From f3f2d31c7e47867b5a81c110847718366dd30237 Mon Sep 17 00:00:00 2001
From: Sakshi Sharma <sakshishar@microsoft.com>
Date: Wed, 26 Aug 2026 16:43:48 +0530
Subject: [PATCH 1/5] Fix GitHub static test package restore

Pin Windows App SDK 2.4.0 and restore the private WinMD verifier only for non-fork validations.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../WinUI-RunStaticTests-Job.yml              | 24 ++++++++++++-------
 build/WinUI-GitHub-PR.yml                     |  2 +-
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
index 0878b33e12..0b580f8313 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
@@ -31,26 +31,26 @@ jobs:
       gci env:* | sort-object name
     displayName: Display build machine environment variable
 
-  # Authenticate to NuGet feeds used by this pipeline (WinUI.Dependencies has nuget.org as an upstream source,
-  # so public releases are available through it without direct nuget.org access)
+  # Fork PRs must not authenticate to private package feeds.
   - task: NuGetAuthenticate@1
-    displayName: 'NuGet Authenticate'
+    displayName: 'Authenticate to WinUI.Dependencies'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
 
   # In this pipeline configuration, 'NuGetCommand' is ambiguous so the specific task guid must be used instead
   # See known NuGet task issue notes.
-  # The latest public release is resolved via the WinUI.Dependencies feed (which has nuget.org as an upstream)
-  # The package is installed into a temp directory to ensure it doesn't get used elsewhere for a build
+  # The pinned public release is installed into a temp directory to ensure it isn't used elsewhere for a build.
   - task: NuGetCommand@2
-    displayName: 'NuGet install Microsoft.WindowsAppSDK'
+    displayName: 'NuGet install Microsoft.WindowsAppSDK 2.4.0'
     inputs:
       command: 'custom'
-      arguments: 'install Microsoft.WindowsAppSDK -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config'
+      arguments: 'install Microsoft.WindowsAppSDK -Version 2.4.0 -DependencyVersion Lowest -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config -NonInteractive'
 
   - task: NuGetCommand@2
-    displayName: 'NuGet install WinMDVersionVerifyLcr'
+    displayName: 'NuGet install WinMDVersionVerifyLcr 1.0.2'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
     inputs:
       command: 'custom'
-      arguments: 'install WinMDVersionVerifyLcr -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config'
+      arguments: 'install WinMDVersionVerifyLcr -Version 1.0.2 -DependencyVersion Ignore -Source "$(WinUILKGDependenciesFeedUri)" -OutputDirectory $(packagesDir) -NonInteractive'
 
   - template: WinUI-DownloadPipelineArtifacts-Steps.yml
     parameters:
@@ -61,8 +61,14 @@ jobs:
 
   - task: powershell@2
     displayName: 'Run WinMD Compat Test'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
     inputs:
       targetType: filePath
       filePath: $(Build.SourcesDirectory)\build\PipelineScripts\VerifyWinMDCompat.ps1
       arguments: -WinMDPath '$(artifactsDir)\packaging\Release\lib\uap10.0' -PackagesDirectory '$(packagesDir)' -isRelease:$${{ parameters.MUXFinalRelease }}
       pwsh: true
+
+  - powershell: |
+      Write-Host "WinMD compatibility validation is not available for fork PRs."
+    displayName: 'Skip WinMD compatibility validation'
+    condition: and(succeeded(), eq(variables['System.PullRequest.IsFork'], 'True'))
diff --git a/build/WinUI-GitHub-PR.yml b/build/WinUI-GitHub-PR.yml
index a34c066768..299d2b9a85 100644
--- a/build/WinUI-GitHub-PR.yml
+++ b/build/WinUI-GitHub-PR.yml
@@ -176,7 +176,7 @@ extends:
           failOnTestFailure: false
 
     - ${{ if eq(parameters.runFullValidation, true) }}:
-      - template: build\AzurePipelinesTemplates\WinUI-RunStaticTests-Stage.yml@WinUIInternal
+      - template: AzurePipelinesTemplates\WinUI-RunStaticTests-Stage.yml
         parameters:
           MUXFinalRelease: ${{ parameters.MUXFinalRelease }}
 

From debf11af5e2981ab915769929a6bcc4e050103d0 Mon Sep 17 00:00:00 2001
From: Sakshi Sharma <sakshishar@microsoft.com>
Date: Wed, 26 Aug 2026 17:52:38 +0530
Subject: [PATCH 2/5] Make Windows App SDK version configurable

Preserve latest-version behavior by default while allowing static-test callers to select a specific version.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../WinUI-RunStaticTests-Job.yml                      | 11 ++++++++---
 .../WinUI-RunStaticTests-Stage.yml                    |  4 +++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
index 0b580f8313..56ad0595c7 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
@@ -4,6 +4,7 @@ parameters:
   runTestJobName: 'RunStaticTests'
   dependsOn: ''
   MUXFinalRelease: false
+  windowsAppSdkVersion: 'latest'
 
 jobs:
 - job: ${{ parameters.runTestJobName }}
@@ -18,6 +19,10 @@ jobs:
     ob_outputDirectory: '$(Build.SourcesDirectory)\out'
     ob_sdl_codeSignValidation_excludes: '-|packaging\**;-|**\Test\**;-|**\Taef\**;-|**\TestDependencies\**;-|**\Microsoft.Internal.FrameworkUdk.dll'
     ob_sdl_prefast_enabled: false   # this job does no native build
+    ${{ if ne(parameters.windowsAppSdkVersion, 'latest') }}:
+      windowsAppSdkVersionArgument: '-Version ${{ parameters.windowsAppSdkVersion }}'
+    ${{ else }}:
+      windowsAppSdkVersionArgument: ''
 
   steps:
   # This is a temporarily workaround to avoid getting non-fatal "folder C:\__t\NativeCompilerPrefast not found"
@@ -38,12 +43,12 @@ jobs:
 
   # In this pipeline configuration, 'NuGetCommand' is ambiguous so the specific task guid must be used instead
   # See known NuGet task issue notes.
-  # The pinned public release is installed into a temp directory to ensure it isn't used elsewhere for a build.
+  # Install the latest public release by default, or the version supplied by the caller.
   - task: NuGetCommand@2
-    displayName: 'NuGet install Microsoft.WindowsAppSDK 2.4.0'
+    displayName: 'NuGet install Microsoft.WindowsAppSDK'
     inputs:
       command: 'custom'
-      arguments: 'install Microsoft.WindowsAppSDK -Version 2.4.0 -DependencyVersion Lowest -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config -NonInteractive'
+      arguments: 'install Microsoft.WindowsAppSDK $(windowsAppSdkVersionArgument) -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config -NonInteractive'
 
   - task: NuGetCommand@2
     displayName: 'NuGet install WinMDVersionVerifyLcr 1.0.2'
diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
index 4b34401330..446182137a 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
@@ -2,6 +2,7 @@
 # Licensed under the MIT License.
 parameters:
   MUXFinalRelease: false
+  windowsAppSdkVersion: 'latest'
 
 stages:
 - stage: RunStaticTests
@@ -12,4 +13,5 @@ stages:
   - template: WinUI-RunStaticTests-Job.yml
     parameters:
       runTestJobName: RunStaticTests
-      MUXFinalRelease: ${{ parameters.MUXFinalRelease }}
\ No newline at end of file
+      MUXFinalRelease: ${{ parameters.MUXFinalRelease }}
+      windowsAppSdkVersion: ${{ parameters.windowsAppSdkVersion }}
\ No newline at end of file

From 309cf34d2f3b7e1a74263f14f0ca21d614088552 Mon Sep 17 00:00:00 2001
From: Sakshi Sharma <sakshishar@microsoft.com>
Date: Wed, 26 Aug 2026 23:13:24 +0530
Subject: [PATCH 3/5] Load internal feed variables for static tests

Make the protected WinUI dependencies feed URI available to the GitHub static-test stage.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
index 446182137a..f3e3562748 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
@@ -9,6 +9,8 @@ stages:
   displayName: Run Static Tests Stage
   dependsOn: Build
   condition: not(failed())
+  variables:
+  - group: WinUI-InternalFeed
   jobs:
   - template: WinUI-RunStaticTests-Job.yml
     parameters:

From fc446bdab2cc8b380a03f10997acbe2cc9626491 Mon Sep 17 00:00:00 2001
From: Sakshi Sharma <sakshishar@microsoft.com>
Date: Thu, 27 Aug 2026 09:13:43 +0530
Subject: [PATCH 4/5] Download WinMD verifier from Azure Artifacts

Use the native package download task and pass the verifier version directly to the compatibility script.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../WinUI-RunStaticTests-Job.yml                  | 15 ++++++++++-----
 .../WinUI-RunStaticTests-Stage.yml                |  2 --
 build/PipelineScripts/VerifyWinMDCompat.ps1       | 13 ++++++++++++-
 3 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
index 56ad0595c7..e246db3fe7 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
@@ -16,6 +16,7 @@ jobs:
   variables:
     artifactsDir: $(Build.SourcesDirectory)\Artifacts
     packagesDir: $(Agent.TempDirectory)\WinUI-RunStaticTests-Job\packages
+    winMDVersionVerifyLcrVersion: '1.0.2'
     ob_outputDirectory: '$(Build.SourcesDirectory)\out'
     ob_sdl_codeSignValidation_excludes: '-|packaging\**;-|**\Test\**;-|**\Taef\**;-|**\TestDependencies\**;-|**\Microsoft.Internal.FrameworkUdk.dll'
     ob_sdl_prefast_enabled: false   # this job does no native build
@@ -50,12 +51,16 @@ jobs:
       command: 'custom'
       arguments: 'install Microsoft.WindowsAppSDK $(windowsAppSdkVersionArgument) -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config -NonInteractive'
 
-  - task: NuGetCommand@2
-    displayName: 'NuGet install WinMDVersionVerifyLcr 1.0.2'
+  - task: DownloadPackage@1
+    displayName: 'Download WinMDVersionVerifyLcr $(winMDVersionVerifyLcrVersion)'
     condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
     inputs:
-      command: 'custom'
-      arguments: 'install WinMDVersionVerifyLcr -Version 1.0.2 -DependencyVersion Ignore -Source "$(WinUILKGDependenciesFeedUri)" -OutputDirectory $(packagesDir) -NonInteractive'
+      packageType: 'nuget'
+      feed: 'WinUI.Dependencies'
+      definition: 'WinMDVersionVerifyLcr'
+      version: '$(winMDVersionVerifyLcrVersion)'
+      extract: true
+      downloadPath: '$(packagesDir)\WinMDVersionVerifyLcr\$(winMDVersionVerifyLcrVersion)'
 
   - template: WinUI-DownloadPipelineArtifacts-Steps.yml
     parameters:
@@ -70,7 +75,7 @@ jobs:
     inputs:
       targetType: filePath
       filePath: $(Build.SourcesDirectory)\build\PipelineScripts\VerifyWinMDCompat.ps1
-      arguments: -WinMDPath '$(artifactsDir)\packaging\Release\lib\uap10.0' -PackagesDirectory '$(packagesDir)' -isRelease:$${{ parameters.MUXFinalRelease }}
+      arguments: -WinMDPath '$(artifactsDir)\packaging\Release\lib\uap10.0' -PackagesDirectory '$(packagesDir)' -WinMDVersionVerifyLcrVersion '$(winMDVersionVerifyLcrVersion)' -isRelease:$${{ parameters.MUXFinalRelease }}
       pwsh: true
 
   - powershell: |
diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
index f3e3562748..446182137a 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
@@ -9,8 +9,6 @@ stages:
   displayName: Run Static Tests Stage
   dependsOn: Build
   condition: not(failed())
-  variables:
-  - group: WinUI-InternalFeed
   jobs:
   - template: WinUI-RunStaticTests-Job.yml
     parameters:
diff --git a/build/PipelineScripts/VerifyWinMDCompat.ps1 b/build/PipelineScripts/VerifyWinMDCompat.ps1
index 273d6c3296..f6c113a578 100644
--- a/build/PipelineScripts/VerifyWinMDCompat.ps1
+++ b/build/PipelineScripts/VerifyWinMDCompat.ps1
@@ -10,6 +10,8 @@ param(
     [Parameter(Mandatory = $false)]
     [string]$WinAppSDKWinUIVersion = "",
     [Parameter(Mandatory = $false)]
+    [string]$WinMDVersionVerifyLcrVersion = "",
+    [Parameter(Mandatory = $false)]
     [bool]$isRelease = $false
 )
 
@@ -108,7 +110,16 @@ if (-not $env:BUILD_BUILDID)
     $nugetResultCode = $?
 }
 
-$WinMDVersionVerifyLcrVersionToUse = Get-LatestVersion "WinMDVersionVerifyLcr"
+if ($WinMDVersionVerifyLcrVersion)
+{
+    $WinMDVersionVerifyLcrVersionToUse = $WinMDVersionVerifyLcrVersion
+    Write-Host "Specific WinMDVersionVerifyLcr version specified: $WinMDVersionVerifyLcrVersionToUse"
+}
+else
+{
+    $WinMDVersionVerifyLcrVersionToUse = Get-LatestVersion "WinMDVersionVerifyLcr"
+}
+
 $winMDVersionVerifyLcrPath = [System.IO.Path]::Combine($PackagesDirectory, "WinMDVersionVerifyLcr", $WinMDVersionVerifyLcrVersionToUse, "WinMDVersionVerifyLcr.exe")
 if (-not (Test-Path $winMDVersionVerifyLcrPath))
 {

From b5b19f249dea09101167698ca1ccd3f456e08b53 Mon Sep 17 00:00:00 2001
From: Sakshi Sharma <sakshishar@microsoft.com>
Date: Thu, 27 Aug 2026 15:49:25 +0530
Subject: [PATCH 5/5] Use latest WinMD verifier package

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: f090face-2019-4029-b63e-6bfaee25f47e
---
 build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
index e246db3fe7..22be524ee2 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
@@ -16,7 +16,7 @@ jobs:
   variables:
     artifactsDir: $(Build.SourcesDirectory)\Artifacts
     packagesDir: $(Agent.TempDirectory)\WinUI-RunStaticTests-Job\packages
-    winMDVersionVerifyLcrVersion: '1.0.2'
+    winMDVersionVerifyLcrVersion: 'latest'
     ob_outputDirectory: '$(Build.SourcesDirectory)\out'
     ob_sdl_codeSignValidation_excludes: '-|packaging\**;-|**\Test\**;-|**\Taef\**;-|**\TestDependencies\**;-|**\Microsoft.Internal.FrameworkUdk.dll'
     ob_sdl_prefast_enabled: false   # this job does no native build