From 87af2c9d9c7101e3065ee15fbe5c3e4e3b9fbae1 Mon Sep 17 00:00:00 2001
From: "Matt Mitchell (.NET)" <mmitche@microsoft.com>
Date: Tue, 14 Jul 2026 15:45:39 -0700
Subject: [PATCH 1/4] Upgrade to V4 arcade publishing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props      |   2 +-
 azure-pipelines.yml           |   3 +-
 eng/Publishing.props          |   1 +
 eng/jobs/windows-build-PR.yml |   2 +-
 eng/jobs/windows-build.yml    | 276 +++++++++++++++++++---------------
 5 files changed, 157 insertions(+), 127 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index f0651fe196..b42609d5a5 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -12,7 +12,7 @@
     <PackageVersion Include="Microsoft.Build.Tasks.Core" Version="17.10.46" />
 
     <!-- Runtime dependencies -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.4" />
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
     <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" /> <!-- Pin transitive dependency to avoid vulnerable 8.0.0 version. -->
 
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 8419797ff3..b34a82a780 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -84,7 +84,7 @@ extends:
       - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
         - template: /eng/common/templates-official/job/publish-build-assets.yml@self
           parameters:
-            publishUsingPipelines: true
+            publishingVersion: 4
             publishAssetsImmediately: true
             dependsOn:
             - win_x64
@@ -97,6 +97,7 @@ extends:
     - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
       - template: /eng/common/templates-official/post-build/post-build.yml@self
         parameters:
+          publishingInfraVersion: 4
           enableSymbolValidation: false
           enableSigningValidation: false
           enableNugetValidation: false
diff --git a/eng/Publishing.props b/eng/Publishing.props
index 8ae2e2988d..40b3f35b1c 100644
--- a/eng/Publishing.props
+++ b/eng/Publishing.props
@@ -3,6 +3,7 @@
   <PropertyGroup>
     <!-- This avoids creating VS.*.symbols.nupkg packages that are identical to the original package. -->
     <AutoGenerateSymbolPackages>false</AutoGenerateSymbolPackages>
+    <PublishingVersion>4</PublishingVersion>
   </PropertyGroup>
   
   <!-- Update all Artifacts with Kind=Package to have additional metadata item Category="ToolingPackage".
diff --git a/eng/jobs/windows-build-PR.yml b/eng/jobs/windows-build-PR.yml
index 19b1fac6de..b16397524d 100644
--- a/eng/jobs/windows-build-PR.yml
+++ b/eng/jobs/windows-build-PR.yml
@@ -30,7 +30,7 @@ jobs:
       -c $(_BuildConfig) /p:TargetArchitecture=${{ parameters.targetArchitecture }} /p:DotNetSignType=$(_SignType)
     ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
       InternalMSBuildArgs: >-
-        /p:OfficialBuildId=$(Build.BuildNumber) /p:DotNetPublishUsingPipelines=true /p:Test=false
+        /p:OfficialBuildId=$(Build.BuildNumber) /p:Test=false
     ${{ else }}:
       InternalMSBuildArgs: ''
     Codeql.Enabled: ${{ parameters.codeql }}
diff --git a/eng/jobs/windows-build.yml b/eng/jobs/windows-build.yml
index fe7ac92616..451c10157a 100644
--- a/eng/jobs/windows-build.yml
+++ b/eng/jobs/windows-build.yml
@@ -6,139 +6,167 @@ parameters:
   timeoutInMinutes: 120
   codeql: false
 jobs:
-- job: ${{ parameters.name }}
-  displayName: ${{ parameters.displayName }}
-  timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
-  strategy:
-    matrix:
-      release:
-        _BuildConfig: Release
-      ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
-        debug:
-          _BuildConfig: Debug
-  workspace:
-    clean: all
-  variables:
-    CommonMSBuildArgs: >-
-      -c $(_BuildConfig) /p:TargetArchitecture=${{ parameters.targetArchitecture }} /p:DotNetSignType=$(_SignType)
-    ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-      InternalMSBuildArgs: >-
-        /p:OfficialBuildId=$(Build.BuildNumber) /p:DotNetPublishUsingPipelines=true /p:Test=false
-    ${{ else }}:
-      InternalMSBuildArgs: ''
-    Codeql.Enabled: ${{ parameters.codeql }}
-    Codeql.Language: csharp,cpp
-  templateContext:
-    outputs:
-    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['_BuildConfig'], 'Release'), eq(variables['StagingArtifactsFolderExist'], True)) }}:
+- template: /eng/common/templates-official/job/job.yml@self
+  parameters:
+    name: ${{ parameters.name }}
+    displayName: ${{ parameters.displayName }}
+    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
+    publishingVersion: 4
+    enablePublishing: ${{ and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}
+    enableMicrobuild: true
+    microbuildUseESRP: true
+    workspace:
+      clean: all
+    strategy:
+      matrix:
+        release:
+          _BuildConfig: Release
+        ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
+          debug:
+            _BuildConfig: Debug
+    variables:
+    - CommonMSBuildArgs: >-
+        -c $(_BuildConfig) /p:TargetArchitecture=${{ parameters.targetArchitecture }} /p:DotNetSignType=$(_SignType)
+    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+      - InternalMSBuildArgs: >-
+          /p:OfficialBuildId=$(Build.BuildNumber) /p:Test=false
+    - ${{ else }}:
+      - InternalMSBuildArgs: ''
+    - Codeql.Enabled: ${{ parameters.codeql }}
+    - Codeql.Language: csharp,cpp
+    templateContext:
+      outputs:
+      - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['_BuildConfig'], 'Release'), eq(variables['StagingArtifactsFolderExist'], True)) }}:
+        - output: pipelineArtifact
+          displayName: 'Publish Artifacts'
+          condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['StagingArtifactsFolderExist'], True))
+          targetPath: '$(Build.StagingDirectory)/Artifacts'
+          artifactName: IntermediateUnsignedArtifacts
+          artifactType: container
+      - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['_BuildConfig'], 'Release')) }}:
+        - output: pipelineArtifact
+          displayName: 'Publish PdbArtifacts'
+          condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
+          targetPath: '$(Build.StagingDirectory)/PdbArtifacts'
+          artifactName: PdbArtifacts-${{ parameters.name }}
+          artifactType: container
       - output: pipelineArtifact
-        displayName: 'Publish Artifacts'
-        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['StagingArtifactsFolderExist'], True))
-        targetPath: '$(Build.StagingDirectory)/Artifacts'
-        artifactName: IntermediateUnsignedArtifacts
-        artifactType: container
-    - output: pipelineArtifact
-      displayName: 'Publish BuildLogs'
-      condition: succeededOrFailed()
-      targetPath: '$(Build.StagingDirectory)/BuildLogs'
-      artifactName: Logs-${{ parameters.name }}-$(_BuildConfig)
-  steps:
-  - powershell: Remove-Item -Recurse -ErrorAction Ignore "$env:LocalAppData\NuGet\v3-cache"
-    displayName: Clear NuGet http cache (if exists)
-  - ${{ if ne(variables['System.TeamProject'], 'public') }}:
-    - task: PowerShell@2
-      displayName: Setup Private Feeds Credentials
-      condition: eq(variables['Agent.OS'], 'Windows_NT')
-      inputs:
-        filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-        arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
-      env:
-        Token: $(dn-bot-dnceng-artifact-feeds-rw)
-    - task: NuGetAuthenticate@1
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-    - template: /eng/common/core-templates/steps/install-microbuild.yml
-      parameters:
-        enableMicrobuild: true
-        microbuildUseESRP: true
-        continueOnError: false
-  - script: >-
-      eng\common\cibuild.cmd $(CommonMSBuildArgs) $(InternalMSBuildArgs)
-    displayName: Build
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-    - template: /eng/common/templates-official/steps/generate-sbom.yml@self
-      parameters:
-        name: Generate_SBOM_${{ parameters.name }}
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables['DisableVSPublish'], 'true')) }}:
-    - task: NuGetAuthenticate@1
-      displayName: 'Authenticate to DevDiv VS feed (WIF)'
-      inputs:
-        azureDevOpsServiceConnection: 'dnceng-devdiv-vs-feed-push'
-        feedUrl: 'https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json'
-    - powershell: |
-        $packages = Get-ChildItem "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/*/VS.Redist.Common.NETCoreCheck.*.nupkg"
-        foreach ($pkg in $packages) {
-          Write-Host "Pushing $($pkg.Name)..."
-          dotnet nuget push $pkg.FullName --source "https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json" --api-key AzureDevOps --skip-duplicate
-        }
-      displayName: 'Push NETCoreCheck NuPkgs to DevDiv VS feed'
-      condition: succeeded()
-    - ${{ if eq(parameters.targetArchitecture, 'x64') }}:
+        displayName: 'Publish BuildLogs'
+        condition: succeededOrFailed()
+        targetPath: '$(Build.StagingDirectory)/BuildLogs'
+        artifactName: Logs-${{ parameters.name }}-$(_BuildConfig)
+    steps:
+    - powershell: Remove-Item -Recurse -ErrorAction Ignore "$env:LocalAppData\NuGet\v3-cache"
+      displayName: Clear NuGet http cache (if exists)
+    - ${{ if ne(variables['System.TeamProject'], 'public') }}:
+      - task: PowerShell@2
+        displayName: Setup Private Feeds Credentials
+        condition: eq(variables['Agent.OS'], 'Windows_NT')
+        inputs:
+          filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
+          arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config******
+        env:
+          Token: $(dn-bot-dnceng-artifact-feeds-rw)
+      - task: NuGetAuthenticate@1
+    - script: >-
+        eng\common\cibuild.cmd $(CommonMSBuildArgs) $(InternalMSBuildArgs)
+      displayName: Build
+    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+      - template: /eng/common/templates-official/steps/generate-sbom.yml@self
+        parameters:
+          name: Generate_SBOM_${{ parameters.name }}
+    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables['DisableVSPublish'], 'true')) }}:
+      - task: NuGetAuthenticate@1
+        displayName: 'Authenticate to DevDiv VS feed (WIF)'
+        inputs:
+          azureDevOpsServiceConnection: 'dnceng-devdiv-vs-feed-push'
+          feedUrl: 'https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json'
       - powershell: |
-          $packages = Get-ChildItem "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/*/VS.Redist.Common.NetCore.Launcher.*.nupkg"
+          $packages = Get-ChildItem "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/*/VS.Redist.Common.NETCoreCheck.*.nupkg"
           foreach ($pkg in $packages) {
             Write-Host "Pushing $($pkg.Name)..."
             dotnet nuget push $pkg.FullName --source "https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json" --api-key AzureDevOps --skip-duplicate
           }
-        displayName: 'Push NetCore.Launcher NuPkgs to DevDiv VS feed'
+        displayName: 'Push NETCoreCheck NuPkgs to DevDiv VS feed'
         condition: succeeded()
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-    - powershell: |
-        $folderExists = Test-Path -Path "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)"
-        Write-Output "##vso[task.setvariable variable=ArtifactsPackagesFolderExists]$folderExists"
-      displayName: Detect Packages subdirectory
-    - task: CopyFiles@2
-      displayName: Prepare job-specific Artifacts subdirectory
-      inputs:
-        SourceFolder: '$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)'
-        Contents: |
-          Shipping/**/*
-          NonShipping/**/*
-        TargetFolder: '$(Build.StagingDirectory)/Artifacts/${{ parameters.name }}'
-        CleanTargetFolder: true
-      condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['ArtifactsPackagesFolderExists'], True))
-    - powershell: |
-        $folderExists = Test-Path -Path "$(Build.StagingDirectory)/Artifacts"
-        Write-Output "##vso[task.setvariable variable=StagingArtifactsFolderExist]$folderExists"
-      displayName: Detect Staged Artifacts subdirectory
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+      - ${{ if eq(parameters.targetArchitecture, 'x64') }}:
+        - powershell: |
+            $packages = Get-ChildItem "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/*/VS.Redist.Common.NetCore.Launcher.*.nupkg"
+            foreach ($pkg in $packages) {
+              Write-Host "Pushing $($pkg.Name)..."
+              dotnet nuget push $pkg.FullName --source "https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json" --api-key AzureDevOps --skip-duplicate
+            }
+          displayName: 'Push NetCore.Launcher NuPkgs to DevDiv VS feed'
+          condition: succeeded()
+    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+      - powershell: |
+          $folderExists = Test-Path -Path "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)"
+          Write-Output "##vso[task.setvariable variable=ArtifactsPackagesFolderExists]$folderExists"
+        displayName: Detect Packages subdirectory
+      - task: CopyFiles@2
+        displayName: Prepare job-specific Artifacts subdirectory
+        inputs:
+          SourceFolder: '$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)'
+          Contents: |
+            Shipping/**/*
+            NonShipping/**/*
+          TargetFolder: '$(Build.StagingDirectory)/Artifacts/${{ parameters.name }}'
+          CleanTargetFolder: true
+        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['ArtifactsPackagesFolderExists'], True))
+      - powershell: |
+          $folderExists = Test-Path -Path "$(Build.StagingDirectory)/Artifacts"
+          Write-Output "##vso[task.setvariable variable=StagingArtifactsFolderExist]$folderExists"
+        displayName: Detect Staged Artifacts subdirectory
+      - powershell: |
+          $packagesRoot = "$(Build.ArtifactStagingDirectory)/artifacts/packages"
+          Remove-Item -Recurse -Force -ErrorAction Ignore $packagesRoot
+
+          foreach ($packageKind in @("Shipping", "NonShipping")) {
+            $source = "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/$packageKind"
+            if (Test-Path $source) {
+              $destination = Join-Path $packagesRoot $packageKind.ToLowerInvariant()
+              New-Item -ItemType Directory -Force $destination | Out-Null
+              Copy-Item -Path (Join-Path $source "*") -Destination $destination -Recurse -Force
+            }
+          }
+        displayName: Stage V4 packages for Arcade wrapper publishing
+        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['ArtifactsPackagesFolderExists'], True))
+      - task: CopyFiles@2
+        displayName: Stage V4 asset manifests for Arcade wrapper publishing
+        inputs:
+          SourceFolder: '$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/AssetManifest'
+          Contents: '*.xml'
+          TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/manifests'
+          CleanTargetFolder: true
+        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
+      - task: CopyFiles@2
+        displayName: Prepare job-specific PdbArtifacts subdirectory
+        inputs:
+          SourceFolder: '$(Build.SourcesDirectory)/artifacts/SymStore/$(_BuildConfig)'
+          Contents: |
+            **/*
+          TargetFolder: '$(Build.StagingDirectory)/PdbArtifacts/${{ parameters.name }}'
+          CleanTargetFolder: true
+        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
+    - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
+      - task: PublishTestResults@2
+        displayName: Publish Test Results
+        inputs:
+          testResultsFormat: 'xUnit'
+          testResultsFiles: '*.xml'
+          searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)'
+          mergeTestResults: true
+          testRunTitle: ${{ parameters.name }}-$(_BuildConfig)
+        continueOnError: true
+        condition: always()
     - task: CopyFiles@2
-      displayName: Prepare job-specific PdbArtifacts subdirectory
+      displayName: Prepare BuildLogs staging directory
       inputs:
-        SourceFolder: '$(Build.SourcesDirectory)/artifacts/SymStore/$(_BuildConfig)'
+        SourceFolder: '$(Build.SourcesDirectory)'
         Contents: |
-          **/*
-        TargetFolder: '$(Build.StagingDirectory)/PdbArtifacts/${{ parameters.name }}'
+          **/*.log
+          **/*.binlog
+        TargetFolder: '$(Build.StagingDirectory)/BuildLogs'
         CleanTargetFolder: true
-      condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
-  - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
-    - task: PublishTestResults@2
-      displayName: Publish Test Results
-      inputs:
-        testResultsFormat: 'xUnit'
-        testResultsFiles: '*.xml'
-        searchFolder: '$(Build.SourcesDirectory)/artifacts/TestResults/$(_BuildConfig)'
-        mergeTestResults: true
-        testRunTitle: ${{ parameters.name }}-$(_BuildConfig)
       continueOnError: true
-      condition: always()
-  - task: CopyFiles@2
-    displayName: Prepare BuildLogs staging directory
-    inputs:
-      SourceFolder: '$(Build.SourcesDirectory)'
-      Contents: |
-        **/*.log
-        **/*.binlog
-      TargetFolder: '$(Build.StagingDirectory)/BuildLogs'
-      CleanTargetFolder: true
-    continueOnError: true
-    condition: succeededOrFailed()
\ No newline at end of file
+      condition: succeededOrFailed()

From 05718c8e22a512fd5d9fa33f1797468c9f1032a9 Mon Sep 17 00:00:00 2001
From: "Matt Mitchell (.NET)" <mmitche@microsoft.com>
Date: Fri, 17 Jul 2026 09:19:06 -0700
Subject: [PATCH 2/4] Remove SBOM generation; V4 publishing makes it irrelevant

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cdd830ac-44ac-4fe8-96e7-44dfffb28763
---
 eng/jobs/windows-build-PR.yml | 4 ----
 eng/jobs/windows-build.yml    | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/eng/jobs/windows-build-PR.yml b/eng/jobs/windows-build-PR.yml
index b16397524d..b02c90a0b7 100644
--- a/eng/jobs/windows-build-PR.yml
+++ b/eng/jobs/windows-build-PR.yml
@@ -51,10 +51,6 @@ jobs:
   - script: >-
       eng\common\cibuild.cmd $(CommonMSBuildArgs) $(InternalMSBuildArgs)
     displayName: Build
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-    - template: /eng/common/templates/steps/generate-sbom.yml@self
-      parameters:
-        name: Generate_SBOM_${{ parameters.name }}
   - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables['DisableVSPublish'], 'true')) }}:
     - task: NuGetAuthenticate@1
       displayName: 'Authenticate to DevDiv VS feed (WIF)'
diff --git a/eng/jobs/windows-build.yml b/eng/jobs/windows-build.yml
index 451c10157a..e99ccfd0bc 100644
--- a/eng/jobs/windows-build.yml
+++ b/eng/jobs/windows-build.yml
@@ -71,10 +71,6 @@ jobs:
     - script: >-
         eng\common\cibuild.cmd $(CommonMSBuildArgs) $(InternalMSBuildArgs)
       displayName: Build
-    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-      - template: /eng/common/templates-official/steps/generate-sbom.yml@self
-        parameters:
-          name: Generate_SBOM_${{ parameters.name }}
     - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), ne(variables['DisableVSPublish'], 'true')) }}:
       - task: NuGetAuthenticate@1
         displayName: 'Authenticate to DevDiv VS feed (WIF)'

From cbd4c60245bd36654be78be14f645d449f41eb8a Mon Sep 17 00:00:00 2001
From: "Matt Mitchell (.NET)" <mmitche@microsoft.com>
Date: Fri, 17 Jul 2026 12:47:12 -0700
Subject: [PATCH 3/4] Remove manual package/manifest staging; V4 publishing
 stages artifacts automatically

Arcade's job.yml template with publishingVersion:4 + enablePublishing runs
Publish.proj, which locally stages shipping/nonshipping packages, asset
manifests, and PDBs to $(Build.ArtifactStagingDirectory)/artifacts and
publishes them as $(System.PhaseName)_Artifacts. The manual staging steps and
the IntermediateUnsignedArtifacts/PdbArtifacts outputs duplicated this and are
removed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cdd830ac-44ac-4fe8-96e7-44dfffb28763
---
 eng/jobs/windows-build.yml | 64 --------------------------------------
 1 file changed, 64 deletions(-)

diff --git a/eng/jobs/windows-build.yml b/eng/jobs/windows-build.yml
index e99ccfd0bc..78a67332f4 100644
--- a/eng/jobs/windows-build.yml
+++ b/eng/jobs/windows-build.yml
@@ -36,20 +36,6 @@ jobs:
     - Codeql.Language: csharp,cpp
     templateContext:
       outputs:
-      - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['_BuildConfig'], 'Release'), eq(variables['StagingArtifactsFolderExist'], True)) }}:
-        - output: pipelineArtifact
-          displayName: 'Publish Artifacts'
-          condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['StagingArtifactsFolderExist'], True))
-          targetPath: '$(Build.StagingDirectory)/Artifacts'
-          artifactName: IntermediateUnsignedArtifacts
-          artifactType: container
-      - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(variables['_BuildConfig'], 'Release')) }}:
-        - output: pipelineArtifact
-          displayName: 'Publish PdbArtifacts'
-          condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
-          targetPath: '$(Build.StagingDirectory)/PdbArtifacts'
-          artifactName: PdbArtifacts-${{ parameters.name }}
-          artifactType: container
       - output: pipelineArtifact
         displayName: 'Publish BuildLogs'
         condition: succeededOrFailed()
@@ -94,56 +80,6 @@ jobs:
             }
           displayName: 'Push NetCore.Launcher NuPkgs to DevDiv VS feed'
           condition: succeeded()
-    - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-      - powershell: |
-          $folderExists = Test-Path -Path "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)"
-          Write-Output "##vso[task.setvariable variable=ArtifactsPackagesFolderExists]$folderExists"
-        displayName: Detect Packages subdirectory
-      - task: CopyFiles@2
-        displayName: Prepare job-specific Artifacts subdirectory
-        inputs:
-          SourceFolder: '$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)'
-          Contents: |
-            Shipping/**/*
-            NonShipping/**/*
-          TargetFolder: '$(Build.StagingDirectory)/Artifacts/${{ parameters.name }}'
-          CleanTargetFolder: true
-        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['ArtifactsPackagesFolderExists'], True))
-      - powershell: |
-          $folderExists = Test-Path -Path "$(Build.StagingDirectory)/Artifacts"
-          Write-Output "##vso[task.setvariable variable=StagingArtifactsFolderExist]$folderExists"
-        displayName: Detect Staged Artifacts subdirectory
-      - powershell: |
-          $packagesRoot = "$(Build.ArtifactStagingDirectory)/artifacts/packages"
-          Remove-Item -Recurse -Force -ErrorAction Ignore $packagesRoot
-
-          foreach ($packageKind in @("Shipping", "NonShipping")) {
-            $source = "$(Build.SourcesDirectory)/artifacts/packages/$(_BuildConfig)/$packageKind"
-            if (Test-Path $source) {
-              $destination = Join-Path $packagesRoot $packageKind.ToLowerInvariant()
-              New-Item -ItemType Directory -Force $destination | Out-Null
-              Copy-Item -Path (Join-Path $source "*") -Destination $destination -Recurse -Force
-            }
-          }
-        displayName: Stage V4 packages for Arcade wrapper publishing
-        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'), eq(variables['ArtifactsPackagesFolderExists'], True))
-      - task: CopyFiles@2
-        displayName: Stage V4 asset manifests for Arcade wrapper publishing
-        inputs:
-          SourceFolder: '$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/AssetManifest'
-          Contents: '*.xml'
-          TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/manifests'
-          CleanTargetFolder: true
-        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
-      - task: CopyFiles@2
-        displayName: Prepare job-specific PdbArtifacts subdirectory
-        inputs:
-          SourceFolder: '$(Build.SourcesDirectory)/artifacts/SymStore/$(_BuildConfig)'
-          Contents: |
-            **/*
-          TargetFolder: '$(Build.StagingDirectory)/PdbArtifacts/${{ parameters.name }}'
-          CleanTargetFolder: true
-        condition: and(succeeded(), eq(variables._BuildConfig, 'Release'))
     - ${{ if or(eq(variables['System.TeamProject'], 'public'), in(variables['Build.Reason'], 'PullRequest')) }}:
       - task: PublishTestResults@2
         displayName: Publish Test Results

From 0e575b1c215b5556a2948ec895c68942d3188598 Mon Sep 17 00:00:00 2001
From: "Matt Mitchell (.NET)" <mmitche@microsoft.com>
Date: Mon, 20 Jul 2026 07:46:15 -0700
Subject: [PATCH 4/4] Use enable-internal-sources template for internal feed
 auth

Replace the manual SetupNugetSources.ps1 + PAT step with the standard
enable-internal-sources.yml template, which uses federated auth
(dnceng-artifacts-feeds-read) and handles NuGetAuthenticate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: cdd830ac-44ac-4fe8-96e7-44dfffb28763
---
 eng/jobs/windows-build.yml | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/eng/jobs/windows-build.yml b/eng/jobs/windows-build.yml
index 78a67332f4..5f42ae0e9a 100644
--- a/eng/jobs/windows-build.yml
+++ b/eng/jobs/windows-build.yml
@@ -45,15 +45,7 @@ jobs:
     - powershell: Remove-Item -Recurse -ErrorAction Ignore "$env:LocalAppData\NuGet\v3-cache"
       displayName: Clear NuGet http cache (if exists)
     - ${{ if ne(variables['System.TeamProject'], 'public') }}:
-      - task: PowerShell@2
-        displayName: Setup Private Feeds Credentials
-        condition: eq(variables['Agent.OS'], 'Windows_NT')
-        inputs:
-          filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-          arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config******
-        env:
-          Token: $(dn-bot-dnceng-artifact-feeds-rw)
-      - task: NuGetAuthenticate@1
+      - template: /eng/common/templates-official/steps/enable-internal-sources.yml@self
     - script: >-
         eng\common\cibuild.cmd $(CommonMSBuildArgs) $(InternalMSBuildArgs)
       displayName: Build