Repository navigation
Replace global tool shim with RID-specific .NET 11 packaging - #28396
Merged
Justin Chung (jshigetomi) merged 4 commits intoNov 12, 2026
Merged
Justin Chung (jshigetomi) merged 4 commits into
Justin Chung (jshigetomi) merged 4 commits into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Justin Chung (jshigetomi)
added
the
CL-BuildPackaging
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Linux/macOS packages built on Windows use incorrect platform implementations, while missing PSMaml schemas break XML help installation and the preparation step lacks required restore-phase configuration.
3 open issues
What changed in this PR
This PR aligns PowerShell global-tool packaging with the repository’s .NET 11 dependencies and supplies credentials for authenticated Azure Artifacts restores.
Changes:
- Targets the cross-platform global-tool project at
net11.0, with runtime-specific packages. - Maps
VSS_NUGET_EXTERNAL_FEED_ENDPOINTSinto both publish and pack task environments. - Provides per-runtime publish, signing, and package post-processing steps.
| File | Description |
|---|---|
src/GlobalTools/PowerShell/PowerShell.csproj |
Defines the .NET 11 global tool and its platform-specific dependencies and content. |
.pipelines/templates/step/globaltool-rid-pack.yml |
Publishes, signs, and packs runtime-specific tools with explicit feed credentials. |
Review effort: Balanced
| Start-TypeGen | ||
| Write-Verbose -Verbose "Publishing PowerShell global tool for RID: $rid" | ||
| dotnet publish -r $rid --no-self-contained --artifacts-path $artifactsPath /property:PackageVersion=$(Version) --configuration Release /property:ReleaseTag=$ReleaseTagToUse |
| displayName: 'Publish PowerShell global tool (${{ parameters.Rid }})' | ||
| env: | ||
| __DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY) | ||
| VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS) |
|
|
||
| <ItemGroup> | ||
| <Compile Include="..\..\powershell\Program.cs" Exclude="bin\**;obj\**;**\*.xproj;packages\**" /> | ||
| <None Include="..\PowerShell.Windows.x64\Powershell_64.png" Pack="true" PackagePath="" /> |
added 3 commits
November 11, 2026 12:08
Replace GlobalTool.Shim with RID-specific .NET tool (PowerShell#238) Backport of https://github.com/azure-core-compute/PowerShell-MSRC/commit/ff175e3cb7c041549b4170099e4340d0468be54f Related work items: #164793
## Summary - update `src/GlobalTools/PowerShell/PowerShell.csproj` from `net10.0` to `net11.0` - align the cross-platform Global Tool with `Microsoft.PowerShell.SDK` and the Windows Global Tool - fix Release Branch Prep vulnerability-scanner restore failures after moving release/v7.7.0 to .NET 11 ## Validation - `dotnet restore src\GlobalTools\PowerShell\PowerShell.csproj --runtime win-x64 /p:NuGetAudit=false`
<!-- Anything that looks like this is a comment and can't be seen after the Pull Request is created. -->
# PR Summary
Explicitly maps `VSS_NUGET_EXTERNAL_FEED_ENDPOINTS` into the environment of both global-tool steps that invoke `dotnet`: the restore/publish step and the later pack step.
## PR Context
Packaging build 738142 failed in all eight global-tool RID matrix jobs with NU1301 / HTTP 401 while restoring from the `powershell-net-11-early-access` Azure Artifacts feed.
`.pipelines/templates/insert-nuget-config-azfeed.yml` creates `VSS_NUGET_EXTERNAL_FEED_ENDPOINTS` as a secret pipeline variable, but Azure Pipelines does not automatically export secret variables into subsequent task environments. The global-tool publish step only mapped `__DOTNET_RUNTIME_FEED_KEY`, so the Azure Artifacts Credential Provider could not read the endpoint credentials. This change explicitly exports the secret variable to restore/publish and pack for consistent authenticated NuGet access.
Validation:
- `git diff --check` — passed
- `python -c "import pathlib, yaml; p=pathlib.Path(r'.pipelines\\templates\\step\\globaltool-rid-pack.yml'); yaml.safe_load(p.read_text(encoding='utf-8')); print('YAML parsed successfully')"` — passed (`YAML parsed successfully`)
## PR Checklist
- [x] [PR has a meaningful title](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- Use the present tense and imperative mood when describing your changes
- [x] [Summarized changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] [Make sure all `.h`, `.cpp`, `.cs`, `.ps1` and `.psm1` files have the correct copyright header](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [x] This PR is ready to merge. If this PR is a work in progress, please open this as a [Draft Pull Request and mark it as Ready to Review when it is ready to merge](https://docs.github.com/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests#draft-pull-requests).
- **[Breaking changes](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#making-breaking-changes)**
- [x] None
- **OR**
- [ ] [Experimental feature(s) needed](https://github.com/MicrosoftDocs/PowerShell-Docs/blob/main/reference/7.5/Microsoft.PowerShell.Core/About/about_Experimental_Features.md)
- [ ] Experimental feature name(s):
- **User-facing changes**
- [x] Not Applicable
- **OR**
- [ ] [Documentation needed](https://github.com/PowerShell/PowerShell/blob/master/.github/CONTRIBUTING.md#pull-request---submission)
- [ ] Issue filed:
- **Testing - New and feature**
- [x] N/A or can only be tested interactively
- **OR**
- [ ] [Make sure you've added a new test if existing tests do not effectively test the code changed](https://github.com/PowerShell/PowerShell/blob/master/.githu...
Justin Chung (jshigetomi)
force-pushed
the
jshigetomi-global-tool-infrastructure
branch
from
November 11, 2026 18:09
0b20fce to
8d22946
Compare
Justin Chung (jshigetomi)
changed the title
Aditya Patwardhan (adityapatwardhan)
approved these changes
Nov 11, 2026
Justin Chung (jshigetomi)
merged commit Nov 12, 2026
436bf03
into
PowerShell:master
38 of 39 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Summary
Microsoft.PowerShell.GlobalTool.Shimwith RID-specific .NET tool sub-packages and a RID-agnostic pointer packageVSS_NUGET_EXTERNAL_FEED_ENDPOINTSto the global-tool publish and pack steps for authenticated Azure Artifacts accessPR Context
The previous global tool bundled Windows and Unix payloads behind a custom runtime-selection shim. This change adopts the .NET SDK's RID-specific tool packaging model: each supported RID is built and signed independently, while a lightweight pointer package maps installations to the correct RID package.
The project targets .NET 11 to align with the repository SDK dependencies. The packaging tasks also explicitly map the secret Azure Artifacts endpoint credentials into each
dotnettask environment because Azure Pipelines does not automatically export secret variables.Azure DevOps source commits, preserved in chronological order:
5cd15d2f9e1f0c090477d58a5a4148c5d8d7ae59— Replace GlobalTool.Shim with RID-specific .NET tool00a84d903c9c404e4deae7ebc12ff945af5db171— Update cross-platform global tool to target .NET 11c23488d8bd29f5fc5c50ab6fac951ed53b0e6a65— Fix NuGet authentication for global tool packagingValidation:
build.psm1,tools\packaging\packaging.psm1,tools\packaging\packaging.psd1, andtools\packaging\packaging.strings.psd1with the PowerShell parser — passedwin-x64andlinux-x64— passeddotnet restore src\GlobalTools\PowerShell\PowerShell.csproj --runtime win-x64 /p:NuGetAudit=false— passeddotnet msbuild src\GlobalTools\PowerShell\PowerShell.csproj -getProperty:TargetFramework -getProperty:ToolPackageRuntimeIdentifiers— passed (net11.0and all eight expected RIDs)git diff --check origin/master...HEAD— passedPR Checklist
.h,.cpp,.cs,.ps1and.psm1files have the correct copyright header