dotnet-maestro · Oct 19, 2026 · Oct 19, 2026
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -27,7 +27,7 @@
       ]
     },
     "microsoft.dotnet.helix.jobmonitor": {
-      "version": "11.0.0-beta.26465.108",
+      "version": "11.0.0-beta.26514.117",
       "commands": [
         "dotnet-helix-job-monitor"
       ]

diff --git a/Directory.Build.targets b/Directory.Build.targets
@@ -54,7 +54,7 @@
     <Product>Microsoft%AE .NET</Product>
     <!-- Use the .NET product branding version for informational version description -->
     <InformationalVersion Condition="'$(InformationalVersion)' == '' and '$(VersionSuffix)' == ''">$(ProductVersion)</InformationalVersion>
-    <InformationalVersion Condition="'$(InformationalVersion)' == '' and '$(PreReleaseVersionLabel)' == 'servicing'">$(ProductVersion)</InformationalVersion>
+    <InformationalVersion Condition="'$(InformationalVersion)' == '' and ('$(PreReleaseVersionLabel)' == 'servicing' or '$(PreReleaseVersionLabel)' == 'hotfix')">$(ProductVersion)</InformationalVersion>
     <InformationalVersion Condition="'$(InformationalVersion)' == '' and '$(VersionSuffix)' != ''">$(ProductVersion)-$(VersionSuffix)</InformationalVersion>
   </PropertyGroup>
 

diff --git a/NuGet.config b/NuGet.config
@@ -7,6 +7,11 @@
   </fallbackPackageFolders>
   <packageSources>
     <clear />
+    <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
+    <!--  Begin: Package sources from dotnet-dotnet -->
+    <add key="darc-pub-dotnet-dotnet-a586537-1" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-dotnet-a586537b-1/nuget/v3/index.json" />
+    <!--  End: Package sources from dotnet-dotnet -->
+    <!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
     <!--
       'src/test/PrepareTestAssets/PrepareTestAssets.proj' generates a NuGet.config file using this
       one as a template. The following line is a marker to insert the test restore sources.

diff --git a/eng/Version.Details.props b/eng/Version.Details.props
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
diff --git a/eng/Versions.props b/eng/Versions.props
@@ -14,8 +14,8 @@
     <PackageVersionNet8>8.0.$([MSBuild]::Add($([System.Version]::Parse('$(PackageVersionNet9)').Build),11))</PackageVersionNet8>
     <PackageVersionNet7>7.0.20</PackageVersionNet7>
     <PackageVersionNet6>6.0.36</PackageVersionNet6>
-    <PreReleaseVersionLabel>rc</PreReleaseVersionLabel>
-    <PreReleaseVersionIteration>2</PreReleaseVersionIteration>
+    <PreReleaseVersionLabel>rtm</PreReleaseVersionLabel>
+    <PreReleaseVersionIteration></PreReleaseVersionIteration>
     <!-- Enable to remove prerelease label. -->
     <StabilizePackageVersion Condition="'$(StabilizePackageVersion)' == ''">false</StabilizePackageVersion>
     <DotNetFinalVersionKind Condition="'$(StabilizePackageVersion)' == 'true'">release</DotNetFinalVersionKind>

diff --git a/eng/common/Get-GitHubAppToken.ps1 b/eng/common/Get-GitHubAppToken.ps1
@@ -1,13 +1,11 @@
 # Mints a short-lived GitHub App installation access token by signing a JWT
-# with a private key stored in Azure Key Vault (RSA, RS256). The signed JWT is
-# exchanged with the GitHub API for a token scoped to a single installation.
+# with an RSA private key (RS256). The signed JWT is exchanged with the GitHub
+# API for a token scoped to a single installation.
 #
 # Requirements:
-#   - A GitHub App whose private key has been uploaded into Key Vault as an RSA
-#     key (the PEM converted to a Key Vault *key*, NOT stored as a secret).
-#   - The caller (the federated Azure service connection used to run this script)
-#     must have the `Key Vault Crypto User` role (or at minimum the `Sign`
-#     action) on that key.
+#   - A GitHub App ID and PEM private key stored as Azure Key Vault secrets.
+#   - The federated Azure service connection running this script must have
+#     `Get` access to those two secrets.
 #   - The App must be installed on the target organization/account
 #     (`InstallationOwner`) with the permissions/repositories it needs.
 #
@@ -16,17 +14,17 @@
 
 [CmdletBinding()]
 param(
-    # Name of the Key Vault that holds the GitHub App's RSA signing key.
+    # Name of the Key Vault holding the GitHub App credentials.
     [Parameter(Mandatory = $true)]
     [string] $KeyVaultName,
 
-    # Name of the RSA key inside the Key Vault (the App's private key).
+    # Secret Manager projection containing the GitHub App ID.
     [Parameter(Mandatory = $true)]
-    [string] $KeyName,
+    [string] $AppIdSecretName,
 
-    # The GitHub App's Client ID (the value to put in the `iss` JWT claim).
+    # Secret Manager projection containing the PEM private key.
     [Parameter(Mandatory = $true)]
-    [string] $AppClientId,
+    [string] $AppPrivateKeySecretName,
 
     # Login of the organization or user account whose installation we should
     # mint the token for (e.g. `dotnet`, `microsoft`).
@@ -39,16 +37,69 @@ param(
     [Parameter(Mandatory = $false)]
     [string] $OutputVariableName
 )
-
 $ErrorActionPreference = 'Stop'
 $PSNativeCommandUseErrorActionPreference = $true
 
 . $PSScriptRoot\pipeline-logging-functions.ps1
 
+if ($KeyVaultName -notmatch '^[A-Za-z][A-Za-z0-9-]{1,22}[A-Za-z0-9]$' -or $KeyVaultName.Contains('--')) {
+    Write-PipelineTelemetryError -Category 'Build' -Message "KeyVaultName '$KeyVaultName' is not a valid Azure Key Vault name."
+    exit 1
+}
+
 function ConvertTo-Base64Url([byte[]] $bytes) {
     return [Convert]::ToBase64String($bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
 }
 
+$previousNativeCommandErrorPreference = $PSNativeCommandUseErrorActionPreference
+try {
+    # Azure CLI can emit non-fatal Python warnings to stderr.
+    $PSNativeCommandUseErrorActionPreference = $false
+    $keyVaultAccessToken = az account get-access-token `
+        --resource https://vault.azure.net `
+        --query accessToken `
+        --output tsv `
+        --only-show-errors
+    $tokenExitCode = $LASTEXITCODE
+}
+catch {
+    Write-PipelineTelemetryError -Category 'Build' -Message "Failed to acquire an Azure Key Vault access token: $_"
+    exit 1
+}
+finally {
+    $PSNativeCommandUseErrorActionPreference = $previousNativeCommandErrorPreference
+}
+if ($tokenExitCode -ne 0 -or [string]::IsNullOrWhiteSpace($keyVaultAccessToken)) {
+    Write-PipelineTelemetryError -Category 'Build' -Message "'az account get-access-token' exited with code $tokenExitCode while acquiring an Azure Key Vault access token."
+    exit 1
+}
+
+function Get-KeyVaultSecret([string] $SecretName) {
+    # Use the data-plane REST API because `az keyvault secret show` can fail
+    # with Errno 22 on hosted Windows agents when reading these projections.
+    $escapedSecretName = [Uri]::EscapeDataString($SecretName)
+    $secretUri = "https://$KeyVaultName.vault.azure.net/secrets/$escapedSecretName`?api-version=7.4"
+    try {
+        $response = Invoke-RestMethod `
+            -Uri $secretUri `
+            -Headers @{ Authorization = "Bearer $keyVaultAccessToken" } `
+            -Method Get
+    }
+    catch {
+        Write-PipelineTelemetryError -Category 'Build' -Message "Failed to read secret '$SecretName' from vault '$KeyVaultName': $_. Verify the secret exists and the service connection has 'Key Vault Secrets User' access to it."
+        exit 1
+    }
+    if ([string]::IsNullOrWhiteSpace($response.value)) {
+        Write-PipelineTelemetryError -Category 'Build' -Message "Secret '$SecretName' in vault '$KeyVaultName' is empty."
+        exit 1
+    }
+    return [string] $response.value
+}
+
+Write-Host "Reading GitHub App credentials from vault '$KeyVaultName'..."
+$appId = Get-KeyVaultSecret $AppIdSecretName
+$privateKey = Get-KeyVaultSecret $AppPrivateKeySecretName
+
 # Build JWT header and payload. Use [ordered] hashtables so JSON
 # serialization is deterministic.
 $jwtHeader = [ordered]@{
@@ -59,46 +110,38 @@ $now = [System.DateTimeOffset]::UtcNow
 $jwtPayload = [ordered]@{
     iat = $now.AddMinutes(-1).ToUnixTimeSeconds()
     exp = $now.AddMinutes(5).ToUnixTimeSeconds()
-    iss = $AppClientId
+    iss = $appId
 }
 
 $headerEncoded  = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtHeader  | ConvertTo-Json -Compress)))
 $payloadEncoded = ConvertTo-Base64Url ([System.Text.Encoding]::UTF8.GetBytes(($jwtPayload | ConvertTo-Json -Compress)))
 $signingInput   = "$headerEncoded.$payloadEncoded"
 
-# Key Vault `sign` expects the *digest* (base64), not the raw bytes.
-$sha256       = [System.Security.Cryptography.SHA256]::Create()
-$digestBytes  = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($signingInput))
-$digestBase64 = [Convert]::ToBase64String($digestBytes)
+$sha256 = [System.Security.Cryptography.SHA256]::Create()
+try {
+    $digestBytes = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($signingInput))
+}
+finally {
+    $sha256.Dispose()
+}
 
-Write-Host "Signing JWT with key '$KeyName' in vault '$KeyVaultName'..."
-$previousNativeCommandErrorPreference = $PSNativeCommandUseErrorActionPreference
+Write-Host 'Signing JWT with the GitHub App private key...'
+$rsa = [System.Security.Cryptography.RSA]::Create()
 try {
-    # Azure CLI can emit non-fatal Python warnings to stderr even when signing succeeds.
-    # Use the exit code to determine success for this invocation.
-    $PSNativeCommandUseErrorActionPreference = $false
-    $signatureBase64 = az keyvault key sign `
-        --vault-name $KeyVaultName `
-        --name $KeyName `
-        --algorithm RS256 `
-        --digest $digestBase64 `
-        --query signature `
-        --output tsv `
-        --only-show-errors
-    $signExitCode = $LASTEXITCODE
+    $rsa.ImportFromPem($privateKey)
+    $signatureBytes = $rsa.SignHash(
+        $digestBytes,
+        [System.Security.Cryptography.HashAlgorithmName]::SHA256,
+        [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)
+    $signatureUrl = ConvertTo-Base64Url $signatureBytes
 }
 catch {
-    Write-PipelineTelemetryError -Category 'Build' -Message "Failed to sign the JWT via Key Vault (key '$KeyName', vault '$KeyVaultName'): $_. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key."
+    Write-PipelineTelemetryError -Category 'Build' -Message "Failed to sign the GitHub App JWT with the supplied private key: $_"
     exit 1
 }
 finally {
-    $PSNativeCommandUseErrorActionPreference = $previousNativeCommandErrorPreference
-}
-if ($signExitCode -ne 0 -or [string]::IsNullOrWhiteSpace($signatureBase64)) {
-    Write-PipelineTelemetryError -Category 'Build' -Message "'az keyvault key sign' exited with code $signExitCode for key '$KeyName' in vault '$KeyVaultName'. Verify the service connection identity has the 'Key Vault Crypto User' role (Sign action) on the key."
-    exit 1
+    $rsa.Dispose()
 }
-$signatureUrl = $signatureBase64.Trim().TrimEnd('=').Replace('+', '-').Replace('/', '_')
 $jwt = "$signingInput.$signatureUrl"
 
 $headers = @{
@@ -126,7 +169,7 @@ try {
     } while ($pageInstallationCount -eq 100)
 }
 catch {
-    Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App's Client ID ('$AppClientId') may be incorrect."
+    Write-PipelineTelemetryError -Category 'Build' -Message "Failed to list GitHub App installations: $_. The signed JWT may be invalid or the App ID may be incorrect."
     exit 1
 }
 $matchingInstallations = @($installations | Where-Object { $_.account.login -ieq $InstallationOwner })

diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml
@@ -63,7 +63,7 @@ parameters:
   type: boolean
   default: false
 
-# Azure service connection ID authorized for Helix. Required when
+# Workload identity federation service connection name authorized for Helix. Required when
 # useEntraAuthentication is true.
 - name: azureSubscription
   type: string
@@ -94,13 +94,12 @@ parameters:
   type: boolean
   default: false
 
-# When true, test results are reported to Azure DevOps using the fully qualified test name
-# (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
-# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display;
-# primarily useful for frameworks like MSTest whose display name is only the method name.
+# When true (the default), test results are reported to Azure DevOps using the fully qualified test
+# name (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
+# well (--use-fully-qualified-test-name). Set to false to preserve framework-provided display names.
 - name: useFullyQualifiedTestName
   type: boolean
-  default: false
+  default: true
 
 # Controls per-test output attachments. Defaults to Failed.
 - name: testResultAttachmentMode
@@ -136,6 +135,20 @@ jobs:
   displayName: Monitor Helix Jobs
   timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
   continueOnError: ${{ parameters.continueOnError }}
+  variables:
+    HELIX_MONITOR_BASE_URI: ${{ parameters.helixBaseUri }}
+    HELIX_MONITOR_USE_ENTRA_AUTHENTICATION: ${{ parameters.useEntraAuthentication }}
+    HELIX_MONITOR_POLLING_INTERVAL_SECONDS: ${{ parameters.pollingIntervalSeconds }}
+    HELIX_MONITOR_FAIL_ON_FAILED_TESTS: ${{ parameters.failWorkItemsWithFailedTests }}
+    HELIX_MONITOR_ALLOW_NO_HELIX_JOBS: ${{ parameters.allowNoHelixJobs }}
+    HELIX_MONITOR_USE_FULLY_QUALIFIED_TEST_NAME: ${{ parameters.useFullyQualifiedTestName }}
+    HELIX_MONITOR_TIMEOUT_IN_MINUTES: ${{ parameters.timeoutInMinutes }}
+    HELIX_MONITOR_TEST_RESULT_UPLOAD_PARALLELISM: ${{ parameters.testResultUploadParallelism }}
+    HELIX_MONITOR_ORGANIZATION: ${{ parameters.organization }}
+    HELIX_MONITOR_REPOSITORY: ${{ parameters.repository }}
+    HELIX_MONITOR_TEST_RESULT_ATTACHMENT_MODE: ${{ parameters.testResultAttachmentMode }}
+    HELIX_MONITOR_TOOL_NUPKG_ARTIFACT_NAME: ${{ parameters.toolNupkgArtifactName }}
+    HELIX_MONITOR_TOOL_COMMAND: ${{ parameters.toolCommand }}
   ${{ if ne(length(parameters.dependsOn), 0) }}:
     dependsOn: ${{ parameters.dependsOn }}
   ${{ if ne(parameters.condition, '') }}:
@@ -157,22 +170,6 @@ jobs:
     - pwsh: throw "azureSubscription must be set when useEntraAuthentication is true."
       displayName: Validate Helix Entra authentication
 
-  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
-    - task: AzureCLI@2
-      displayName: Initialize Helix Entra authentication
-      inputs:
-        azureSubscription: ${{ parameters.azureSubscription }}
-        addSpnToEnvironment: true
-        scriptType: pscore
-        scriptLocation: inlineScript
-        inlineScript: |
-          if ([string]::IsNullOrWhiteSpace($env:servicePrincipalId) -or [string]::IsNullOrWhiteSpace($env:tenantId)) {
-            throw "The Helix Azure service connection did not provide a service principal or tenant ID."
-          }
-
-          Write-Host "##vso[task.setvariable variable=HelixEntraClientId]$env:servicePrincipalId"
-          Write-Host "##vso[task.setvariable variable=HelixEntraTenantId]$env:tenantId"
-
   - ${{ if ne(parameters.toolNupkgArtifactName, '') }}:
     - task: DownloadPipelineArtifact@2
       displayName: Download Helix Job Monitor artifact
@@ -241,76 +238,26 @@ jobs:
     - bash: ./eng/common/dotnet.sh tool restore
       displayName: Restore Helix Job Monitor
 
-  - bash: |
-      set -euo pipefail
-
-      toolArgs=(
-        --helix-base-uri              '${{ parameters.helixBaseUri }}'
-        --use-entra-authentication    '${{ parameters.useEntraAuthentication }}'
-        --polling-interval-seconds    '${{ parameters.pollingIntervalSeconds }}'
-        --fail-on-failed-tests        '${{ parameters.failWorkItemsWithFailedTests }}'
-        --allow-no-helix-jobs         '${{ parameters.allowNoHelixJobs }}'
-        --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}'
-        --max-wait-minutes            "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully.
-        --stage-name                  '$(System.StageName)'
-        --stage-attempt               '$(System.StageAttempt)'
-        --job-attempt                 '$(System.JobAttempt)'
-        --test-result-upload-parallelism '${{ parameters.testResultUploadParallelism }}'
-      )
-
-      organization='${{ parameters.organization }}'
-      repository='${{ parameters.repository }}'
-      testResultAttachmentMode='${{ parameters.testResultAttachmentMode }}'
-
-      # Fall back to Azure DevOps-provided environment variables when the caller did not
-      # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically
-      # 'owner/repo' for GitHub-backed builds and 'owner-repo' for internal builds.
-      if [ -z "$organization" ] || [ -z "$repository" ]; then
-        buildRepoName="${BUILD_REPOSITORY_NAME:-}"
-        if [ -n "$buildRepoName" ] && [[ "$buildRepoName" == */* ]]; then
-          repoOwner="${buildRepoName%%/*}"
-          repoName="${buildRepoName#*/}"
-        elif [ -n "$buildRepoName" ] && [[ "$buildRepoName" == *-* ]]; then
-          repoOwner="${buildRepoName%%-*}"
-          repoName="${buildRepoName#*-}"
-        fi
-
-        if [ -n "${repoOwner:-}" ] && [ -n "${repoName:-}" ]; then
-          if [ -z "$organization" ]; then organization="$repoOwner"; fi
-          if [ -z "$repository" ];   then repository="$repoName";   fi
-        fi
-      fi
-
-      if [ -n "$organization" ]; then toolArgs+=( --organization "$organization" ); fi
-      if [ -n "$repository" ];   then toolArgs+=( --repository   "$repository" );   fi
-      if [ -n "$testResultAttachmentMode" ]; then
-        toolArgs+=( --test-result-attachment-mode "$testResultAttachmentMode" )
-      fi
-
-      # Build.Reason and Build.SourceBranch are required to derive the Helix source filter
-      # the same way the Helix SDK submitter does (PR -> 'pr', internal -> 'official',
-      # otherwise -> 'ci'). Without these, manually-queued / scheduled / CI builds would
-      # be looked up under the wrong source prefix and find zero jobs.
-      toolArgs+=( --build-reason  "$(Build.Reason)" )
-      toolArgs+=( --source-branch "$(Build.SourceBranch)" )
-
-      if [ -n '${{ parameters.toolNupkgArtifactName }}' ]; then
-        # Tool was installed from a local nupkg; run the DLL via the repo-local dotnet.
-        export DOTNET_ROOT="$(Build.SourcesDirectory)/.dotnet"
-        ./eng/common/dotnet.sh exec "$(HelixJobMonitorDll)" "${toolArgs[@]}"
-      else
-        # Tool was restored from the local .config/dotnet-tools.json manifest; invoke it
-        # through the manifest from the repo root.
-        pushd "$BUILD_SOURCESDIRECTORY" > /dev/null
-        trap 'popd > /dev/null' EXIT
-        ./eng/common/dotnet.sh tool run '${{ parameters.toolCommand }}' -- "${toolArgs[@]}"
-      fi
-    displayName: Monitor Helix Jobs
-    env:
-      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-      ${{ if eq(parameters.useEntraAuthentication, false) }}:
+  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
+    - task: AzureCLI@2
+      displayName: Monitor Helix Jobs
+      inputs:
+        azureSubscription: ${{ parameters.azureSubscription }}
+        keepAzSessionActive: true
+        scriptType: bash
+        scriptLocation: inlineScript
+        inlineScript: |
+          set -euo pipefail
+
+          # AzureCLI@2 replaces SYSTEM_ACCESSTOKEN with the service connection token.
+          export SYSTEM_ACCESSTOKEN="$HELIX_AZDO_ACCESSTOKEN"
+          bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      env:
+        HELIX_AZDO_ACCESSTOKEN: $(System.AccessToken)
+
+  - ${{ if eq(parameters.useEntraAuthentication, false) }}:
+    - bash: bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      displayName: Monitor Helix Jobs
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
         HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
-      ${{ if eq(parameters.useEntraAuthentication, true) }}:
-        AZURESUBSCRIPTION_CLIENT_ID: $(HelixEntraClientId)
-        AZURESUBSCRIPTION_TENANT_ID: $(HelixEntraTenantId)
-        AZURESUBSCRIPTION_SERVICE_CONNECTION_ID: ${{ parameters.azureSubscription }}