[ci] Move to new compliance task (#19475)

* Try security/full/v1.yml

* try again

* Fix

* Try again only dll

* Disable for now

* Only on windows

* try binskim again

* Try skip provisioning

* Add logging

* Missing semicolumn

* Update glob

* Fix glob

* Update provisioning file

* We don't need vs anymore

* try exclude

* Need to provision api

* Try exclude

* Fixes for compliance

* Update handlers.yml

* Create PoliCheck.Exclusions.xml

* Update PoliCheck.Exclusions.xml

* Try again

* Exclusions please work

* Fix name

* Try one element

* Rename source.gdnsuppress.json to source.gdnsuppress

* Update handlers.yml

* Update source.gdnsuppress

* Enable api scan

* Update handlers.yml

* Update handlers.yml

* Update handlers.yml

* Update handlers.yml

* Update source.gdnsuppress

* Run on nightly or on demand

* Update handlers.yml

* Update handlers.yml

* Just a little more cleanup

eng/automation/guardian/PoliCheck.Exclusions.xml

@@ -0,0 +1,12 @@
+<!-- Upper case must be used. All values will be compared only to the upper case strings -->
+<PoliCheckExclusions>
+  <!-- Reminder: you are only allowed one exclusion element of each type, to have multiple values you must pipe separate them in a single element -->
+  <!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
+  <Exclusion Type="FolderPathFull">SAMPLES|CONTROLGALLERY|PUBLICAPI</Exclusion>
+  <!-- Each of these exclusions is a folder name - if any folder or file starts with "\[name]", it will be skipped -->
+  <!-- <Exclusion Type="FolderPathStart">SRC\CONTROLS\SAMPLES</Exclusion> -->
+  <!-- Each of these file types will be completely skipped for the entire scan -->
+  <!--<Exclusion Type="FileType">.ABC|.XYZ</Exclusion>-->
+  <!-- The specified file names will be skipped during the scan regardless which folder they are in -->
+  <!-- <Exclusion Type="FileName">POLICHECK.EXCLUSIONS.xml</Exclusion> -->
+</PoliCheckExclusions>

eng/automation/guardian/source.gdnsuppress

@@ -0,0 +1,157 @@
+{
+  "hydrated": false,
+  "properties": {
+    "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions",
+    "hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance."
+  },
+  "version": "1.0.0",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2023-12-19 01:00:51Z",
+      "lastUpdatedDate": "2023-12-19 01:00:51Z"
+    }
+  },
+  "results": {
+    "2b52868fe039fbd90740afbc18547ee681ff4d31b9e735baf1910f725047c91b": {
+      "signature": "2b52868fe039fbd90740afbc18547ee681ff4d31b9e735baf1910f725047c91b",
+      "alternativeSignatures": [
+        "32b53436aab7fe01be76eeaf55fdc480ae3e288068c975c330204f5214bac1a6"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "c68a8b69a701b249a1f8559a6312f9c84f2ddf6fbe015311e3bcecd1452c3fa8": {
+      "signature": "c68a8b69a701b249a1f8559a6312f9c84f2ddf6fbe015311e3bcecd1452c3fa8",
+      "alternativeSignatures": [
+        "9f3289403408e6061bef02f2797caf0ee33588822d0749fbab6217d53f9b94ad"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "9b093cc0042c0213b961f8dda54e23e465522102c54ce85f260b5c4e976e24b0": {
+      "signature": "9b093cc0042c0213b961f8dda54e23e465522102c54ce85f260b5c4e976e24b0",
+      "alternativeSignatures": [
+        "5d69d137eb65b19f533fb743aefd2e24e8a791fc0cd401176694d67062637c9a"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "30e1cedbc2fa0acb44a51cce387d330b006ae6d03b225703795aed30d4f8ca15": {
+      "signature": "30e1cedbc2fa0acb44a51cce387d330b006ae6d03b225703795aed30d4f8ca15",
+      "alternativeSignatures": [
+        "5d69d137eb65b19f533fb743aefd2e24e8a791fc0cd401176694d67062637c9a"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "a93d8f47d6ed3667a8da9052bb2c3bfda4aa34ad1a364baa67e72598e5c5f0ec": {
+      "signature": "a93d8f47d6ed3667a8da9052bb2c3bfda4aa34ad1a364baa67e72598e5c5f0ec",
+      "alternativeSignatures": [
+        "5d69d137eb65b19f533fb743aefd2e24e8a791fc0cd401176694d67062637c9a"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "ad7d097158e927bb550e7e929040af3c7690f98a898fb1e7d44acb7de74bc236": {
+      "signature": "ad7d097158e927bb550e7e929040af3c7690f98a898fb1e7d44acb7de74bc236",
+      "alternativeSignatures": [
+        "5d69d137eb65b19f533fb743aefd2e24e8a791fc0cd401176694d67062637c9a"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "73fff606a22ef12984983efea617234d0624347dce685ba29580636fbfe21fa9": {
+      "signature": "73fff606a22ef12984983efea617234d0624347dce685ba29580636fbfe21fa9",
+      "alternativeSignatures": [
+        "b8db8607e95111d16e9125b7a15689579e040253897a5559418c3ebf83174931"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "d78e5435e84b69f2d03d73c1fad7d14fc1c699d1d97921bcd98137d849cb90a1": {
+      "signature": "d78e5435e84b69f2d03d73c1fad7d14fc1c699d1d97921bcd98137d849cb90a1",
+      "alternativeSignatures": [
+        "b8db8607e95111d16e9125b7a15689579e040253897a5559418c3ebf83174931"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "df2396825a2e98d82d6abf7b7106987a5613d09d3643410a74f50d51689bfdda": {
+      "signature": "df2396825a2e98d82d6abf7b7106987a5613d09d3643410a74f50d51689bfdda",
+      "alternativeSignatures": [
+        "b759d6fa2abf85fa275dad1dfa965b5ba20f8419a7b6b8b1a4fe1a6abf2e6fb0"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "bedac00ddbef304982dfa919c5d312818ea90512fb54f897ea57911e36f5e0ec": {
+      "signature": "bedac00ddbef304982dfa919c5d312818ea90512fb54f897ea57911e36f5e0ec",
+      "alternativeSignatures": [
+        "b759d6fa2abf85fa275dad1dfa965b5ba20f8419a7b6b8b1a4fe1a6abf2e6fb0"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "90535343707d61f2fe054d504e4d850d8c5b50c6ffc73350e35cf5c487766fcf": {
+      "signature": "90535343707d61f2fe054d504e4d850d8c5b50c6ffc73350e35cf5c487766fcf",
+      "alternativeSignatures": [
+        "aae683218cf322239f79f0abe2647683ed8ebfd5692c73a6eca1c2050c22b131"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "15be33aeb230ab1a9b067b8d49e7f785f06ba31b48a03f3ca560da362f587c9a": {
+      "signature": "15be33aeb230ab1a9b067b8d49e7f785f06ba31b48a03f3ca560da362f587c9a",
+      "alternativeSignatures": [
+        "aae683218cf322239f79f0abe2647683ed8ebfd5692c73a6eca1c2050c22b131"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "bec2d784ae75dca8841b36ab4e65a3a1ef78db105126a282b0905ed4aad9edc0": {
+      "signature": "bec2d784ae75dca8841b36ab4e65a3a1ef78db105126a282b0905ed4aad9edc0",
+      "alternativeSignatures": [
+        "aae683218cf322239f79f0abe2647683ed8ebfd5692c73a6eca1c2050c22b131"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    },
+    "6ac0182599ced04419c0501d9eddd2dc150da498f8495b564d9c7d5288f881ae": {
+      "signature": "6ac0182599ced04419c0501d9eddd2dc150da498f8495b564d9c7d5288f881ae",
+      "alternativeSignatures": [
+        "d957e575f6cc3e6e8a4385fcd0c99eb88a6f7b75af4c75a779a5487c38c00e41"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "createdDate": "2023-12-19 01:00:51Z"
+    }
+  }
+}

eng/automation/guardian/tsaoptions-v2.json

@@ -0,0 +1,11 @@
+{
+    "codebaseName": "dotnet.maui_main",
+    "notificationAliases": [
+        "dotnet-maui-eng@microsoft.com"
+    ],
+    "instanceUrl": "https://devdiv.visualstudio.com/",
+    "projectName": "DevDiv",
+    "areaPath": "DevDiv\\VS Client - Runtime SDKs\\MAUI",
+    "iterationPath": "DevDiv",
+    "allTools": true
+}

eng/pipelines/common/pack.yml

@@ -15,6 +15,10 @@ parameters:
   type: string
   default: 'nuget'
 
+- name: artifactBinaries
+  type: string
+  default: 'pack-binaries'
+
 - name: nugetFolder
   type: string
   default: 'artifacts'
@@ -41,6 +45,7 @@ steps:
         poolName: ${{ parameters.poolName }}
         provisionatorChannel: ${{ parameters.provisionatorChannel }}
         gitHubToken: ${{ parameters.gitHubToken }}
+        skipAndroidImages: true
 
   - ${{ each step in parameters.prepareSteps }}:
     - ${{ each pair in step }}:
@@ -159,3 +164,20 @@ steps:
         PathToPublish: ${{ parameters.checkoutDirectory }}/artifacts/docs-packs
         ArtifactName: xml-docs
 
+    # binaries for compliance scanning
+    - task: CopyFiles@2
+      displayName: 'Copy Binaries Files'
+      condition: succeeded()
+      inputs:
+        Contents: |
+          ${{ parameters.checkoutDirectory }}/src/Controls/src/Nuget/bin/Release/**/*.dll
+        TargetFolder: ${{ parameters.checkoutDirectory }}/binaries
+        flattenFolders: false
+
+    - task: PublishBuildArtifacts@1
+      condition: succeeded()
+      displayName: publish binaries artifacts
+      inputs:
+        PathToPublish: ${{ parameters.checkoutDirectory }}/binaries
+        ArtifactName: ${{ parameters.artifactBinaries }}
+

eng/pipelines/common/provision.yml

@@ -1,13 +1,12 @@
 parameters:
   poolName: ''
   skipXcode: false
-  skipVS: true
   skipProvisioning: $(skipProvisionator)
   skipAndroidSdks: false
+  skipAndroidImages: false
   checkoutDirectory: $(System.DefaultWorkingDirectory)
   provisionatorPath: $(provisionator.path)
   provisionatorXCodePath: $(provisionator.xcode)
-  provisionatorVSPath: $(provisionator.vs)
   provisionatorChannel: 'latest'
   provisionatorExtraArguments: $(provisionator.extraArguments)
   gitHubToken: $(github--pat--vs-mobiletools-engineering-service2)
@@ -49,8 +48,10 @@ steps:
       env:
         PROVISIONATOR_CHANNEL: ${{ parameters.provisionatorChannel }}
         AUTH_TOKEN_COMPONENTS_MAC_IOS_CERTIFICATE_P12: ${{ parameters.certPass }}
-        ${{ if eq(parameters.skipAndroidSdks, 'true') }}:
+        ${{ if eq(parameters.skipAndroidSdks, true) }}:
-          SKIP_ANDROID_API_SDKS: true
+          SKIP_ANDROID_API_SDKS: 'true'
+        ${{ if eq(parameters.skipAndroidImages, true) }}:
+          SKIP_ANDROID_API_IMAGES: 'true'
 
   # Setup JDK Paths (gradle needs it)
   - bash: |
@@ -70,33 +71,6 @@ steps:
     condition: and(succeeded(), eq(variables['Agent.OS'], 'Darwin'))
 
   # Prepare Windows
-  - powershell: |
-      if (-not $(where.exe pwsh)) {
-        $url = "https://github.com/PowerShell/PowerShell/releases/download/v$env:POWERSHELL_VERSION/PowerShell-$env:POWERSHELL_VERSION-win-x64.msi"
-        $output = "$env:TEMP\PowerShell.msi"
-        Remove-Item -Force $output -ErrorAction Ignore
-        Invoke-WebRequest -Uri $url -OutFile $output
-        msiexec.exe /package $output /quiet ADD_EXPLORER_CONTEXT_MENU_OPENPOWERSHELL=1 ENABLE_PSREMOTING=1 REGISTER_MANIFEST=1
-      }
-    displayName: 'Install PowerShell Core'
-    condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
-  - ${{ if ne(parameters.skipVS, 'true') }}:
-    - task: xamops.azdevex.provisionator-task.provisionator@2
-      displayName: 'Provision Visual Studio'
-      condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-      inputs:
-        provisioning_script: ${{ parameters.checkoutDirectory }}/${{ parameters.provisionatorVSPath }}
-        provisioning_extra_args: ${{ parameters.provisionatorExtraArguments }}
-        github_token: ${{ parameters.gitHubToken }}
-      env:
-        PROVISIONATOR_CHANNEL: ${{ parameters.provisionatorChannel }}
-    - pwsh: |
-        $msbuild = "$env:ProgramFiles/Microsoft Visual Studio/2022/Preview/MSBuild/Current/Bin/MSBuild.exe"
-        echo "##vso[task.setvariable variable=MSBUILD_EXE]$msbuild"
-      displayName: 'Setup MSBuild Paths'
-      condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
-
   # Provision Additional Software
   - ${{ if ne(parameters.skipProvisioning, 'true') }}:
     - task: xamops.azdevex.provisionator-task.provisionator@2
@@ -108,6 +82,10 @@ steps:
         github_token: ${{ parameters.gitHubToken }}
       env:
         PROVISIONATOR_CHANNEL: ${{ parameters.provisionatorChannel }}
+        ${{ if eq(parameters.skipAndroidSdks, true) }}:
+          SKIP_ANDROID_API_SDKS: 'true'
+        ${{ if eq(parameters.skipAndroidImages, true) }}:
+          SKIP_ANDROID_API_IMAGES: 'true'
 
   - pwsh: |
       if ($env:JAVA_HOME_11_X64) {

eng/pipelines/common/security-compliance.yml

@@ -1,50 +0,0 @@
-stages:
-  - stage: security_compliance
-    displayName: Security and Compliance checks
-    dependsOn: []
-    jobs:
-    - job: run_policheck_security_compliance
-      displayName: 'Policheck And Credentials Compliance'
-      pool: $(HostedWinVS2019)
-      timeoutInMinutes: 60
-      cancelTimeoutInMinutes: 5
-      steps:
-      - checkout: self
-
-      - template: security/policheck/v1.yml@yaml-templates
-
-      - template: security/xa-static-analysis/v2.yml@yaml-templates
-        parameters:
-          credScanSuppressionsFile: $(System.DefaultWorkingDirectory)\eng\automation\CredScanSuppressions.json
-
-      - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
-        displayName: Run AntiMalware (Defender) Scan
-        condition: succeededOrFailed()
-        inputs:
-          FileDirPath: $(System.DefaultWorkingDirectory)
-          EnableServices: true
-
-      - task: securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@1
-        displayName: Create Security Analysis Report
-        condition: succeededOrFailed()
-        inputs:
-          AllTools: false
-          CredScan: true
-          AntiMalware: true
-          PoliCheck: true
-
-      - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
-        displayName: Publish Security Analysis Logs
-        condition: succeededOrFailed()
-        inputs:
-          ArtifactName: CodeAnalysisLogs
-        
-      - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
-        displayName: Fail Job if Security Issues are Detected
-        condition: succeededOrFailed()
-        inputs:
-          AllTools: false
-          CredScan: true
-          AntiMalware: true
-          PoliCheck: true
-        

eng/pipelines/common/variables.yml

@@ -43,8 +43,6 @@ variables:
   value: 'eng/provisioning/xcode.csx'
 - name: provisionator.path
   value: 'eng/provisioning/provisioning.csx'
-- name: provisionator.vs
-  value: 'eng/provisioning/vs.csx'
 - name: provisionator.extraArguments
   value: '-vvvv'
 - name: DotNet.Dir

eng/pipelines/handlers.yml

@@ -64,6 +64,11 @@ parameters:
   - name: BuildEverything
     type: boolean
     default: false
+
+  - name: RunCompliance
+    type: boolean
+    default: false
+
   - name: BuildConfigurations
     type: object
     default:
@@ -83,6 +88,7 @@ parameters:
         bootsAndroid: $(Android.Pkg)
         bootsMacCatalyst: $(MacCatalyst.Pkg)
         artifact: build-macos
+ 
   - name: PackPlatforms
     type: object
     default:
@@ -215,6 +221,7 @@ stages:
                 poolName: ${{ PackPlatform.poolName }}
                 provisionatorChannel: ${{ parameters.provisionatorChannel }}
                 artifact:  ${{ PackPlatform.artifact }}
+                artifactBinaries: 'pack-binaries'
                 gitHubToken: $(github--pat--vs-mobiletools-engineering-service2)
 
   - stage: samples_net
@@ -275,7 +282,26 @@ stages:
         BuildPlatforms: ${{ parameters.BuildPlatforms }}
 
   - ${{ if eq(variables['System.TeamProject'], 'devdiv') }}:
-    - template: common/security-compliance.yml
     - template: common/localization-handoff.yml                     # Process outgoing strings [Localization Handoff]
     - template: common/localization-handback.yml                    # Process incoming translations and Create PR to main [Localization Handback]
     - template: common/merge-translations-update.yml                # Validating incoming translations strings and merge PR [Localization Handback]
+    - ${{ if or(eq(variables['Build.Reason'], 'Schedule'), parameters.RunCompliance) }}:
+      - template: security/full/v1.yml@yaml-templates
+        parameters:
+          stageDependsOn: 'pack_net'
+          complianceEnabled: true
+          complianceTimeoutInMinutes: 480
+          scanArtifacts: ['pack-binaries']
+          antiMalwareEnabled: true
+          binSkimEnabled: true
+          #binSkimTargetGlob: '$(Build.ArtifactStagingDirectory)\binaries-to-scan\pack-binaries\src\Controls\src\Nuget\bin\Release\net8.0\*.dll'
+          sourceGdnSuppressionFile: $(Build.SourcesDirectory)\eng\automation\guardian\source.gdnsuppress
+          tsaConfigFile: '$(Build.SourcesDirectory)\eng\automation\guardian\tsaoptions-v2.json'
+          policheckExclusionFile: '$(System.DefaultWorkingDirectory)\eng\automation\guardian\PoliCheck.Exclusions.xml' 
+          policheckGdnSuppressionFilesFolder: '$(System.DefaultWorkingDirectory)\eng\automation\guardian'
+          credScanEnabled: true
+          credScanSuppressionFile: '$(System.DefaultWorkingDirectory)\eng\automation\guardian\CredScanSuppressions.json'
+          enableCodeInspector: true
+          apiScanEnabled: true
+          apiScanSoftwareName: 'MAUI'
+          apiScanSoftwareVersionNum: $(Build.BuildNumber)

eng/provisioning/provisioning.csx

@@ -11,7 +11,13 @@ if (IsMac)
 
 string ANDROID_API_SDKS = Environment.GetEnvironmentVariable ("ANDROID_API_SDKS");
 string SKIP_ANDROID_API_SDKS = Environment.GetEnvironmentVariable ("SKIP_ANDROID_API_SDKS");
+string SKIP_ANDROID_API_IMAGES = Environment.GetEnvironmentVariable ("SKIP_ANDROID_API_IMAGES");
 
+
+Console.WriteLine($"LOGGING:");
+Console.WriteLine($"ANDROID_API_SDKS: {ANDROID_API_SDKS}");
+Console.WriteLine($"SKIP_ANDROID_API_SDKS: {SKIP_ANDROID_API_SDKS}");
+Console.WriteLine($"SKIP_ANDROID_API_IMAGES: {SKIP_ANDROID_API_IMAGES}");
 if(String.IsNullOrWhiteSpace(ANDROID_API_SDKS) && String.IsNullOrWhiteSpace(SKIP_ANDROID_API_SDKS))
 {
 	AndroidSdk()
@@ -26,6 +32,11 @@ if(String.IsNullOrWhiteSpace(ANDROID_API_SDKS) && String.IsNullOrWhiteSpace(SKIP
 		.ApiLevel((AndroidApiLevel)31)
 		.ApiLevel((AndroidApiLevel)32)
 		.ApiLevel((AndroidApiLevel)33)
+		.ApiLevel((AndroidApiLevel)34);
+
+	if(string.IsNullOrWhiteSpace(SKIP_ANDROID_API_IMAGES))
+	{
+		AndroidSdk()
 		.VirtualDevice("Android_x64_API23",   (AndroidApiLevel)23, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X)
 		.VirtualDevice("Android_x64_API24",   (AndroidApiLevel)24, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X)
 		.VirtualDevice("Android_x64_API25",   (AndroidApiLevel)25, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X)
@@ -38,27 +49,29 @@ if(String.IsNullOrWhiteSpace(ANDROID_API_SDKS) && String.IsNullOrWhiteSpace(SKIP
 		.VirtualDevice("Android_x64_API32",   (AndroidApiLevel)32, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X)
 		.VirtualDevice("Android_x64_API33",   (AndroidApiLevel)33, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X)
 		.VirtualDevice("Android_x64_API34",   (AndroidApiLevel)34, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.x86_64,    AndroidVirtualDevice.NEXUS_5X);
-		
+	
-		
+		if (IsArm64)
-	if (IsArm64)
+		{
-	{
+			AndroidSdk()
-		AndroidSdk()
+				.VirtualDevice("Android_arm64_API23", (AndroidApiLevel)23, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API23", (AndroidApiLevel)23, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API24", (AndroidApiLevel)24, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API24", (AndroidApiLevel)24, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API25", (AndroidApiLevel)25, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API25", (AndroidApiLevel)25, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API26", (AndroidApiLevel)26, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API26", (AndroidApiLevel)26, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API27", (AndroidApiLevel)27, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API27", (AndroidApiLevel)27, AndroidSystemImageApi.Google,          AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API28", (AndroidApiLevel)28, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API28", (AndroidApiLevel)28, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API29", (AndroidApiLevel)29, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API29", (AndroidApiLevel)29, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API30", (AndroidApiLevel)30, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API30", (AndroidApiLevel)30, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API31", (AndroidApiLevel)31, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API31", (AndroidApiLevel)31, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API32", (AndroidApiLevel)32, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API32", (AndroidApiLevel)32, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API33", (AndroidApiLevel)33, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
-			.VirtualDevice("Android_arm64_API33", (AndroidApiLevel)33, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X)
+				.VirtualDevice("Android_arm64_API34", (AndroidApiLevel)34, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X);
-			.VirtualDevice("Android_arm64_API34", (AndroidApiLevel)34, AndroidSystemImageApi.GooglePlayStore, AndroidSystemImageAbi.ARM64_v8a, AndroidVirtualDevice.NEXUS_5X);
+		}
 	}
 
 	AndroidSdk().SdkManagerPackage ("build-tools;33.0.0");
 }
+
+
 else if(!String.IsNullOrWhiteSpace(ANDROID_API_SDKS))
 {
 

eng/provisioning/vs.csx

@@ -1,4 +0,0 @@
-VisualStudio (VisualStudioChannel.Preview, VisualStudioTier.Enterprise, 17, @"%ProgramFiles%\Microsoft Visual Studio\2022\Preview", true)
-    .Workload (VisualStudioWorkload.ManagedDesktop)
-    .Workload (VisualStudioWorkload.NetCrossPlat)
-    .Workload (VisualStudioWorkload.Universal);

src/Compatibility/ControlGallery/src/Core/GalleryPages/EditableList.cs

@@ -11,7 +11,7 @@ namespace Microsoft.Maui.Controls.ControlGallery
 		{
 			Messages = new ObservableCollection<MessageViewModel>(Enumerable.Range(0, messagesCount).Select(i =>
 			{
-				return new MessageViewModel { Subject = "Subject Line " + i, MessagePreview = "Lorem ipsum dolorem monkeys bonkers " + i };
+				return new MessageViewModel { Subject = "Subject Line " + i, MessagePreview = "Lorem ipsum dolorem monkeys" + i };
 			}));
 
 			MessagingCenter.Subscribe<MessageViewModel, MessageViewModel>(this, "DeleteMessage", (vm, vm2) =>

src/Compatibility/Core/src/iOS/CollectionView/ItemsViewController.cs

@@ -48,7 +48,7 @@ namespace Microsoft.Maui.Controls.Compatibility.Platform.iOS
 
 			if (_initialized)
 			{
-				// Reload the data so the currently visible cells get laid out according to the new layout
+				// Reload the data so the currently visible cells are arranged in accordance with the updated layout configuration.
 				CollectionView.ReloadData();
 			}
 		}

src/Controls/src/Core/Compatibility/Handlers/Shell/Android/ShellContentFragment.cs

@@ -112,7 +112,7 @@ namespace Microsoft.Maui.Controls.Platform.Compatibility
 
 			// This is very strange what we are about to do. For whatever reason if you take this animation
 			// and wrap it into an animation set it will have a 1 frame glitch at the start where the
-			// fragment shows at the final position. That sucks. So instead we reach into the returned
+			// fragment shows at the final position. So instead we reach into the returned
 			// set and hook up to the first item. This means any animation we use depends on the first item
 			// finishing at the end of the animation.