From 452e2fb3381efee37adb0894601d5f6154544ddc Mon Sep 17 00:00:00 2001 From: Tyrie Vella Date: Wed, 27 May 2026 13:03:46 -0700 Subject: [PATCH] Release pipeline: route vcpkg through Terrapin asset cache The official release pipeline has been failing since libgit2 was statically linked via vcpkg, because the pool's build agents do not have direct public-internet access. vcpkg was reaching out to sourceforge.net (and other origins) for libgit2 transitive dependencies (pcre, zlib, http_parser, ...) which the network layer blocked, causing WinHttpSendRequest 12029 errors. Route vcpkg asset downloads through the internal Terrapin cache (the canonical CI asset-caching service). This is opt-in. External contributors and the public GitHub Actions PR-validation workflow (.github/workflows/build.yaml) continue to use the standard vcpkg flow with direct downloads from public origins. No internal feed authentication is required to build VFS for Git from a fresh clone, and the repo source code intentionally contains no msbuild SDK references that would pull internal packages into a default restore. Changes: Directory.Build.props Add IsLocalBuild and UseTerrapinAssetCache properties, both defaulted to false. IsLocalBuild controls Terrapin upload-on-fetch (allowed on dev boxes only); UseTerrapinAssetCache opts the build into the Terrapin asset-cache machinery (release pipeline only). Directory.Build.targets Build a --x-asset-sources string that combines the Terrapin retrieval script with x-block-origin, gated on UseTerrapinAssetCache=true, and append it to both vcpkg install invocations. Add a guard that requires the pipeline to supply TerrapinRetrievalToolPath up front when asset caching is enabled. Also validate static git2.lib (was only checking dynamic git2.dll). .azure-pipelines/official-release-nuget.config (new) Pipeline-only NuGet config that points at an internal feed. Used solely by a one-off `nuget install` of Microsoft.Build.Vcpkg, not by any csproj restore. Not consulted by external contributors or by GitHub Actions. .azure-pipelines/release.yml Add NuGetAuthenticate@1 task. Add a NuGetCommand@2 task that out-of-band installs the internal Microsoft.Build.Vcpkg package (which ships TerrapinRetrievalTool.exe) into $(Agent.TempDirectory). Add an explicit "Restore vcpkg native libraries (Terrapin cache)" step that invokes _RestoreVcpkgDependencies on GVFS.Common.csproj with -p:UseTerrapinAssetCache=true and TerrapinRetrievalToolPath pointing at the extracted tool. Build.bat's own vcpkg install step then skips because the libs are already present. Assisted-by: Claude Opus 4.7 Signed-off-by: Tyrie Vella --- .../official-release-nuget.config | 29 ++++++++++++++++ .azure-pipelines/release.yml | 34 +++++++++++++++++++ Directory.Build.props | 19 +++++++++++ Directory.Build.targets | 34 +++++++++++++++++-- 4 files changed, 113 insertions(+), 3 deletions(-) create mode 100644 .azure-pipelines/official-release-nuget.config diff --git a/.azure-pipelines/official-release-nuget.config b/.azure-pipelines/official-release-nuget.config new file mode 100644 index 000000000..4df1aaa4c --- /dev/null +++ b/.azure-pipelines/official-release-nuget.config @@ -0,0 +1,29 @@ + + + + + + + + diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml index 84b9a2b80..9433cb2f5 100644 --- a/.azure-pipelines/release.yml +++ b/.azure-pipelines/release.yml @@ -111,6 +111,9 @@ extends: inputs: versionSpec: '6.x' + - task: NuGetAuthenticate@1 + displayName: 'Authenticate to internal NuGet feed (for Microsoft.Build.Vcpkg)' + - task: PowerShell@2 displayName: 'Install VS C++ workload (NativeAOT prerequisite)' inputs: @@ -121,6 +124,37 @@ extends: inputs: filePath: $(Build.SourcesDirectory)\.azure-pipelines\scripts\enable-projfs.ps1 + # Download the Microsoft.Build.Vcpkg NuGet package out-of-band so we + # can hand the build a path to TerrapinRetrievalTool.exe via + # -p:TerrapinRetrievalToolPath. The package is pulled from an + # internal NuGet feed (see .azure-pipelines/official-release-nuget.config). + # Downloading it this way -- rather than as an msbuild Sdk import -- + # keeps the internal feed out of the root nuget.config that + # external contributors and the public GitHub Actions workflow see. + - task: NuGetCommand@2 + displayName: 'Download Microsoft.Build.Vcpkg package (Terrapin retrieval tool)' + inputs: + command: custom + arguments: 'install Microsoft.Build.Vcpkg -Version 2026.5.25.434-aa40adda53 -ConfigFile $(Build.SourcesDirectory)\.azure-pipelines\official-release-nuget.config -OutputDirectory $(Agent.TempDirectory)\nuget-internal -ExcludeVersion -DirectDownload -NonInteractive' + + # Restore vcpkg native dependencies through the Terrapin asset + # cache (the release pipeline's build agents have x-block-origin + # enforced and cannot download from the public internet). Runs the + # _RestoreVcpkgDependencies MSBuild target with + # UseTerrapinAssetCache=true and TerrapinRetrievalToolPath pointing + # at the binary extracted by the previous step. vcpkg downloads + # then route through https://vcpkg.storage.devpackages.microsoft.io. + # Build.bat's own vcpkg install step then skips because the libs + # are already present. + - script: | + dotnet build "$(Build.SourcesDirectory)\GVFS\GVFS.Common\GVFS.Common.csproj" ^ + /t:_RestoreVcpkgDependencies ^ + -c $(BuildConfiguration) ^ + -p:UseTerrapinAssetCache=true ^ + -p:TerrapinRetrievalToolPath=$(Agent.TempDirectory)\nuget-internal\Microsoft.Build.Vcpkg\trt\TerrapinRetrievalTool.exe ^ + -v:detailed + displayName: 'Restore vcpkg native libraries (Terrapin cache)' + - script: | $(Build.SourcesDirectory)\scripts\Build.bat ^ $(BuildConfiguration) ^ diff --git a/Directory.Build.props b/Directory.Build.props index 89953442c..b7752b80f 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -18,6 +18,25 @@ but our .NET projects do. --> true + + + false + + + false diff --git a/Directory.Build.targets b/Directory.Build.targets index d04b30b4f..f78140643 100644 --- a/Directory.Build.targets +++ b/Directory.Build.targets @@ -32,6 +32,22 @@ <_VcpkgManifestFile>$(RepoSrcPath)vcpkg.json <_VcpkgConfigFile>$(RepoSrcPath)vcpkg-configuration.json <_VcpkgStampFile>$(RepoOutPath)vcpkg_installed\.msbuildstamp + + + <_VcpkgAssetSources Condition="'$(UseTerrapinAssetCache)' == 'true'">"--x-asset-sources=x-script,$(TerrapinRetrievalToolPath) -b https://vcpkg.storage.devpackages.microsoft.io/artifacts/ -a $(IsLocalBuild) -p {url} -s {sha512} -d {dst};x-block-origin" @@ -70,13 +86,25 @@ - + + + - + Text="vcpkg install completed but git2.dll (dynamic) is missing. Check vcpkg output above for errors." /> +