dotnet · dotnet-maestro · Nov 19, 2025 · Nov 19, 2025 · Nov 19, 2025 · Nov 19, 2025
diff --git a/src/arcade/.azuredevops/dependabot.yml b/src/arcade/.azuredevops/dependabot.yml
@@ -0,0 +1,5 @@
+version: 2
+
+# Disabling dependabot on Azure DevOps as this is a mirrored repo. Updates should go through github.
+enable-campaigned-updates: false
+enable-security-updates: false
diff --git a/src/arcade/.config/dotnet-tools.json b/src/arcade/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
  "isRoot": true,
  "tools": {
    "microsoft.dnceng.secretmanager": {
-      "version": "1.1.0-beta.25555.6",
+      "version": "1.1.0-beta.25564.1",
      "commands": [
        "secret-manager"
      ]

diff --git a/src/arcade/eng/Version.Details.props b/src/arcade/eng/Version.Details.props
@@ -14,11 +14,11 @@ This file should be imported by eng/Versions.props
    <!-- dotnet/templating dependencies -->
    <MicrosoftTemplateEngineAuthoringTasksPackageVersion>10.0.100-preview.4.25220.1</MicrosoftTemplateEngineAuthoringTasksPackageVersion>
    <!-- dotnet/arcade dependencies -->
-    <MicrosoftDotNetArcadeSdkPackageVersion>11.0.0-beta.25560.1</MicrosoftDotNetArcadeSdkPackageVersion>
-    <MicrosoftDotNetHelixSdkPackageVersion>11.0.0-beta.25560.1</MicrosoftDotNetHelixSdkPackageVersion>
+    <MicrosoftDotNetArcadeSdkPackageVersion>11.0.0-beta.25562.6</MicrosoftDotNetArcadeSdkPackageVersion>
+    <MicrosoftDotNetHelixSdkPackageVersion>11.0.0-beta.25562.6</MicrosoftDotNetHelixSdkPackageVersion>
    <!-- dotnet/arcade-services dependencies -->
-    <MicrosoftDotNetDarcLibPackageVersion>1.1.0-beta.25557.3</MicrosoftDotNetDarcLibPackageVersion>
-    <MicrosoftDotNetProductConstructionServiceClientPackageVersion>1.1.0-beta.25557.3</MicrosoftDotNetProductConstructionServiceClientPackageVersion>
+    <MicrosoftDotNetDarcLibPackageVersion>1.1.0-beta.25564.1</MicrosoftDotNetDarcLibPackageVersion>
+    <MicrosoftDotNetProductConstructionServiceClientPackageVersion>1.1.0-beta.25564.1</MicrosoftDotNetProductConstructionServiceClientPackageVersion>
    <!-- dotnet/xharness dependencies -->
    <MicrosoftDotNetXHarnessCLIPackageVersion>10.0.0-prerelease.25513.3</MicrosoftDotNetXHarnessCLIPackageVersion>
    <!-- dotnet/symreader-converter dependencies -->
@@ -50,7 +50,7 @@ This file should be imported by eng/Versions.props
    <!-- dotnet/command-line-api dependencies -->
    <SystemCommandLinePackageVersion>2.0.0-beta5.25210.1</SystemCommandLinePackageVersion>
    <!-- dotnet/dnceng dependencies -->
-    <MicrosoftDncEngSecretManagerPackageVersion>1.1.0-beta.25555.6</MicrosoftDncEngSecretManagerPackageVersion>
+    <MicrosoftDncEngSecretManagerPackageVersion>1.1.0-beta.25564.1</MicrosoftDncEngSecretManagerPackageVersion>
    <!-- dotnet/msbuild dependencies -->
    <MicrosoftBuildPackageVersion>17.12.50</MicrosoftBuildPackageVersion>
    <MicrosoftBuildFrameworkPackageVersion>17.12.50</MicrosoftBuildFrameworkPackageVersion>

diff --git a/src/arcade/eng/Version.Details.xml b/src/arcade/eng/Version.Details.xml
@@ -20,21 +20,21 @@
      <Uri>https://github.com/dotnet/templating</Uri>
      <Sha>43b5827697e501c442eb75ffff832cd4df2514fe</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.25560.1">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.25562.6">
      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>3a7f017be1c42a4ecc516446977cf55d429cf390</Sha>
+      <Sha>4bb60deca10193c27f5bdf0a6afc5878ef558455</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="11.0.0-beta.25560.1">
+    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="11.0.0-beta.25562.6">
      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>3a7f017be1c42a4ecc516446977cf55d429cf390</Sha>
+      <Sha>4bb60deca10193c27f5bdf0a6afc5878ef558455</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DotNet.ProductConstructionService.Client" Version="1.1.0-beta.25557.3">
+    <Dependency Name="Microsoft.DotNet.ProductConstructionService.Client" Version="1.1.0-beta.25564.1">
      <Uri>https://github.com/dotnet/arcade-services</Uri>
-      <Sha>8f84b3f03acec6ddc12e110c71133dfebda5f0f2</Sha>
+      <Sha>526aa00e2a2533e0263e50f299d5525572c48c18</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DotNet.DarcLib" Version="1.1.0-beta.25557.3">
+    <Dependency Name="Microsoft.DotNet.DarcLib" Version="1.1.0-beta.25564.1">
      <Uri>https://github.com/dotnet/arcade-services</Uri>
-      <Sha>8f84b3f03acec6ddc12e110c71133dfebda5f0f2</Sha>
+      <Sha>526aa00e2a2533e0263e50f299d5525572c48c18</Sha>
    </Dependency>
    <Dependency Name="Microsoft.DotNet.XHarness.CLI" Version="10.0.0-prerelease.25513.3">
      <Uri>https://github.com/dotnet/xharness</Uri>
@@ -144,9 +144,9 @@
      <Uri>https://github.com/dotnet/runtime</Uri>
      <Sha>d3981726bc8b0e179db50301daf9f22d42393096</Sha>
    </Dependency>
-    <Dependency Name="Microsoft.DncEng.SecretManager" Version="1.1.0-beta.25555.6">
+    <Dependency Name="Microsoft.DncEng.SecretManager" Version="1.1.0-beta.25564.1">
      <Uri>https://github.com/dotnet/dnceng</Uri>
-      <Sha>355356d2cce11feb84134ac05083770d911d5f21</Sha>
+      <Sha>79d5ba9594a98c05483843e8bc018e312bc5817b</Sha>
    </Dependency>
    <!-- Dependencies required for source build to lift to the previously-source-built version. -->
    <Dependency Name="Microsoft.Build" Version="17.12.50">

diff --git a/src/arcade/eng/common/core-templates/job/job.yml b/src/arcade/eng/common/core-templates/job/job.yml
@@ -31,7 +31,6 @@ parameters:
  testRunTitle: ''
  testResultsFormat: ''
  name: ''
-  componentGovernanceSteps: []
  preSteps: []
  artifactPublishSteps: []
  runAsPublic: false
@@ -150,9 +149,6 @@ jobs:
  - ${{ each step in parameters.steps }}:
    - ${{ step }}

-  - ${{ each step in parameters.componentGovernanceSteps }}:
-    - ${{ step }}
-
  - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
    - template: /eng/common/core-templates/steps/cleanup-microbuild.yml
      parameters:

diff --git a/src/arcade/eng/common/core-templates/job/publish-build-assets.yml b/src/arcade/eng/common/core-templates/job/publish-build-assets.yml
@@ -172,7 +172,7 @@ jobs:
            artifactName: AssetManifests
            displayName: 'Publish Merged Manifest'
            retryCountOnTaskFailure: 10 # for any logs being locked
-            sbomEnabled: false # we don't need SBOM for logs
+            isProduction: false

    - template: /eng/common/core-templates/steps/publish-build-artifacts.yml
      parameters:

diff --git a/src/arcade/eng/common/core-templates/steps/component-governance.yml b/src/arcade/eng/common/core-templates/steps/component-governance.yml
diff --git a/src/arcade/eng/common/core-templates/steps/generate-sbom.yml b/src/arcade/eng/common/core-templates/steps/generate-sbom.yml
@@ -1,54 +1,14 @@
-# BuildDropPath - The root folder of the drop directory for which the manifest file will be generated.
-# PackageName - The name of the package this SBOM represents.
-# PackageVersion - The version of the package this SBOM represents. 
-# ManifestDirPath - The path of the directory where the generated manifest files will be placed
-# IgnoreDirectories - Directories to ignore for SBOM generation. This will be passed through to the CG component detector.
-
 parameters:
-  PackageVersion: 11.0.0
-  BuildDropPath: '$(System.DefaultWorkingDirectory)/artifacts'
-  PackageName: '.NET'
-  ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom
-  IgnoreDirectories: ''
-  sbomContinueOnError: true
-  is1ESPipeline: false
-  # disable publishArtifacts if some other step is publishing the artifacts (like job.yml).
-  publishArtifacts: true
+  PackageVersion: unused
+  BuildDropPath: unused
+  PackageName: unused
+  ManifestDirPath: unused
+  IgnoreDirectories: unused
+  sbomContinueOnError: unused
+  is1ESPipeline: unused
+  publishArtifacts: unused

 steps:
- task: PowerShell@2 
-  displayName: Prep for SBOM generation in (Non-linux)
-  condition: or(eq(variables['Agent.Os'], 'Windows_NT'), eq(variables['Agent.Os'], 'Darwin'))
-  inputs: 
-    filePath: ./eng/common/generate-sbom-prep.ps1
-    arguments: ${{parameters.manifestDirPath}}
-
-# Chmodding is a workaround for https://github.com/dotnet/arcade/issues/8461
 - script: |
-    chmod +x ./eng/common/generate-sbom-prep.sh
-    ./eng/common/generate-sbom-prep.sh ${{parameters.manifestDirPath}}
-  displayName: Prep for SBOM generation in (Linux)
-  condition: eq(variables['Agent.Os'], 'Linux')
-  continueOnError: ${{ parameters.sbomContinueOnError }}
-
- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
-  displayName: 'Generate SBOM manifest'
-  continueOnError: ${{ parameters.sbomContinueOnError }}
-  inputs:
-      PackageName: ${{ parameters.packageName }}
-      BuildDropPath: ${{ parameters.buildDropPath }}
-      PackageVersion: ${{ parameters.packageVersion }}
-      ManifestDirPath: ${{ parameters.manifestDirPath }}/$(ARTIFACT_NAME)
-      ${{ if ne(parameters.IgnoreDirectories, '') }}:
-        AdditionalComponentDetectorArgs: '--IgnoreDirectories ${{ parameters.IgnoreDirectories }}'
-
- ${{ if eq(parameters.publishArtifacts, 'true')}}:
-  - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
-    parameters:
-      is1ESPipeline: ${{ parameters.is1ESPipeline }}
-      args:
-        displayName: Publish SBOM manifest
-        continueOnError: ${{parameters.sbomContinueOnError}}
-        targetPath: '${{ parameters.manifestDirPath }}'
-        artifactName: $(ARTIFACT_NAME)
-
+    echo "##vso[task.logissue type=warning]Including generate-sbom.yml is deprecated, SBOM generation is handled 1ES PT now. Remove this include."
+  displayName: Issue generate-sbom.yml deprecation warning
diff --git a/src/arcade/eng/common/core-templates/steps/source-build.yml b/src/arcade/eng/common/core-templates/steps/source-build.yml
@@ -62,4 +62,4 @@ steps:
      artifactName: BuildLogs_SourceBuild_${{ parameters.platform.name }}_Attempt$(System.JobAttempt)
      continueOnError: true
      condition: succeededOrFailed()
-      sbomEnabled: false  # we don't need SBOM for logs
+      isProduction: false
diff --git a/src/arcade/eng/common/generate-sbom-prep.ps1 b/src/arcade/eng/common/generate-sbom-prep.ps1
diff --git a/src/arcade/eng/common/generate-sbom-prep.sh b/src/arcade/eng/common/generate-sbom-prep.sh
diff --git a/src/arcade/eng/common/template-guidance.md b/src/arcade/eng/common/template-guidance.md
@@ -82,7 +82,6 @@ eng\common\
            publish-build-artifacts.yml      (logic)
            publish-pipeline-artifacts.yml   (logic)
            component-governance.yml         (shim)
-            generate-sbom.yml                (shim)
            publish-logs.yml                 (shim)
            retain-build.yml                 (shim)
            send-to-helix.yml                (shim)
@@ -107,7 +106,6 @@ eng\common\
            setup-maestro-vars.yml           (logic)
        steps\
            component-governance.yml         (logic)
-            generate-sbom.yml                (logic)
            publish-build-artifacts.yml      (redirect)
            publish-logs.yml                 (logic)
            publish-pipeline-artifacts.yml   (redirect)

diff --git a/src/arcade/eng/common/templates-official/job/job.yml b/src/arcade/eng/common/templates-official/job/job.yml
@@ -1,24 +1,15 @@
 parameters:
-# Sbom related params
-  enableSbom: true
  runAsPublic: false
-  PackageVersion: 9.0.0
-  BuildDropPath: '$(System.DefaultWorkingDirectory)/artifacts'
+# Sbom related params, unused now and can eventually be removed
+  enableSbom: unused
+  PackageVersion: unused
+  BuildDropPath: unused

 jobs:
 - template: /eng/common/core-templates/job/job.yml
  parameters:
    is1ESPipeline: true

-    componentGovernanceSteps:
-    - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}:
-      - template: /eng/common/templates/steps/generate-sbom.yml
-        parameters:
-          PackageVersion: ${{ parameters.packageVersion }}
-          BuildDropPath: ${{ parameters.buildDropPath }}
-          ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom
-          publishArtifacts: false
-
    # publish artifacts
    # for 1ES managed templates, use the templateContext.output to handle multiple outputs.
    templateContext:
@@ -41,7 +32,7 @@ jobs:
            continueOnError: true
            condition: always()
            retryCountOnTaskFailure: 10 # for any logs being locked
-            sbomEnabled: false  # we don't need SBOM for logs
+            isProduction: false

      - ${{ if eq(parameters.enablePublishBuildArtifacts, true) }}:
        - output: buildArtifacts
@@ -51,22 +42,15 @@ jobs:
          ArtifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)_Attempt$(System.JobAttempt)' ) }}
          continueOnError: true
          condition: always()
-          sbomEnabled: false  # we don't need SBOM for logs
+          #isProduction: false

      - ${{ if eq(parameters.enableBuildRetry, 'true') }}:
        - output: pipelineArtifact
          targetPath: '$(Build.ArtifactStagingDirectory)/artifacts/eng/common/BuildConfiguration'
          artifactName: 'BuildConfiguration'
          displayName: 'Publish build retry configuration'
          continueOnError: true
-          sbomEnabled: false  # we don't need SBOM for BuildConfiguration
-
-      - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}:
-        - output: pipelineArtifact
-          displayName: Publish SBOM manifest
-          continueOnError: true
-          targetPath: $(Build.ArtifactStagingDirectory)/sbom
-          artifactName: $(ARTIFACT_NAME)
+          isProduction: false

      # add any outputs provided via root yaml
      - ${{ if ne(parameters.templateContext.outputs, '') }}:

diff --git a/src/arcade/eng/common/templates-official/steps/component-governance.yml b/src/arcade/eng/common/templates-official/steps/component-governance.yml
diff --git a/src/arcade/eng/common/templates-official/steps/publish-pipeline-artifacts.yml b/src/arcade/eng/common/templates-official/steps/publish-pipeline-artifacts.yml
@@ -26,3 +26,5 @@ steps:
      properties: ${{ parameters.args.properties }}
    ${{ if parameters.args.sbomEnabled }}:
      sbomEnabled: ${{ parameters.args.sbomEnabled }}
+    ${{ if parameters.args.isProduction }}:
+      isProduction: ${{ parameters.args.isProduction }}