Use Azure Artifacts Maven feed for CFSClean network isolation compliance

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Problem

The official build pipeline (dotnet-maui, def 1095) fails because CFSClean network isolation blocks direct access to repo.maven.apache.org. This breaks two separate Gradle invocations:

1. src/Core/AndroidNative build — our own Gradle project
2. Microsoft.Android.Sdk.Bindings.Gradle.targets — Android SDK binding generator in Core.csproj

Per 1ES CFS guidance, the fix is to route all Maven dependency resolution through an Azure Artifacts feed with upstream sources.

Fix

Gradle configuration changes

• settings.gradle — Replace mavenCentral(), google(), gradlePluginPortal() with the dotnet-public-maven Azure Artifacts feed. Add the Azure Artifacts Gradle credential provider plugin (v1.1.1) for local authentication.
• build.gradle — Point buildscript.repositories to the same feed for AGP classpath resolution.
• eng/init.gradle — Global Gradle init script that redirects any remaining Maven Central/Google Maven references (e.g. from Microsoft.Android.Sdk.Bindings.Gradle.targets) to the feed. Installed into GRADLE_USER_HOME by the pipeline.

Pipeline changes

• cache-gradle.yml — Copy init.gradle into GRADLE_USER_HOME after cache restore to prevent stale cached copies. Uses $(GRADLE_USER_HOME) variable for the destination path.

Why the ingestion script (eng/ingest-maven-deps.sh) is needed

The dotnet-public-maven feed proxies Maven Central, but new packages require an authenticated first-time pull to be saved. The Gradle credential provider plugin has two limitations that prevent dotnet build from self-ingesting:

1. Skips entirely in CI — when TF_BUILD=True (Azure Pipelines), the plugin is a no-op
2. Doesn't cover all Gradle scopes — the plugin injects auth into pluginManagement.repositories and project.repositories, but NOT buildscript.repositories or AGP's internal detachedConfiguration scopes. This means dotnet build locally cannot ingest new packages through the Android SDK binding targets even with correct credentials.

We verified this by adding an un-ingested package (io.coil-kt:coil:2.7.0) — dotnet build fails with 401 despite the credential provider authenticating successfully.

Upstream issue: microsoft/artifacts-credprovider#671

The script works around these gaps by:

1. Acquiring an auth token via the .NET credential provider (MSAL)
2. Pre-ingesting platform-specific artifacts (aapt2) for all OS variants (macOS/Linux/Windows)
3. Running Gradle with --refresh-dependencies to bypass local cache
4. Falling back to curl with Bearer token for unreachable scopes

Run ./eng/ingest-maven-deps.sh after adding or updating any Maven/Gradle dependency.

Documentation updates

• settings.gradle — explains the feed setup and when to run the script
• gradle-wrapper.properties — warning not to upgrade Gradle past 8.x (dotnet/android#10738)
• copilot-instructions.md — always-on guidance for Gradle 401 failures
• azdo-build-investigator/SKILL.md — error signatures and DO NOTs for CI investigation
• android.instructions.md — quick reference for Android developers

Verified

• ✅ Internal official build 2961149 passed — Pack macOS + Pack Windows both green
• ✅ Same pattern used by dotnet/aspnetcore (PR #64962)
• ✅ Feed is public — no auth needed to read already-ingested packages, external contributors can build without credentials
• ✅ Locally verified: dotnet build works for already-ingested packages, fails for new ones (confirming script is needed)

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 35089

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 35089"

[Copilot]

Pull request overview

This PR updates the Android/Gradle dependency resolution used by MAUI’s build and CI pipeline to comply with CFSClean network isolation by routing Maven/Google/Plugin Portal access through the public dnceng Azure Artifacts Maven feed.

Changes:

• Replace google(), mavenCentral(), and gradlePluginPortal() usage in AndroidNative Gradle settings with the Azure Artifacts Maven feed and enforce FAIL_ON_PROJECT_REPOS.
• Add a global eng/init.gradle init script intended to redirect Maven/Google/Plugin Portal repositories to the Azure Artifacts feed for Gradle invocations MAUI doesn’t directly control.
• Update the Gradle cache pipeline template to copy eng/init.gradle into GRADLE_USER_HOME.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
src/Core/AndroidNative/settings.gradle	Routes plugin/dependency resolution through the Azure Artifacts Maven feed; enforces no project-level repos.
src/Core/AndroidNative/build.gradle	Removes buildscript repository declarations (but still uses buildscript classpath).
eng/pipelines/common/cache-gradle.yml	Copies eng/init.gradle into GRADLE_USER_HOME during cache setup on macOS/Windows.
eng/init.gradle	Adds an init script to rewrite certain Maven repository URLs to the Azure Artifacts feed.

[MauiBot]

⚠️ Merge Conflict Detected — This PR has merge conflicts with its target branch. Please rebase onto the target branch and resolve the conflicts.

[MauiBot]

⚠️ Merge Conflict Detected — This PR has merge conflicts with its target branch. Please rebase onto the target branch and resolve the conflicts.

[MauiBot]

⚠️ Merge Conflict Detected — This PR has merge conflicts with its target branch. Please rebase onto the target branch and resolve the conflicts.

[MauiBot]

⚠️ Merge Conflict Detected — This PR has merge conflicts with its target branch. Please rebase onto the target branch and resolve the conflicts.

[MauiBot]

⚠️ Merge Conflict Detected — This PR has merge conflicts with its target branch. Please rebase onto the target branch and resolve the conflicts.

[jonathanpeppers]

This looks find 👍 , but I wonder if it blocks any contributors from building.

[github-actions]

🔍 Skill Validation Results

❌ Static Checks Failed

Skills checked: 15 | Agents checked: 0

Full validator output

Found 1 skill(s)
[azdo-build-investigator] 📊 azdo-build-investigator: 1,292 BPE tokens [chars/4: 1,209] (detailed ✓), 8 sections, 3 code blocks
[azdo-build-investigator]    ⚠  No numbered workflow steps — agents follow sequenced procedures more reliably.
✅ All checks passed (1 skill(s))
No agents found in the specified paths: "/home/runner/work/maui/maui/.github/agents"

⏭️ LLM Evaluation: Skipped

No changed skills with eval tests found.

🔍 Full results and investigation steps

[PureWeen]

Upstream issue filed: microsoft/artifacts-credprovider#671 — the Gradle credential provider plugin doesn't cover buildscript.repositories or detachedConfiguration scopes, which is why we need the eng/ingest-maven-deps.sh script as a workaround.