Download version-pinned NuGet.config for MAUI workload install

[matouskozak]

Summary

Instead of downloading the latest NuGet.config from branch HEAD of upstream repos (dotnet/maui, dotnet/android, dotnet/macios), extract the commit SHA from the NuGet package .nuspec metadata and download from the exact commit that produced the workload package.

Problem

MauiNuGetConfigContext downloads NuGet.config files from upstream repos using branch HEAD. If the upstream repo has moved ahead since the workload package was published, the NuGet.config may reference feeds that don't match the packages being installed.

Solution

NuGet packages embed <repository type="git" url="..." commit="..." /> in their .nuspec metadata. We use this to:

1. Query the NuGet feed for the latest manifest package per upstream repo (same feed used for workload install)
2. Download the .nuspec from the NuGet flat container API
3. Extract the exact commit SHA from the <repository> element
4. Download NuGet.config from that commit instead of branch HEAD

New functions

• _find_latest_manifest_package — shared filtering logic (extracted from install_latest_maui)
• _get_nuget_flat_container_base — gets flat container URL from NuGet V3 service index
• _get_commit_sha_from_nuspec — downloads .nuspec, parses <repository> element
• _discover_repo_commits — orchestrates per-repo commit SHA discovery

Modified functions

• _get_repo_nuget_config_url / download_repo_nuget_config — accept optional commit_sha parameter
• MauiNuGetConfigContext.__enter__ — calls _discover_repo_commits before downloading configs
• install_latest_maui — refactored to use shared _find_latest_manifest_package helper

Fallback

Any failure in commit discovery silently falls back to the current branch-HEAD behavior. All failures are logged as warnings, never fatal.

Validation

Tested on https://dev.azure.com/dnceng/internal/_build/results?buildId=3022990&view=results— commit SHAs are correctly discovered and used for NuGet.config downloads.

[Copilot]

Pull request overview

This PR makes MAUI workload installs more deterministic by pinning upstream NuGet.config downloads (maui/android/macios) to the exact git commit that produced the workload’s manifest package, instead of downloading configs from branch HEAD.

Changes:

• Added NuGet feed probing to download a manifest package .nuspec and extract <repository commit="..."> for commit-pinned NuGet.config URLs.
• Refactored “latest manifest package” selection into a shared helper and reused it for both workload install and commit discovery.
• Updated MauiNuGetConfigContext to attempt commit discovery and fall back to branch HEAD behavior on failure.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.