[main] Update dependencies from dotnet/arcade

.gitignore

@@ -1,7 +1,11 @@
 .vs
 bin/
 obj/
+artifacts/
+.dotnet/
+.packages
 *.user
 project.lock.json
 *.nuget.props
 *.nuget.targets
+.tools

CODE-OF-CONDUCT.md

@@ -0,0 +1,6 @@
+# Code of Conduct
+
+This project has adopted the code of conduct defined by the Contributor Covenant
+to clarify expected behavior in our community.
+
+For more information, see the [.NET Foundation Code of Conduct](https://dotnetfoundation.org/code-of-conduct).

CONTRIBUTING.md

@@ -0,0 +1,9 @@
+# Contributing
+
+We welcome contributions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
+
+Great ways to contribute include trying things out, filing bugs, joining in design conversations and fixing issues.
+
+When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.
+
+If you want to submit a feature or a substantial code contribution, please discuss it first with the the team by [filing an issue](https://github.com/dotnet/NuGet.BuildTasks/issues/new).

Directory.Build.props

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <Import Project="Sdk.props" Sdk="Microsoft.DotNet.Arcade.Sdk" />
+  <PropertyGroup Condition="'$(CopyrightNetFoundation)' != ''">
+    <Copyright>$(CopyrightNetFoundation)</Copyright>
+  </PropertyGroup>
+  <PropertyGroup>
+    <PackageLicenseExpression>MIT</PackageLicenseExpression>
+  </PropertyGroup>
+</Project>

Directory.Build.targets

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project>
+  <Import Project="Sdk.targets" Sdk="Microsoft.DotNet.Arcade.Sdk" />
+</Project>

LICENSE.txt

@@ -1,14 +1,23 @@
-NuGet.BuildTasks
+The MIT License (MIT)
 
-Copyright (c) .NET Foundation. All rights reserved.
+Copyright (c) .NET Foundation and Contributors
 
-Licensed under the Apache License, Version 2.0 (the "License"); you may not use
-these files except in compliance with the License. You may obtain a copy of the
-License at
+All rights reserved.
 
-http://www.apache.org/licenses/LICENSE-2.0
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-Unless required by applicable law or agreed to in writing, software distributed
-under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
-CONDITIONS OF ANY KIND, either express or implied. See the License for the
-specific language governing permissions and limitations under the License.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

NuGet.BuildTasks.sln

@@ -1,28 +1,55 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 14
-VisualStudioVersion = 14.0.24720.0
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29021.251
 MinimumVisualStudioVersion = 10.0.40219.1
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.NuGet.Build.Tasks", "src\Microsoft.NuGet.Build.Tasks\Microsoft.NuGet.Build.Tasks.csproj", "{55DC2BBF-42AE-4BE8-A6E0-351EEF51C0FC}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.NuGet.Build.Tasks", "src\Microsoft.NuGet.Build.Tasks\Microsoft.NuGet.Build.Tasks.csproj", "{6912FE54-B273-471C-A839-59A45DBC9305}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.NuGet.Build.Tasks.Tests", "src\Microsoft.NuGet.Build.Tasks.Tests\Microsoft.NuGet.Build.Tasks.Tests.csproj", "{61443D47-85B6-4519-96C1-2704BDF604BF}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.NuGet.Build.Tasks.Tests", "src\Microsoft.NuGet.Build.Tasks.Tests\Microsoft.NuGet.Build.Tasks.Tests.csproj", "{61443D47-85B6-4519-96C1-2704BDF604BF}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Microsoft.NuGet.Build.Tasks.Setup", "setup\Swix\Microsoft.NuGet.Build.Tasks.Setup\Microsoft.NuGet.Build.Tasks.Setup.csproj", "{B0894928-23E2-4346-A661-945C4C1A279E}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "items", "items", "{5802E42F-3586-4FD4-B08A-8BA1A3B2F690}"
+	ProjectSection(SolutionItems) = preProject
+		.gitattributes = .gitattributes
+		.gitignore = .gitignore
+		build.cmd = build.cmd
+		build.sh = build.sh
+		CODE-OF-CONDUCT.md = CODE-OF-CONDUCT.md
+		Directory.Build.props = Directory.Build.props
+		Directory.Build.targets = Directory.Build.targets
+		global.json = global.json
+		LICENSE.txt = LICENSE.txt
+		NuGet.config = NuGet.config
+		README.md = README.md
+		ThirdPartyNotices.txt = ThirdPartyNotices.txt
+		CONTRIBUTING.md = CONTRIBUTING.md
+		SECURITY.md = SECURITY.md
+	EndProjectSection
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
 		Release|Any CPU = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{55DC2BBF-42AE-4BE8-A6E0-351EEF51C0FC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{55DC2BBF-42AE-4BE8-A6E0-351EEF51C0FC}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{55DC2BBF-42AE-4BE8-A6E0-351EEF51C0FC}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{55DC2BBF-42AE-4BE8-A6E0-351EEF51C0FC}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6912FE54-B273-471C-A839-59A45DBC9305}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6912FE54-B273-471C-A839-59A45DBC9305}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6912FE54-B273-471C-A839-59A45DBC9305}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6912FE54-B273-471C-A839-59A45DBC9305}.Release|Any CPU.Build.0 = Release|Any CPU
 		{61443D47-85B6-4519-96C1-2704BDF604BF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{61443D47-85B6-4519-96C1-2704BDF604BF}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{61443D47-85B6-4519-96C1-2704BDF604BF}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{61443D47-85B6-4519-96C1-2704BDF604BF}.Release|Any CPU.Build.0 = Release|Any CPU
+		{B0894928-23E2-4346-A661-945C4C1A279E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{B0894928-23E2-4346-A661-945C4C1A279E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{B0894928-23E2-4346-A661-945C4C1A279E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{B0894928-23E2-4346-A661-945C4C1A279E}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
 	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {77F4C17D-7B21-4419-9C97-89A5A5DEC30D}
+	EndGlobalSection
 EndGlobal

NuGet.config

@@ -0,0 +1,12 @@
+<!-- Licensed to the .NET Foundation under one or more agreements. The .NET Foundation licenses this file to you under the MIT license. See the LICENSE file in the project root for more information. -->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
+    <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
+    <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
+  </packageSources>
+  <disabledPackageSources>
+    <clear />
+  </disabledPackageSources>
+</configuration>

README.md

@@ -1,4 +1,12 @@
 # NuGet.BuildTasks
-The build tasks used to pick up package content from project.lock.json.
-# Open Source Code of Conduct
-This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
+The build tasks used to pick up package content from project.assets.json.
+
+[![Build Status](https://dev.azure.com/dnceng/public/_apis/build/status/dotnet/NuGet.BuildTasks/dotnet.NuGet.BuildTasks-CI?branchName=main)](https://dev.azure.com/dnceng/public/_build/latest?definitionId=567&branchName=main)
+
+# Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in ["Visual Studio Customer Experience Improvement Program"](https://learn.microsoft.com/visualstudio/ide/visual-studio-experience-improvement-program). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
+
+# Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/legal/intellectualproperty/trademarks/usage/general). Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

SECURITY.md

@@ -0,0 +1,41 @@
+<!-- BEGIN MICROSOFT SECURITY.MD V0.0.9 BLOCK -->
+
+## Security
+
+Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/Microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet) and [Xamarin](https://github.com/xamarin).
+
+If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/security.md/definition), please report it to us as described below.
+
+## Reporting Security Issues
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/security.md/msrc/create-report).
+
+If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]).  If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/security.md/msrc/pgp).
+
+You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://www.microsoft.com/msrc). 
+
+Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
+
+  * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly.
+
+If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/security.md/msrc/bounty) page for more details about our active programs.
+
+## Preferred Languages
+
+We prefer all communications to be in English.
+
+## Policy
+
+Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/security.md/cvd).
+
+<!-- END MICROSOFT SECURITY.MD BLOCK -->

build.cmd

@@ -0,0 +1,3 @@
+@echo off
+powershell -ExecutionPolicy ByPass -NoProfile -command "& """%~dp0eng\common\Build.ps1""" -restore -build %*"
+exit /b %ErrorLevel%

build.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+source="${BASH_SOURCE[0]}"
+
+# resolve $SOURCE until the file is no longer a symlink
+while [[ -h $source ]]; do
+  scriptroot="$( cd -P "$( dirname "$source" )" && pwd )"
+  source="$(readlink "$source")"
+
+  # if $source was a relative symlink, we need to resolve it relative to the path where the
+  # symlink file was located
+  [[ $source != /* ]] && source="$scriptroot/$source"
+done
+
+scriptroot="$( cd -P "$( dirname "$source" )" && pwd )"
+"$scriptroot/eng/common/build.sh" --build --restore $@

build/TSAConfig.gdntsa

@@ -0,0 +1,19 @@
+{
+    "tsaVersion": "TsaV2",
+    "codebase": "NewOrUpdate",
+    "codebaseName": "dotnet-nugetbuildtasks",
+    "tsaStamp": "DevDiv",
+    "tsaEnvironment": "PROD",
+    "notificationAliases": [
+        "[email protected]"
+    ],
+    "codebaseAdmins": [
+        "REDMOND\\tomescht",
+        "REDMOND\\kvenkatrajan"
+    ],
+    "instanceUrl": "https://devdiv.visualstudio.com",
+    "projectName": "DevDiv",
+    "areaPath": "DevDiv\\NET Tools\\Project",
+    "iterationPath": "DevDiv",
+    "allTools": true
+}

build/analyze-compliance.yml

@@ -0,0 +1,35 @@
+parameters:
+  - name: SoftwareVersion
+    type: string
+
+# Overview of tasks offered for security and compliance:
+# - https://dev.azure.com/securitytools/SecurityIntegration/_wiki/wikis/Guardian/1425/Guardian-Tools
+# - https://eng.ms/docs/security-compliance-identity-and-management-scim/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki
+# - https://eng.ms/docs/security-compliance-identity-and-management-scim/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/sdl-azdo-extension/secure-development-tools-extension-for-azure-devops#tools
+# Other tools to consider:
+# - InferSharp: https://dev.azure.com/securitytools/SecurityIntegration/_wiki/wikis/Guardian/1638/InferSharp-Usage
+# - CodeQL: https://eng.ms/docs/security-compliance-identity-and-management-scim/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/sdl-azdo-extension/codeql-build-task
+steps:
+
+# Scan for the use of undocumented APIs.
+# YAML reference: https://eng.ms/docs/security-compliance-identity-and-management-scim/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/sdl-azdo-extension/apiscan-build-task#v2
+- task: APIScan@2
+  displayName: Run APIScan
+  inputs:
+    softwareFolder: $(Build.SourcesDirectory)/artifacts/DLLs
+    softwareName: 'Dotnet-NuGet.BuildTasks'
+    softwareVersionNum: ${{ parameters.SoftwareVersion }}
+    softwareBuildNum: $(Build.BuildId)
+    symbolsFolder: SRV*https://symweb.azurefd.net
+    noCopySymbols: true
+    noCopyBinaries: true
+    noDecompress: true
+    isLargeApp: true
+    verbosityLevel: minimal
+    preserveTempFiles: true
+  # APIScan requires an Azure Identity to run. That is provided via an Azure service principal.
+  # - https://microsoft.sharepoint.com/teams/apiscan/APIScan%20User%20Wiki/authentication_using_AAD_identities.aspx
+  # - https://microsoft.sharepoint.com/teams/apiscan/Lists/Contacts%20%20System%20Account%20and%20Wrappers/AllItems.aspx?skipSignal=true
+  # This value is provided from the DotNet-Project-System variable group, defined in the stage variables.
+  env:
+    AzureServicesAuthConnectionString: runAs=App;AppId=$(ApiScanClientId)

build/azure-pipelines-ci.yml

@@ -0,0 +1,73 @@
+# NuGet.BuildTasks
+# Pull request pipeline
+# URL: https://dev.azure.com/dnceng-public/public/_build?definitionId=37
+
+# Branches that trigger a build on commit
+trigger:
+  branches:
+    include:
+    - main
+    - dev*
+    - feature/*
+
+# Branches that trigger builds on PR
+pr:
+  branches:
+    include:
+    - main
+    - dev*
+    - feature/*
+
+jobs:
+- job: Visual_Studio
+  pool:
+    # The max number of concurrent jobs that can be run in the pool is 820.
+    # https://dnceng-public.visualstudio.com/public/_settings/agentqueues?queueId=13&view=jobs
+    name: NetCore-Public
+    # Demands Docs: https://docs.microsoft.com/azure/devops/pipelines/process/demands?view=azure-devops&tabs=yaml#manually-entered-demands
+    # ImageOverride is used to select the image. See:
+    # - https://dev.azure.com/dnceng/internal/_wiki/wikis/DNCEng%20Services%20Wiki/510/1ES-Hosted-Pools-Migration
+    # - https://dev.azure.com/dnceng/internal/_wiki/wikis/DNCEng%20Services%20Wiki/675/1ESManagedPoolsDesign?anchor=1es-managed-images
+    # Image List: https://helix.dot.net/#1esPools
+    demands: ImageOverride -equals Windows.VS2022Preview.Amd64.Open
+  strategy:
+    maxParallel: 2
+    matrix:
+      Debug:
+        _configuration: Debug
+      Release:
+        _configuration: Release
+  timeoutInMinutes: 60
+  steps:
+    - script: $(Build.SourcesDirectory)\build.cmd -configuration $(_configuration) -prepareMachine -test -ci -sign -pack -binaryLog
+    - task: PublishBuildArtifacts@1
+      inputs:
+        PathtoPublish: '$(Build.SourcesDirectory)\artifacts\log\$(_configuration)'
+        ArtifactName: '$(_configuration) Logs'
+        publishLocation: Container
+      continueOnError: true
+      condition: always()
+    - task: PublishBuildArtifacts@1
+      inputs:
+        PathtoPublish: '$(Build.SourcesDirectory)\artifacts\bin'
+        ArtifactName: '$(_configuration) bin folder'
+        publishLocation: Container
+      continueOnError: true
+      condition: failed()
+    - task: PublishBuildArtifacts@1
+      inputs:
+        PathtoPublish: '$(Build.SourcesDirectory)\artifacts\TestResults\$(_configuration)'
+        ArtifactName: '$(_configuration) Test Results'
+        publishLocation: Container
+      continueOnError: true
+      condition: failed()
+    - task: PublishTestResults@2
+      inputs:
+        testRunner: 'xUnit'
+        testResultsFiles: '**/*.xml' 
+        searchFolder: '$(Build.SourcesDirectory)\artifacts\TestResults\$(_configuration)'
+        configuration: '$(_configuration)'
+        publishRunAttachments: true
+        failTaskOnFailedTests: true
+      continueOnError: true
+      condition: always()