[main] Update dependencies from dotnet/arcade

eng/Version.Details.props

@@ -6,7 +6,7 @@ This file should be imported by eng/Versions.props
 <Project>
   <PropertyGroup>
     <!-- dotnet-arcade dependencies -->
-    <MicrosoftDotNetArcadeSdkPackageVersion>12.0.0-beta.26469.3</MicrosoftDotNetArcadeSdkPackageVersion>
+    <MicrosoftDotNetArcadeSdkPackageVersion>12.0.0-beta.26502.2</MicrosoftDotNetArcadeSdkPackageVersion>
     <!-- dotnet-msbuild dependencies -->
     <MicrosoftBuildPackageVersion>18.12.0-1.26468.2</MicrosoftBuildPackageVersion>
     <MicrosoftBuildFrameworkPackageVersion>18.12.0-1.26468.2</MicrosoftBuildFrameworkPackageVersion>

eng/Version.Details.xml

@@ -82,9 +82,9 @@
     </Dependency>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="12.0.0-beta.26469.3">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="12.0.0-beta.26502.2">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>63c79a28ca6e086d59c5553e7ed69cacb1d52fbd</Sha>
+      <Sha>967466cae9ae41a6b61431f772d1de23aff20f43</Sha>
     </Dependency>
     <Dependency Name="optimization.windows_nt-x64.MIBC.Runtime" Version="1.0.0-prerelease.26465.1">
       <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-optimization</Uri>

eng/common/core-templates/job/helix-job-monitor.yml

@@ -63,7 +63,7 @@ parameters:
   type: boolean
   default: false
 
-# Azure service connection ID authorized for Helix. Required when
+# Workload identity federation service connection name authorized for Helix. Required when
 # useEntraAuthentication is true.
 - name: azureSubscription
   type: string
@@ -94,13 +94,12 @@ parameters:
   type: boolean
   default: false
 
-# When true, test results are reported to Azure DevOps using the fully qualified test name
-# (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
-# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display;
-# primarily useful for frameworks like MSTest whose display name is only the method name.
+# When true (the default), test results are reported to Azure DevOps using the fully qualified test
+# name (Namespace.Type.Method) as the stable automatedTestName and the visible title is qualified as
+# well (--use-fully-qualified-test-name). Set to false to preserve framework-provided display names.
 - name: useFullyQualifiedTestName
   type: boolean
-  default: false
+  default: true
 
 # Controls per-test output attachments. Defaults to Failed.
 - name: testResultAttachmentMode
@@ -136,6 +135,20 @@ jobs:
   displayName: Monitor Helix Jobs
   timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
   continueOnError: ${{ parameters.continueOnError }}
+  variables:
+    HELIX_MONITOR_BASE_URI: ${{ parameters.helixBaseUri }}
+    HELIX_MONITOR_USE_ENTRA_AUTHENTICATION: ${{ parameters.useEntraAuthentication }}
+    HELIX_MONITOR_POLLING_INTERVAL_SECONDS: ${{ parameters.pollingIntervalSeconds }}
+    HELIX_MONITOR_FAIL_ON_FAILED_TESTS: ${{ parameters.failWorkItemsWithFailedTests }}
+    HELIX_MONITOR_ALLOW_NO_HELIX_JOBS: ${{ parameters.allowNoHelixJobs }}
+    HELIX_MONITOR_USE_FULLY_QUALIFIED_TEST_NAME: ${{ parameters.useFullyQualifiedTestName }}
+    HELIX_MONITOR_TIMEOUT_IN_MINUTES: ${{ parameters.timeoutInMinutes }}
+    HELIX_MONITOR_TEST_RESULT_UPLOAD_PARALLELISM: ${{ parameters.testResultUploadParallelism }}
+    HELIX_MONITOR_ORGANIZATION: ${{ parameters.organization }}
+    HELIX_MONITOR_REPOSITORY: ${{ parameters.repository }}
+    HELIX_MONITOR_TEST_RESULT_ATTACHMENT_MODE: ${{ parameters.testResultAttachmentMode }}
+    HELIX_MONITOR_TOOL_NUPKG_ARTIFACT_NAME: ${{ parameters.toolNupkgArtifactName }}
+    HELIX_MONITOR_TOOL_COMMAND: ${{ parameters.toolCommand }}
   ${{ if ne(length(parameters.dependsOn), 0) }}:
     dependsOn: ${{ parameters.dependsOn }}
   ${{ if ne(parameters.condition, '') }}:
@@ -157,22 +170,6 @@ jobs:
     - pwsh: throw "azureSubscription must be set when useEntraAuthentication is true."
       displayName: Validate Helix Entra authentication
 
-  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
-    - task: AzureCLI@2
-      displayName: Initialize Helix Entra authentication
-      inputs:
-        azureSubscription: ${{ parameters.azureSubscription }}
-        addSpnToEnvironment: true
-        scriptType: pscore
-        scriptLocation: inlineScript
-        inlineScript: |
-          if ([string]::IsNullOrWhiteSpace($env:servicePrincipalId) -or [string]::IsNullOrWhiteSpace($env:tenantId)) {
-            throw "The Helix Azure service connection did not provide a service principal or tenant ID."
-          }
-
-          Write-Host "##vso[task.setvariable variable=HelixEntraClientId]$env:servicePrincipalId"
-          Write-Host "##vso[task.setvariable variable=HelixEntraTenantId]$env:tenantId"
-
   - ${{ if ne(parameters.toolNupkgArtifactName, '') }}:
     - task: DownloadPipelineArtifact@2
       displayName: Download Helix Job Monitor artifact
@@ -241,76 +238,26 @@ jobs:
     - bash: ./eng/common/dotnet.sh tool restore
       displayName: Restore Helix Job Monitor
 
-  - bash: |
-      set -euo pipefail
-
-      toolArgs=(
-        --helix-base-uri              '${{ parameters.helixBaseUri }}'
-        --use-entra-authentication    '${{ parameters.useEntraAuthentication }}'
-        --polling-interval-seconds    '${{ parameters.pollingIntervalSeconds }}'
-        --fail-on-failed-tests        '${{ parameters.failWorkItemsWithFailedTests }}'
-        --allow-no-helix-jobs         '${{ parameters.allowNoHelixJobs }}'
-        --use-fully-qualified-test-name '${{ parameters.useFullyQualifiedTestName }}'
-        --max-wait-minutes            "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully.
-        --stage-name                  '$(System.StageName)'
-        --stage-attempt               '$(System.StageAttempt)'
-        --job-attempt                 '$(System.JobAttempt)'
-        --test-result-upload-parallelism '${{ parameters.testResultUploadParallelism }}'
-      )
-
-      organization='${{ parameters.organization }}'
-      repository='${{ parameters.repository }}'
-      testResultAttachmentMode='${{ parameters.testResultAttachmentMode }}'
-
-      # Fall back to Azure DevOps-provided environment variables when the caller did not
-      # supply organization / repository explicitly. BUILD_REPOSITORY_NAME is typically
-      # 'owner/repo' for GitHub-backed builds and 'owner-repo' for internal builds.
-      if [ -z "$organization" ] || [ -z "$repository" ]; then
-        buildRepoName="${BUILD_REPOSITORY_NAME:-}"
-        if [ -n "$buildRepoName" ] && [[ "$buildRepoName" == */* ]]; then
-          repoOwner="${buildRepoName%%/*}"
-          repoName="${buildRepoName#*/}"
-        elif [ -n "$buildRepoName" ] && [[ "$buildRepoName" == *-* ]]; then
-          repoOwner="${buildRepoName%%-*}"
-          repoName="${buildRepoName#*-}"
-        fi
-
-        if [ -n "${repoOwner:-}" ] && [ -n "${repoName:-}" ]; then
-          if [ -z "$organization" ]; then organization="$repoOwner"; fi
-          if [ -z "$repository" ];   then repository="$repoName";   fi
-        fi
-      fi
-
-      if [ -n "$organization" ]; then toolArgs+=( --organization "$organization" ); fi
-      if [ -n "$repository" ];   then toolArgs+=( --repository   "$repository" );   fi
-      if [ -n "$testResultAttachmentMode" ]; then
-        toolArgs+=( --test-result-attachment-mode "$testResultAttachmentMode" )
-      fi
-
-      # Build.Reason and Build.SourceBranch are required to derive the Helix source filter
-      # the same way the Helix SDK submitter does (PR -> 'pr', internal -> 'official',
-      # otherwise -> 'ci'). Without these, manually-queued / scheduled / CI builds would
-      # be looked up under the wrong source prefix and find zero jobs.
-      toolArgs+=( --build-reason  "$(Build.Reason)" )
-      toolArgs+=( --source-branch "$(Build.SourceBranch)" )
-
-      if [ -n '${{ parameters.toolNupkgArtifactName }}' ]; then
-        # Tool was installed from a local nupkg; run the DLL via the repo-local dotnet.
-        export DOTNET_ROOT="$(Build.SourcesDirectory)/.dotnet"
-        ./eng/common/dotnet.sh exec "$(HelixJobMonitorDll)" "${toolArgs[@]}"
-      else
-        # Tool was restored from the local .config/dotnet-tools.json manifest; invoke it
-        # through the manifest from the repo root.
-        pushd "$BUILD_SOURCESDIRECTORY" > /dev/null
-        trap 'popd > /dev/null' EXIT
-        ./eng/common/dotnet.sh tool run '${{ parameters.toolCommand }}' -- "${toolArgs[@]}"
-      fi
-    displayName: Monitor Helix Jobs
-    env:
-      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-      ${{ if eq(parameters.useEntraAuthentication, false) }}:
+  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
+    - task: AzureCLI@2
+      displayName: Monitor Helix Jobs
+      inputs:
+        azureSubscription: ${{ parameters.azureSubscription }}
+        keepAzSessionActive: true
+        scriptType: bash
+        scriptLocation: inlineScript
+        inlineScript: |
+          set -euo pipefail
+
+          # AzureCLI@2 replaces SYSTEM_ACCESSTOKEN with the service connection token.
+          export SYSTEM_ACCESSTOKEN="$HELIX_AZDO_ACCESSTOKEN"
+          bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      env:
+        HELIX_AZDO_ACCESSTOKEN: $(System.AccessToken)
+
+  - ${{ if eq(parameters.useEntraAuthentication, false) }}:
+    - bash: bash "$BUILD_SOURCESDIRECTORY/eng/common/run-helix-job-monitor.sh"
+      displayName: Monitor Helix Jobs
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
         HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
-      ${{ if eq(parameters.useEntraAuthentication, true) }}:
-        AZURESUBSCRIPTION_CLIENT_ID: $(HelixEntraClientId)
-        AZURESUBSCRIPTION_TENANT_ID: $(HelixEntraTenantId)
-        AZURESUBSCRIPTION_SERVICE_CONNECTION_ID: ${{ parameters.azureSubscription }}

eng/common/core-templates/stages/renovate.yml

@@ -60,7 +60,7 @@ parameters:
 
 # Renovate version used in the container image tag.
 - name: renovateVersion
-  default: 43
+  default: 44
   type: number
 
 # Pool configuration for SDL analysis.