[release/9.0.2xx] Update dependencies from dotnet/msbuild

[dotnet-maestro]

This pull request updates the following dependencies

From https://github.com/dotnet/msbuild

• Subscription: ec91df1d-8e6d-40cf-80b3-4ef102298e66
• Build: 20250211.7
• Date Produced: February 11, 2025 4:02:16 PM UTC
• Commit: 1ea16607ac1c0646d3f309d9457a4d2b75517de1
• Branch: refs/heads/vs17.13

• Updates:
  • Microsoft.SourceBuild.Intermediate.msbuild: from 17.13.10-preview-25107-01 to 17.13.12-preview-25111-07
  • Microsoft.Build: from 17.13.10 to 17.13.12
  • Microsoft.Build.Localization: from 17.13.10-preview-25107-01 to 17.13.12-preview-25111-07

[nagilson]

@mmitche Thank you for investigating the darc issue we discsused in October: #43972. It looks like this is still not fixed:

Do you know when this will be fixed?

[mmitche]

@nagilson After a bunch of discussion, and abandoning a PR to consider the neutral checks as passing (due to concerns this would enable the bot to try and merge before some things had started), I believe the plan of action is that we will remove the auto-merge capability, and then the all-checks-successful policy altogether. I think this is on @premun and co's radar for sometime soon.

[nagilson]

Thank you @mmitche for the context, I'm sure this required a lot of thought and it's more complicated than I imagined. -- FYI @marcpopMSFT as this may be of interest to you. I'm not sure if that's actually better than the current status of things in my (very) subjective opinion, but both are viable options, for sure

[premun]

@nagilson @mmitche remind me again - I understand we were not able condition out some of the checks that got skipped later but for subscriptions to non 1xx branches, we know that sdk-source-build and sdk-unified-build will always be skipped. Why can't we configure those in the merge policies to be ignored?

As an example, I was able to get this PR green: #46762
By changing the subscription to this:

Merge Policies:
- Name: AllChecksSuccessful
  Properties:
    ignoreChecks:
    - sdk-source-build
    - sdk-unified-build
- Name: NoRequestedChanges
- Name: DontAutomergeDowngrades
- Name: ValidateCoherency # Update darc to make this one work

Wouldn't this work for these 2xx, 3xx and 4xx branches at least? As an immediate solution?

For the removal itself - unfortunately SFI and Unified Build have been the priority so we won't get to it.

[marcpopMSFT]

I think the plan eventually is to gate on the BA check but I'm told to wait until #45762 is fixed for that (I can do that in main as we also added additional checks but in the 2xx branch for example, I wouldn't have additional checks to add.

For now, I modified the rulesets we have in the repo to not require those two legs in the 9.0.2xx and 3xx branches but still require it in 1xx. I think that'll work.

[marcpopMSFT]

or does maestro watch a different list than the repo? I've tried updating the required checks in maestro before without luck but I can try again

[premun]

The rulesets are quite a new feature (<2 years), the branch security has been around for quite some time, but I believe the Maestro checks are even older. So I am pretty sure Maestro is not reading these settings. It has the list of ignored checks in the subscription properties like I showed above.
I will have to check if the check result coming from the GitHub API has the "is required" information and whether the check adheres to that.

[marcpopMSFT]

I tried to modify the maestro settings as well but at least in the past with 8.0.4xx, we found that didn't actually work and maestro still considered the skipped checks as failures.

[premun]

It seems to have worked in #46762 so I'd advise to configure all subscriptions targeting non-1xx bands like this.

[marcpopMSFT]

maybe I looked at one that ran the check before my change. Fingers crossed that it applies to all new PRs at least.

[premun]

@marcpopMSFT which subscriptions have you updated? I check all in sdk and apart from the 2 I changed, none of them had these new merge policies.

For instance I saw #46844 was opened and the subscription didn't have this property changed yet so I edited the subscription and it went green.
It will apply to an already existing PRs as well (takes 5 minutes until the PR is checked again).

[premun]

I am asking because maybe there is some misunderstanding ^^

[marcpopMSFT]

I was setting the repository policies. Should I be modifying the subscriptions themselves?
darc set-repository-policies --repo https://github.com/dotnet/sdk --branch release/9.0.2xx --ignore-checks sdk-source-build,sdk-unified-build --all-checks-passed

[premun]

@marcpopMSFT the repository policies are for batched subscriptions. You need to modify the non-batched subscriptions (which is what I've done).