From 067502a05f26a7bde15ba6b23ef294459195a109 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ricardo=20Gro=C3=9F?= Date: Sun, 25 Oct 2026 20:43:11 +0100 Subject: [PATCH] ci: pin the .NET 10 SDK to 10.0.402 while aka.ms resolves to a host that answers 409 (#461) Resolving "latest 10.0" from global.json goes through an aka.ms link that now redirects to dotnetorigin.blob.core.windows.net, which answers 409 for every version. An exact version downloads from builds.dotnet.microsoft.com. global.json is unchanged, so local builds are not affected. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/dotnet.yml | 16 ++++++++++++---- .github/workflows/release.yml | 9 ++++++--- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 917f5632..755e9e81 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -77,10 +77,12 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + # An exact version, not global.json: resolving "latest 10.0" goes through an aka.ms link that + # redirects to a host answering 409, while an exact version downloads from builds.dotnet (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - global-json-file: global.json + dotnet-version: 10.0.402 - name: Restore dependencies run: dotnet restore @@ -149,10 +151,12 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + # An exact version, not global.json: resolving "latest 10.0" goes through an aka.ms link that + # redirects to a host answering 409, while an exact version downloads from builds.dotnet (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - global-json-file: global.json + dotnet-version: 10.0.402 # EF_FLOAT is empty on the floor legs, and must reach restore and build alike on the others: # restore picks the packages, build copies them next to the test assemblies. @@ -240,10 +244,12 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + # An exact version, not global.json: resolving "latest 10.0" goes through an aka.ms link that + # redirects to a host answering 409, while an exact version downloads from builds.dotnet (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - global-json-file: global.json + dotnet-version: 10.0.402 - name: Restore the packages into a throwaway consumer project run: ./test/consumer-smoke-test.sh @@ -261,10 +267,12 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + # An exact version, not global.json: resolving "latest 10.0" goes through an aka.ms link that + # redirects to a host answering 409, while an exact version downloads from builds.dotnet (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - global-json-file: global.json + dotnet-version: 10.0.402 # Packing is itself a check: a package that declares PackageReadmeFile without packing the # file fails here with NU5019. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e891549f..c421db37 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,10 +82,12 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + # An exact version, not global.json: resolving "latest 10.0" goes through an aka.ms link that + # redirects to a host answering 409, while an exact version downloads from builds.dotnet (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - global-json-file: global.json + dotnet-version: 10.0.402 # MSBuild evaluation rather than parsing the XML, so the value is exactly what the build # will stamp onto the packages. @@ -196,11 +198,12 @@ jobs: steps: # No checkout here, so no global.json to read: this job only pushes the verified packages - # and any SDK of the line can do that. Bump it with global.json when the line moves. + # and any SDK of the line can do that. Bump it with global.json when the line moves. Exact, + # as in the build job (#461). - name: Setup .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: - dotnet-version: 10.0.x + dotnet-version: 10.0.402 # Publishes exactly what was verified — the packages are not rebuilt here. - name: Download packages