[Sébastien Ros (sebastienros)]

Description

Use ${{ github.workspace }}/.nuget/packages for Windows GitHub Actions scripts that restore or consume NuGet packages. Keep Windows restore, build, and test steps on the same cache instead of switching between .packages and nuget-cache.

Multi-platform jobs configure the variable through GITHUB_ENV in Windows-only setup steps; Windows-only consumers set it at step scope. Remove conflicting Windows test-step overrides and document the convention. Linux and macOS retain their existing cache behavior. No new dependencies.

Cache changes to refresh-manifests.yml and reproduce-flaky-tests.yml are deferred because safe final-definition validation is unavailable. Both files are unchanged from the original PR base. Added PowerShell statements use Write-Output rather than aliases.

Validation

• git diff --check: passed.
• actionlint -shellcheck= -pyflakes= .github/workflows/build-cli-native-archives.yml .github/workflows/cli-starter-validation.yml .github/workflows/extension-e2e-tests.yml .github/workflows/native-dashboard-validation.yml .github/workflows/prepare-installer-artifacts.yml .github/workflows/run-tests.yml: passed.
• git diff 1bb3437a51^ --exit-code -- .github/workflows/refresh-manifests.yml .github/workflows/reproduce-flaky-tests.yml: passed, confirming both deferred workflows are unchanged.
• PSScriptAnalyzer 1.25.0 comparison of the four remaining added cache statements, with GitHub workspace expressions expanded identically: four diagnostics before, zero after.
• CI attempt 2 validated the Windows cache behavior at 8cfec1e. Latest-commit CI is pending; the subsequent changes only replace aliases and remove the two deferred workflow changes.
• .NET tests were not run locally; changes are workflow configuration and documentation only.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20705

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20705"

[Copilot]

Copilot review overview

🟡 Changes recommended

Linux restores target root-owned /mnt without first creating a runner-writable cache directory.

Review effort: Balanced
Findings: 22 · 1

Open (23)

• QuarantineTools uses an unwritable NuGet cache path · New
• Linux archive builds use an unprepared NuGet cache · New
• Package restore cannot write to the NuGet cache · New
• Stabilization restore uses an unwritable NuGet cache · New
• Linux installer validation uses an unprepared NuGet cache · New
• Setup restore fails because the NuGet cache is unwritable · New
• Issue generation uses an unwritable NuGet cache path · New
• Deployment artifact restore uses an unwritable NuGet cache · New
• Linux extension restores use an unprepared cache directory · New
• API diff restore uses an unwritable NuGet cache path · New
• ATS diff restore uses an unwritable NuGet cache path · New
• Flaky-test restore uses an unprepared NuGet cache directory · New
• Linux test restores fail because the NuGet cache is unwritable · New
• Build restore uses an unprepared NuGet cache directory · New
• Restore script cannot write to the NuGet cache path · New
• Failure reporting uses an unwritable NuGet cache path · New
• Test selection restore uses an unprepared NuGet cache path · New
• NuGet cache path is not writable on Ubuntu runners · New
• NuGet cache path is not writable on Ubuntu runners · New
• NuGet cache path is not writable on Ubuntu runners · New

And 3 more that still need to be addressed.

What changed in this PR

Standardizes NuGet package-cache paths across GitHub Actions workflows.

Changes:

• Moves Linux caches to /mnt/nuget/packages.
• Uses workspace-local caches on Windows/macOS.
• Removes inconsistent step-level overrides and documents the convention.

File	Description
docs/​ci/​TestingOnCI.md	Documents cache-path guidance.
.github/​workflows/​validate-agentic-workflows.yml	Configures the validation cache.
.github/​workflows/​update-dependencies.yml	Configures dependency-update caching.
.github/​workflows/​update-aspire-skills-bundle.yml	Configures bundle-update caching.
.github/​workflows/​update-ai-foundry-models.yml	Configures model-generator caching.
.github/​workflows/​typescript-api-compat.yml	Configures API compatibility caching.
.github/​workflows/​tests.yml	Configures test-selection caching.
.github/​workflows/​tests-outerloop.yml	Configures failure-report caching.
.github/​workflows/​tests-daily-smoke.yml	Configures smoke-test caching.
.github/​workflows/​specialized-test-runner.yml	Configures runsheet-generation caching.
.github/​workflows/​run-tests.yml	Unifies restore and test caches.
.github/​workflows/​reproduce-flaky-tests.yml	Unifies flaky-test caches.
.github/​workflows/​refresh-manifests.yml	Configures Windows manifest caching.
.github/​workflows/​prepare-installer-artifacts.yml	Configures installer-test caching.
.github/​workflows/​native-dashboard-validation.yml	Updates the Windows test cache.
.github/​workflows/​generate-ats-diffs.yml	Configures ATS generation caching.
.github/​workflows/​generate-api-diffs.yml	Configures API generation caching.
.github/​workflows/​extension-e2e-tests.yml	Configures platform-specific E2E caching.
.github/​workflows/​deployment-tests.yml	Configures build and deployment caches.
.github/​workflows/​create-failing-test-issue.yml	Configures issue-tool caching.
.github/​workflows/​copilot-setup-steps.yml	Configures setup caching.
.github/​workflows/​cli-starter-validation.yml	Configures platform-specific validation caching.
.github/​workflows/​ci.yml	Configures stabilization-build caching.
.github/​workflows/​build-packages.yml	Configures package-build caching.
.github/​workflows/​build-cli-native-archives.yml	Configures native archive caching.
.github/​workflows/​apply-test-attributes.yml	Configures QuarantineTools caching.

[Copilot]

Copilot review overview

🟡 Changes recommended

The refresh-manifests workflow would stage its unignored NuGet cache into generated pull requests.

Review effort: Balanced
Findings: 1

Open (1)

• Ignore NuGet cache to prevent generated package files in PRs · New

Resolved since last review (23)

• NuGet restore fails because cache directory lacks permissions
• NuGet cache path is not writable on Ubuntu runners
• NuGet cache path is not writable on Ubuntu runners
• NuGet cache path is not writable on Ubuntu runners
• NuGet cache path is not writable on Ubuntu runners
• Test selection restore uses an unprepared NuGet cache path
• Failure reporting uses an unwritable NuGet cache path
• Restore script cannot write to the NuGet cache path
• Build restore uses an unprepared NuGet cache directory
• Linux test restores fail because the NuGet cache is unwritable
• Flaky-test restore uses an unprepared NuGet cache directory
• ATS diff restore uses an unwritable NuGet cache path
• API diff restore uses an unwritable NuGet cache path
• Linux extension restores use an unprepared cache directory
• Deployment artifact restore uses an unwritable NuGet cache
• Issue generation uses an unwritable NuGet cache path
• Setup restore fails because the NuGet cache is unwritable
• Linux installer validation uses an unprepared NuGet cache
• Stabilization restore uses an unwritable NuGet cache
• Package restore cannot write to the NuGet cache

And 3 more resolved.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[James Newton-King (JamesNK)]

Reviewed the current revision; no additional high-confidence findings.

[Ankit Jain (radical)]

CI confidence report

🔴 BLOCKED — fix before merge: two touched workflows lack final-definition execution: refresh-manifests.yml and reproduce-flaky-tests.yml.

Required validation: 🔴 2 missing · 🟡 1 attention · 🟢 11 verified · ⚪ 3 not applicable

Reviewer actions

• Required before merge: Establish authorized, safe validation of refresh-manifests.yml, or record qualifying non-author maintainer acceptance of its unrun risk.
  Done when: a supported run observes the final workflow behavior, or a linked acceptance covers that specific unrun behavior. Do not dispatch this write-enabled workflow against upstream.
• Required before merge: Establish supported validation of reproduce-flaky-tests.yml with a valid test selection, or record qualifying non-author maintainer acceptance.
  Done when: a qualifying run exercises the changed Windows setup, or a linked acceptance covers that specific unrun behavior. The checked-in placeholder filter fails setup validation and the workflow has no dispatch input for a test selection.
• Recommended: Replace the five added PowerShell echo aliases with Write-Output.
  Done when: the same-version PSScriptAnalyzer comparison reports no new diagnostics.

Evidence

🔴 refresh-manifests workflow unrun

• Gap: No run of this touched workflow's final definition was found. It has write permissions and its local PR-creation action can push a branch and create or update a PR.
• Evidence: refresh-manifests.yml was not run against the PR head. The earlier cache-staging concern is not a finding: .gitignore ignores **/packages/*.
• Resolution: Establish authorized safe validation with the final definition and controlled mutation targets, or obtain qualifying acceptance. No safe final-definition run is currently established.

🔴 reproduce-flaky-tests workflow unrun

• Gap: No final-definition run was found. Its checked-in placeholder test filter fails setup validation before reaching the changed Windows cache configuration.
• Evidence: reproduce-flaky-tests.yml sets the placeholder; setup validation rejects it. No dispatch input supplies a valid filter.
• Resolution: Establish an authorized supported run against the final definition or obtain the specific acceptance above; a modified copy does not prove the final workflow ran.

🟡 PSScriptAnalyzer reports added alias warnings

• Gap: The required latest-version scan found five new PSAvoidUsingCmdletAliases warnings, one for each added echo statement.
• Evidence: PSScriptAnalyzer 1.25.0 scanned the five changed statements; all five warnings say echo aliases Write-Output. This is an attention-level analyzer finding, not evidence of runtime failure.
• Resolution: Replace the aliases and compare base/head using the same analyzer version and settings.

🟢 Verified checks (11)

• build-cli-native-archives.yml: Final-head CI attempt 2 exercised Windows x64 and ARM64 cache setup successfully.
• cli-starter-validation.yml: The same final-head CI run exercised Windows x64 and ARM64 starter validation successfully.
• extension-e2e-tests.yml: The same run completed the Windows extension E2E jobs.
• native-dashboard-validation.yml: The same run completed Windows x64 smoke and interactivity validation.
• prepare-installer-artifacts.yml: The same run completed WinGet installer smoke validation and Homebrew artifact preparation.
• run-tests.yml: The same run completed the PR test matrix.
• Outerloop cache-path smoke: Final-head outerloop PR run ran Windows Acquisition tests successfully; its one-project smoke is sufficient for this Windows cache-path change. Full outerloop execution is not required for this setting-only diff.
• Quarantine cache-path smoke: Final-head quarantine PR run ran Windows Acquisition tests successfully; its one-project smoke is sufficient for this Windows cache-path change. Full quarantine execution is not required for this setting-only diff.
• zizmor: Version 1.30.1; base/head comparison found no new or worsened findings. Final-head Zizmor job succeeded.
• actionlint: Version 1.7.12; base/head comparison found no new or worsened findings. Six existing diagnostics remain on unchanged workflows. Final-head lint job succeeded.
• Targeted security review: No new event-context, token/permission, shell/expression injection, or action-pin issue found. No action pins changed.

⚪ Not applicable (3)

• Azure DevOps definition 1602: No internal pipeline, Arcade, eng/, or shared official-build plumbing changed.
• ShellCheck: No standalone shell scripts changed; added inline commands are PowerShell.
• Deployment E2E: No deployment scenario, workflow, or runtime dependency changed.

Scope and method

• Scope: Eight GitHub workflow files plus docs/ci/TestingOnCI.md; no action pins, gh-aw sources, or selector rules changed.
• Method: Audited final head 8cfec1e81a1556ba93c98bd2087c0fb71e10a0e5 against base/merge base 013ad14a2b4f4f1a2114c42f9854bc13bdc4951c. Scans used python3 -B "$S/scan_ci_delta.py" --facts "$A/facts.json" --repo-dir "$R" --scratch-dir "$A/scan-<tool>" --tool <tool>. PSScriptAnalyzer 1.25.0 was run on the five added PowerShell statements and reported five warnings. Local artifacts were retained.

Runs and links consulted (11)

• CI attempt 2 — final PR head; successful, including the six named touched reusable workflows through ci.yml.
• CI attempt 1 — same head; the Linux CLI test TrayWatchStreamTests.StalledResourceWatchDoesNotBlockReconciliationOrQuit failed (expected 0, actual 7), and the Windows Qdrant process exited -1073741502. Both jobs were retried successfully; no continuing PR-caused failure was established.
• Outerloop and quarantine — final-head smoke runs with successful Windows Acquisition tests; adequate for the changed cache setting, but not evidence of full lane execution.
• Earlier quarantine, CI, and outerloop — prior head 1bb3437a51f7b4c1120e2ca4ca0749ae82239f05; failed/cancelled and not evidence for final behavior.
• Final-head Zizmor and lint checks succeeded.
• Test selector comment reports the full PR matrix and PR-gated jobs were selected.
• Manifest-cache review thread alleged the cache would be staged; the final ignore pattern **/packages/* contradicts that finding.

Ready-to-use pr-testing prompt

Use the pr-testing skill to test PR #20705. Focus on whether an authorized supported final-definition run can exercise the changed Windows setup in reproduce-flaky-tests.yml despite its placeholder filter, and safe validation of refresh-manifests.yml without upstream mutations. Do not dispatch the write-enabled manifest workflow against upstream.

Unknowns

• Whether an authorized safe final-definition validation path exists for the two unrun workflows is not established; confirming one could change their disposition.

[Sébastien Ros (sebastienros)]

Addressed the CI confidence report in 6df9193:

• Dropped the cache changes from refresh-manifests.yml and reproduce-flaky-tests.yml. Both files are identical to the original PR base, so neither unvalidated workflow behavior remains in scope. I did not dispatch the write-enabled manifest workflow upstream.
• Replaced the four remaining added PowerShell echo aliases with Write-Output; the fifth was removed with the reproduction-workflow change. PSScriptAnalyzer 1.25.0, with the GitHub workspace expressions expanded identically for both revisions, reports four diagnostics before and zero after for those four statements.
• Actionlint passed for all six remaining changed workflows; git diff --check passed.
• Replied to and resolved the cache-staging review thread: **/packages/* already ignores restored cache contents, independently of removing the manifest change.

The earlier successful Windows runs remain evidence for the cache-path behavior, but CI still needs to finish on the latest commit.

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflow behavior is consistent and previously CI-validated; only non-blocking documentation wording remains.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid claiming all Windows NuGet consumers use the shared cache path · New

Resolved since last review (1)

• Ignore NuGet cache to prevent generated package files in PRs

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching '.github/workflows/run-tests.yml' selects ALL

---

Selection computed for commit 7783e8d.

[Copilot]

Copilot review overview

🟢 Approval recommended

The cache configuration is consistently scoped to Windows, preserves existing Unix behavior, and has successful CI validation.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Avoid claiming all Windows NuGet consumers use the shared cache path

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch taken: docs_optional → build_or_ci_only (treating the sole triggered signal as a proven false positive, per Step 10's allowance).

Triggered signals (1): pr_body_has_cli_flag_mention. Evidence: the PR body text "...actionlint -shellcheck= -pyflakes= .github/wor..." is a quote from the PR's own Validation section describing the actionlint linter invocation used to verify the workflow YAML — it is not a new or changed Aspire product CLI flag. No Aspire CLI/MCP option was added or changed anywhere in the diff.

Allowlist justification (build_or_ci_only): All 7 changed files fall into this category:

• .github/workflows/build-cli-native-archives.yml
• .github/workflows/cli-starter-validation.yml
• .github/workflows/extension-e2e-tests.yml
• .github/workflows/native-dashboard-validation.yml
• .github/workflows/prepare-installer-artifacts.yml
• .github/workflows/run-tests.yml
• docs/ci/TestingOnCI.md (internal contributor/CI documentation in the microsoft/aspire repo — not published on microsoft/aspire.dev)

The change configures a shared Windows NuGet package cache path (${{ github.workspace }}/.nuget/packages) across GitHub Actions jobs for restore/build/test consistency. It has no effect on any Aspire product behavior, public API, CLI surface, or dashboard — it only affects the repository's own CI pipeline. No end-user-facing documentation on aspire.dev describes or needs to describe GitHub Actions caching internals of the Aspire repo itself.