bump checklist to include tools.dotnet parity requirement.
documentation/dev/releasing.md	Updates release documentation for BAR/Arcade V3 flow and new pipeline IDs/feeds.
documentation/dev/building-samples.md	Updates sample build/version examples to Arcade-derived short-date.revision build number.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 39 out of 39 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

scripts/azure-pipelines-package.yml:118

• This strict-isolation configuration still includes the Permissive policy, which the PR description itself lists as a remaining gate to remove. That leaves the migrated build/signing path with broader network access than the stated fail-closed posture; complete the endpoint audit and remove this policy before merging.

      networkIsolationPolicy: Permissive, CFSClean, CFSClean2

documentation/dev/releasing.md:187

• This command still invokes a status script that is hard-coded to the legacy DevDiv chain and feed (.agents/skills/release-status/scripts/pipeline-status.py:18-45, IDs 26493/10789/15756). It cannot report the new dnceng Build 1642, Tests 1630, or BAR identity promised here, so the documented release-status workflow is broken until the script and skill metadata are migrated.

```bash
python3 .agents/skills/release-status/scripts/pipeline-status.py release/{version}

**documentation/dev/releasing.md:118**
* The PR says a protected release-by-BAR pipeline is future work, but this table documents it as an available pipeline. The current release-publish tooling still queues legacy DevDiv pipeline 25298 and selects a managed run (`.agents/skills/release-publish/scripts/push-release-packages.py:17-45`), not a BAR ID. Keep this entry marked as future/out of scope or implement and migrate the protected publisher before presenting this as the release procedure.

| NuGet.org Publish | Gathers one exact BAR build and publishes it after protected human approval. |

</details>