[release/10.0.4xx] Update dependencies from dotnet/arcade

.github/skills/fsharp-diagnostics/server/Directory.Build.props

@@ -3,6 +3,8 @@
        Also blocks Directory.Build.targets import. -->
   <PropertyGroup>
     <ImportDirectoryBuildTargets>false</ImportDirectoryBuildTargets>
+    <!-- Standalone tool consuming shipped FSharp.Compiler.Service/FSharp.Core; keep off repo CPM. -->
+    <ImportDirectoryPackagesProps>false</ImportDirectoryPackagesProps>
     <BaseOutputPath>$(MSBuildThisFileDirectory)../../../../.tools/fsharp-diag/bin/</BaseOutputPath>
     <BaseIntermediateOutputPath>$(MSBuildThisFileDirectory)../../../../.tools/fsharp-diag/obj/</BaseIntermediateOutputPath>
   </PropertyGroup>

.github/skills/pr-description/SKILL.md

@@ -9,13 +9,14 @@ Reviewers can already see the Files tab, the commit log, and the issue thread. S
 
 ## Rules
 
-Rules 1, 2, 4, 5 are defaults; if the user insists, push back once then comply. Rule 3 is non-negotiable — `-b "..."` ships broken markdown (see PR #19866).
+Rules 1, 2, 4, 5, 6 are defaults; if the user insists, push back once then comply. Rule 3 is non-negotiable — `-b "..."` ships broken markdown (see PR #19866).
 
 1. **No change inventory.** No file/module/method/test lists. No `## Changes`/`## Implementation` section. Mention an identifier only when it *is* the user-visible behavior. Whatever the reader already has (Files tab for PRs, commit log for follow-up comments, issue history for issue edits) — don't re-list it.
 2. **No LLM slop, no justification scaffolding.** No emoji headers, no "TL;DR" above a 3-line body, no Motivation/Background/Approach/Testing sections, no re-stating the title or the comment you're replying to. No "matching the X norm", no "preventing the Y failure (PR #ZZZZ)", no stats, no links to past PRs as proof. The diff is the proof.
 3. **Body via `--body-file`, built without shell expansion.** Write the file with your file-creation/edit tool (it writes bytes verbatim — no `$`/backtick evaluation, no delimiter collisions, OS-agnostic). Never `-b "..."` / `--body "..."` — backticks and `$` get shell-evaluated and the render breaks. If you build the file in a shell, use a pwsh verbatim here-string `@'...'@` (cross-platform; single-quoted is mandatory). Applies to `gh pr create/edit/comment/review`, `gh issue create/edit/comment`.
 4. **`Fixes #N` to close issues.** Use only when the PR actually closes #N (auto-closes on merge). It is the highest-value line in most PR bodies — never omit it when valid. No "Related to" / speculative links. Preserve existing trailers (`Co-authored-by:`, `Signed-off-by:`, `Reverts #N`); don't invent them.
 5. **Title:** imperative, ≤72 chars, no trailing period, no `fix:`/`feat:` prefix. Name the behavior, not the file. A specific title lets the body shrink to `Fixes #N` + one sentence.
+6. **No hard-wrapped prose.** Write each paragraph as one unbroken line and let GitHub's renderer wrap it — blank lines separate paragraphs, and that's the only break you author. Manual mid-sentence line breaks (wrapping at a fixed column) are a machine tell and render raggedly across window widths.
 
 ## PR-body shapes (pick the smallest that carries the signal)
 
@@ -28,16 +29,14 @@ Update .NET SDK from 10.0.202 to 10.0.204.
 ~~~
 Fixes #18009
 
-Wrong colorization when a qualified type name with generic parameters
-is used in a static member access expression.
+Wrong colorization when a qualified type name with generic parameters is used in a static member access expression.
 ~~~
 
 **Issue link + 1-sentence why** — the most common non-trivial shape:
 ~~~
 Fixes #19751
 
-`--refout` MVIDs were unstable because hashing relied on per-process
-string randomization. Switched to a deterministic hash.
+`--refout` MVIDs were unstable because hashing relied on per-process string randomization. Switched to a deterministic hash.
 ~~~
 
 **Before/After code block** — when prose loses information; ≤15 lines, language tag:
@@ -73,8 +72,7 @@ Show the title + body (or comment text) in chat first. **Do not run `gh` until t
 
    ```powershell
    @'
-   Fix false-positive FS3261 when nullness narrowing leaks across iterations
-   of seq/list/array comprehensions.
+   Fix false-positive FS3261 when nullness narrowing leaks across iterations of seq/list/array comprehensions.
 
    Fixes #19644
    '@ | Set-Content -NoNewline pr-body.md

Directory.Build.targets

@@ -3,6 +3,13 @@
   <Import Project="FSharpTests.Directory.Build.targets" Condition = " '$(FSharpTestCompilerVersion)' != '' "/>
   <Import Project="CoordinateXliff.targets" Condition = " '$(FSharpBuildAssemblyFile)' != '' and '$(XliffTasksAssembly)' != '' "/>
 
+  <!-- The repo restores from many NuGet sources (Maestro does not support package source mapping),
+       which triggers NU1507 under Central Package Management. Suppress it here, after the project
+       bodies (some of which reset NoWarn), so it is applied consistently across every CPM project. -->
+  <PropertyGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true'">
+    <NoWarn>$(NoWarn);NU1507</NoWarn>
+  </PropertyGroup>
+
   <!-- Disable R2R when building source-only and not targeting the current SDK bundled TFM. -->
   <PropertyGroup>
     <PublishReadyToRun Condition="'$(DotNetBuildSourceOnly)' == 'true' and
@@ -18,17 +25,21 @@
     <FsYaccPath>$(ArtifactsDir)/bin/fsyacc/$(Configuration)/$(FSharpNetCoreProductTargetFramework)/$(NETCoreSdkPortableRuntimeIdentifier)/fsyacc.dll</FsYaccPath>
   </PropertyGroup>
 
-  <ItemGroup Condition="'$(DesignTimeBuild)' == 'true'">
-    <PackageReference Update="Microsoft.VSSDK.BuildTools" Version="17.14.2120" />
-  </ItemGroup>
-
-  <ItemGroup Condition="'$(UnitTestType)' == 'xunit'">
-    <PackageReference Include="xunit.v3.mtp-v2" Version="$(XunitVersion)" />
-  </ItemGroup>
-
   <!-- We want to restore ALL the MIBCs when we build anything, since in the future it will contain different profiles, not only the FSC one we got from building Giraffe -->
   <Import Project="$(MSBuildThisFileDirectory)\eng\restore\optimizationData.targets"/>
-  <ItemGroup>
+  <!-- @(MIBCPackage) carries Version item metadata (CopyMIBC needs it to locate the restored .mibc under
+       the package cache). Under CPM that Version must not sit on a PackageReference (NU1008), and neither
+       RemoveMetadata nor an identity transform strips it in an evaluation-phase ItemGroup, so list the
+       identities literally here; the central versions in eng/Packages.props apply. Opt-out subtrees
+       (ImportDirectoryPackagesProps=false) are not under CPM and keep the inline Version from @(MIBCPackage). -->
+  <ItemGroup Condition="'$(IgnoreMIBC)' != 'true' and '$(ManagePackageVersionsCentrally)' == 'true'">
+    <PackageReference Include="optimization.windows_nt-x86.mibc.runtime" />
+    <PackageReference Include="optimization.windows_nt-x64.mibc.runtime" />
+    <PackageReference Include="optimization.windows_nt-arm64.mibc.runtime" />
+    <PackageReference Include="optimization.linux-x64.mibc.runtime" />
+    <PackageReference Include="optimization.linux-arm64.mibc.runtime" />
+  </ItemGroup>
+  <ItemGroup Condition="'$(IgnoreMIBC)' != 'true' and '$(ManagePackageVersionsCentrally)' != 'true'">
     <PackageReference Include="@(MIBCPackage)" />
   </ItemGroup>
 

Directory.Packages.props

@@ -0,0 +1,10 @@
+<Project>
+
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
+  </PropertyGroup>
+
+  <Import Project="eng/Packages.props" />
+
+</Project>

NuGet.config

@@ -35,4 +35,8 @@
   <fallbackPackageFolders>
     <clear />
   </fallbackPackageFolders>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://data.nuget.org/v3/index.json" />
+  </auditSources>
 </configuration>

azure-pipelines-PR.yml

@@ -65,8 +65,6 @@ variables:
     value: Products/$(System.TeamProject)/$(Build.Repository.Name)/$(Build.SourceBranchName)/$(Build.BuildNumber)
   - name: Codeql.Enabled
     value: true
-  - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
-    - group: DotNet-FSharp-SDLValidation-Params
   - ${{ if and(eq(variables['System.TeamProject'], 'public'), eq(variables['Build.Reason'], 'PullRequest')) }}:
     - name: RunningAsPullRequest
       value: true
@@ -341,78 +339,6 @@ stages:
                 ArtifactType: Container
                 parallel: true
 
-        - job: WindowsStrictIndentation
-          pool:
-            name: $(DncEngPublicBuildPool)
-            demands: ImageOverride -equals $(_WindowsMachineQueueName)
-          timeoutInMinutes: 120
-          steps:
-          - checkout: self
-            clean: true
-
-          - script: eng\CIBuildNoPublish.cmd -compressallmetadata -configuration Release /p:AdditionalFscCmdFlags=--strict-indentation+
-            env:
-              DOTNET_DbgEnableMiniDump: 1
-              DOTNET_DbgMiniDumpType: 2 # 1=mini, 2=heap, 3=triage, 4=full. Heap dumps include managed object data for debugging.
-              DOTNET_DbgMiniDumpName: $(Build.SourcesDirectory)\artifacts\log\Release\$(Build.BuildId)-%e-%p-%t.dmp
-              NativeToolsOnMachine: true
-            displayName: Build
-
-          - task: PublishBuildArtifacts@1
-            displayName: Publish Build BinLog
-            condition: always()
-            continueOnError: true
-            inputs:
-                PathToPublish: '$(Build.SourcesDirectory)\artifacts\log/Release\Build.VisualFSharp.slnx.binlog'
-                ArtifactName: 'Windows Release build binlogs'
-                ArtifactType: Container
-                parallel: true
-          - task: PublishBuildArtifacts@1
-            displayName: Publish Dumps
-            condition: failed()
-            continueOnError: true
-            inputs:
-                PathToPublish: '$(Build.SourcesDirectory)\artifacts\log\Release'
-                ArtifactName: 'Windows Release WindowsStrictIndentation process dumps'
-                ArtifactType: Container
-                parallel: true
-
-        - job: WindowsNoStrictIndentation
-          pool:
-            name: $(DncEngPublicBuildPool)
-            demands: ImageOverride -equals $(_WindowsMachineQueueName)
-          timeoutInMinutes: 120
-          steps:
-          - checkout: self
-            clean: true
-
-          - script: eng\CIBuildNoPublish.cmd -compressallmetadata -configuration Release /p:AdditionalFscCmdFlags=--strict-indentation-
-            env:
-              DOTNET_DbgEnableMiniDump: 1
-              DOTNET_DbgMiniDumpType: 2 # 1=mini, 2=heap, 3=triage, 4=full. Heap dumps include managed object data for debugging.
-              DOTNET_DbgMiniDumpName: $(Build.SourcesDirectory)\artifacts\log\Release\$(Build.BuildId)-%e-%p-%t.dmp
-              NativeToolsOnMachine: true
-            displayName: Build
-
-          - task: PublishBuildArtifacts@1
-            displayName: Publish Build BinLog
-            condition: always()
-            continueOnError: true
-            inputs:
-                PathToPublish: '$(Build.SourcesDirectory)\artifacts\log/Release\Build.VisualFSharp.slnx.binlog'
-                ArtifactName: 'Windows Release build binlogs'
-                ArtifactType: Container
-                parallel: true
-          - task: PublishBuildArtifacts@1
-            displayName: Publish Dumps
-            condition: failed()
-            continueOnError: true
-            inputs:
-                PathToPublish: '$(Build.SourcesDirectory)\artifacts\log\Release'
-                ArtifactName: 'Windows Release WindowsNoStrictIndentation process dumps'
-                ArtifactType: Container
-                parallel: true
-
         # Windows With Compressed Metadata
         - job: WindowsCompressedMetadata
           variables:
@@ -774,7 +700,7 @@ stages:
               workingDirectory: $(Build.SourcesDirectory)
               installationPath: $(Build.SourcesDirectory)/.dotnet
           - script: .\eng\common\dotnet.cmd
-          - script: .\Build.cmd $(_kind) -pack -c $(_BuildConfig)
+          - script: .\Build.cmd $(_kind) -ci -pack -c $(_BuildConfig)
             env:
               NativeToolsOnMachine: true
             displayName: Initial build and prepare packages.

azure-pipelines.yml

@@ -48,7 +48,6 @@ variables:
     value: Products/$(System.TeamProject)/$(Build.Repository.Name)/$(Build.SourceBranchName)/$(Build.BuildNumber)
   - name: Codeql.Enabled
     value: "true"
-  - group: DotNet-FSharp-SDLValidation-Params
   - template: /eng/common/templates-official/variables/pool-providers.yml@self
 
 resources:
@@ -68,6 +67,7 @@ extends:
         enabled: true
       policheck:
         enabled: true
+        exclusionsFile: '$(Build.SourcesDirectory)/eng/policheck_exclusions.xml'
       sbom:
         enabled: false # VS SBOM is generated with other steps
         justificationForDisabling: 'SBOM for F# is generated via build process. Will be migrated at later date.'
@@ -219,23 +219,8 @@ extends:
         enableSymbolValidation: false
         # SourceLink improperly looks for generated files.  See https://github.com/dotnet/arcade/issues/3069
         enableSourceLinkValidation: false
-        # Enable SDL validation, passing through values from the 'DotNet-FSharp-SDLValidation-Params' group.
-        SDLValidationParameters:
-          enable: true
-          params: >-
-            -SourceToolsList @("policheck","credscan")
-            -ArtifactToolsList @("binskim")
-            -BinskimAdditionalRunConfigParams @("IgnorePdbLoadError < True","Recurse < True")
-            -TsaInstanceURL $(_TsaInstanceURL)
-            -TsaProjectName $(_TsaProjectName)
-            -TsaNotificationEmail $(_TsaNotificationEmail)
-            -TsaCodebaseAdmin $(_TsaCodebaseAdmin)
-            -TsaBugAreaPath $(_TsaBugAreaPath)
-            -TsaIterationPath $(_TsaIterationPath)
-            -TsaRepositoryName "FSharp"
-            -TsaCodebaseName "FSharp-GitHub"
-            -TsaPublish $True
-            -PoliCheckAdditionalRunConfigParams @("UserExclusionPath < $(Build.SourcesDirectory)/eng/policheck_exclusions.xml")
+        # SDL validation (PoliCheck, CredScan, BinSkim) and TSA reporting are handled by the 1ES Pipeline
+        # Templates via the 'sdl:' block in the 'extends' section above; TSA config lives in eng/TSAConfig.gdntsa.
 
     #---------------------------------------------------------------------------------------------------------------------#
     #                                                   VS Insertion                                                      #

buildtools/AssemblyCheck/AssemblyCheck.fsproj

@@ -23,7 +23,7 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(FSHARPCORE_USE_PACKAGE)' == 'true'">
-    <PackageReference Include="FSharp.Core" Version="$(FSharpCoreShippedPackageVersionValue)" />
+    <PackageReference Include="FSharp.Core" />
   </ItemGroup>
 
 </Project>

buildtools/checkpackages/Directory.Build.props

@@ -3,6 +3,8 @@
     <Import Project="$(MSBuildThisFileDirectory)..\..\eng\TargetFrameworks.props" />
 
     <PropertyGroup>
+        <!-- Auxiliary/consumer-style projects keep their own inline package versions (not under repo CPM). -->
+        <ImportDirectoryPackagesProps>false</ImportDirectoryPackagesProps>
         <DisableImplicitFSharpCoreReference>true</DisableImplicitFSharpCoreReference>
         <CachePath>$(MSBuildProjectDirectory)\..\..\artifacts\tmp\$([System.Guid]::NewGuid())</CachePath>
         <BaseIntermediateOutputPath>$(CachePath)\obj\</BaseIntermediateOutputPath>

buildtools/fslex/fslex.fsproj

@@ -38,7 +38,7 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(FSHARPCORE_USE_PACKAGE)' == 'true'">
-    <PackageReference Include="FSharp.Core" Version="$(FSharpCoreShippedPackageVersionValue)" />
+    <PackageReference Include="FSharp.Core" />
   </ItemGroup>
 
 </Project>

buildtools/fsyacc/fsyacc.fsproj

@@ -38,7 +38,7 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(FSHARPCORE_USE_PACKAGE)' == 'true'">
-    <PackageReference Include="FSharp.Core" Version="$(FSharpCoreShippedPackageVersionValue)" />
+    <PackageReference Include="FSharp.Core" />
   </ItemGroup>
 
 </Project>

docs/fcs-samples/Directory.Build.props

@@ -0,0 +1,7 @@
+<Project>
+  <Import Project="$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)../'))" />
+  <PropertyGroup>
+    <!-- FCS sample projects consume shipped FCS/FSharp.Core packages; keep them off repo CPM. -->
+    <ImportDirectoryPackagesProps>false</ImportDirectoryPackagesProps>
+  </PropertyGroup>
+</Project>