Standardize NuGet restore and channel-update policy across AppHosts

.github/workflows/run-tests.yml

@@ -48,6 +48,7 @@ on:
         default: false
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -324,6 +325,14 @@ jobs:
           echo "TEST_PROJECT_PATH=$projectPath" >> $env:GITHUB_ENV
           echo "TEST_ASSEMBLY_NAME=$filenameWithoutExtension" >> $env:GITHUB_ENV
 
+      - name: Configure CLI test NuGet service index
+        shell: pwsh
+        run: |
+          if ($env:TEST_ASSEMBLY_NAME -eq 'Aspire.Cli.Tests') {
+            "ASPIRE_CLI_NUGET_SERVICE_INDEX=https://packagefeedproxy.microsoft.io/nuget/v3/index.json" |
+              Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          }
+
       - name: Build test project
         if: ${{ fromJson(inputs.properties).requiresNugets != true }}
         run: >

.github/workflows/specialized-test-runner.yml

@@ -80,33 +80,48 @@ jobs:
 
       - name: Inject enablePlaywrightInstall into runsheet properties
         id: inject_properties
+        env:
+          RUNSHEET: ${{ steps.generate_tests_matrix_raw.outputs.runsheet }}
+          ENABLE_PLAYWRIGHT_INSTALL: ${{ inputs.enablePlaywrightInstall }}
         run: |
-          RUNSHEET='${{ steps.generate_tests_matrix_raw.outputs.runsheet }}'
           if [ "$RUNSHEET" = "[]" ] || [ -z "$RUNSHEET" ]; then
-            echo "runsheet=[]" >> $GITHUB_OUTPUT
+            echo "runsheet=[]" >> "$GITHUB_OUTPUT"
           else
-            UPDATED=$(echo "$RUNSHEET" | jq -c --argjson epw ${{ inputs.enablePlaywrightInstall }} '[.[] | .properties.enablePlaywrightInstall = $epw]')
-            echo "runsheet=$UPDATED" >> $GITHUB_OUTPUT
+            UPDATED=$(printf '%s\n' "$RUNSHEET" | jq -c --argjson epw "$ENABLE_PLAYWRIGHT_INSTALL" '[.[] | .properties.enablePlaywrightInstall = $epw]')
+            echo "runsheet=$UPDATED" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Check if any test requires NuGets
         id: check_nugets
+        env:
+          RUNSHEET: ${{ steps.inject_properties.outputs.runsheet }}
         run: |
-          RUNSHEET='${{ steps.inject_properties.outputs.runsheet }}'
-          if echo "$RUNSHEET" | jq -e 'any(.[]; .properties.requiresNugets == true)' > /dev/null 2>&1; then
-            echo "requiresNugets=true" >> $GITHUB_OUTPUT
+          if printf '%s\n' "$RUNSHEET" | jq -e 'any(.[]; .properties.requiresNugets == true)' > /dev/null 2>&1; then
+            echo "requiresNugets=true" >> "$GITHUB_OUTPUT"
           else
-            echo "requiresNugets=false" >> $GITHUB_OUTPUT
+            echo "requiresNugets=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Check if any test requires CLI archives
         id: check_cli_archive
+        env:
+          RUNSHEET: ${{ steps.inject_properties.outputs.runsheet }}
+        run: |
+          if printf '%s\n' "$RUNSHEET" | jq -e 'any(.[]; .properties.requiresCliArchive == true)' > /dev/null 2>&1; then
+            echo "requiresCliArchive=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "requiresCliArchive=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Check if any test requires GitHub token
+        id: check_github_token
+        env:
+          RUNSHEET: ${{ steps.inject_properties.outputs.runsheet }}
         run: |
-          RUNSHEET='${{ steps.inject_properties.outputs.runsheet }}'
-          if echo "$RUNSHEET" | jq -e 'any(.[]; .properties.requiresCliArchive == true)' > /dev/null 2>&1; then
-            echo "requiresCliArchive=true" >> $GITHUB_OUTPUT
+          if printf '%s\n' "$RUNSHEET" | jq -e 'any(.[]; .properties.requiresGitHubToken == true)' > /dev/null 2>&1; then
+            echo "requiresGitHubToken=true" >> "$GITHUB_OUTPUT"
           else
-            echo "requiresCliArchive=false" >> $GITHUB_OUTPUT
+            echo "requiresGitHubToken=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Upload logs, and test results
@@ -160,6 +175,7 @@ jobs:
       }}
     uses: ./.github/workflows/run-tests.yml
     permissions:
+      actions: read
       contents: read
     with:
       testShortName: ${{ matrix.tests.project }}

.github/workflows/tests-outerloop.yml

@@ -42,6 +42,7 @@ jobs:
     if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
     permissions:
+      actions: read
       contents: read
     with:
       testRunnerName: "OuterloopTestRunsheetBuilder"

.github/workflows/tests-quarantine.yml

@@ -42,6 +42,7 @@ jobs:
     if: ${{ github.repository == 'microsoft/aspire' }}
     uses: ./.github/workflows/specialized-test-runner.yml
     permissions:
+      actions: read
       contents: read
     with:
       testRunnerName: "QuarantinedTestRunsheetBuilder"

docs/contributing.md

@@ -111,6 +111,12 @@ To test changes from a specific pull request locally, see [dogfooding-pull-reque
 
 To validate how the CLI resolves `Aspire.*` packages for **staging** and **stable** release-branch builds (including making an installed PR build behave like a staging build), see [cli-staging-validation.md](/docs/cli-staging-validation.md).
 
+### NuGet configuration in CLI unit tests
+
+Use `NuGetTestHelper.CreateClient()` or `CreateService()` for tests that compose real NuGet configuration, and `NuGetTestHelper.LoadSettings()` for native settings assertions. These helpers preserve directory-level configuration inheritance while replacing the runner's user-wide settings with a controlled baseline and excluding machine-wide settings by default. Supply `TestMachineWideSettings` explicitly when testing machine-wide policy.
+
+`TemporaryWorkspace.CreateForCli()` isolates Aspire settings, not NuGet settings. Do not change process-wide environment variables to isolate NuGet configuration in parallel tests.
+
 ## Coding Agents
 
 Aspire uses GitHub Copilot automatic code review on pull requests. We expect Copilot review comments to be reviewed and addressed before merging, either by making the requested change or by explaining why a suggested change is not needed.

docs/specs/cli-identity-sidecar.md

@@ -85,14 +85,16 @@ The CLI exposes the override on demand via a small API on `CliExecutionContext`:
 public string? NuGetServiceIndexOverride { get; }
 ```
 
-Call sites that today emit `api.nuget.org` directly (`NuGetConfigMerger`, `TemplateNuGetConfigService`, etc.) consult this property; when it returns non-null, the emitted config carries the override URL. When null, the existing canonical URL is used. This is the bytes-side half of the identity story tracked separately in #17823; the API and the sidecar/env plumbing land **now** so that #17823's proxy work has a stable consumer surface to slot into.
+Source-override policy composition consults this property when it needs a fallback source: a non-null value selects the override URL, while null selects the canonical URL. Shared configuration writing materializes the composed policy for temporary overlays and persisted template configuration. Existing ambient source definitions are not rewritten.
 
 #### `packages`
 
 The `packages` field points the CLI at a **flat directory of `.nupkg` files** (for example `artifacts/packages/Release/Shipping`). When set, the CLI synthesizes a package channel — named after the resolved identity channel — that maps `Aspire*` package globs to this directory (everything else resolves from nuget.org). This synthesized channel **replaces** any same-named built-in, discovered-hive, or PR-install channel, so the CLI resolves Aspire packages from the directory while still presenting the emulated channel/version/commit identity. It is exposed on `CliExecutionContext` as `IdentityPackagesDirectory` (a `DirectoryInfo?`, null when no override is active) — distinct from the existing `PackagesDirectory`, which is the restore cache.
 
 This lets a locally built CLI test against packages it just built (or against a PR's CI-built packages staged into a directory) without copying them into a hive. It pairs with `ASPIRE_CLI_CHANNEL` for the "PR build identity + locally built packages" and "released repro with a CLI+hosting fix spanning packages" scenarios (see the `cli-channel-debugging` skill for the full matrix).
 
+For an existing C# AppHost, an unqualified `aspire update` uses current native NuGet configuration and does not enumerate identity or hive feeds. Applying a synthesized package channel requires an explicit `--channel` or legacy `--quality` option; feeds are persisted only when the desired policy differs. See [shared policy previews and .NET persistence](polyglot-integration-restore.md#shared-policy-previews-and-net-persistence).
+
 **Cleanliness guardrail (fail-fast).** A flat directory has no "latest stable vs latest prerelease" semantics: if the same `Aspire*` package id appears with more than one version, NuGet would silently resolve the highest and mask the intended version. The CLI therefore **fails fast** at channel-resolution time when the directory is missing, or when any `Aspire*` package id carries more than one distinct version anywhere under the directory (the check recurses, matching how local package discovery walks subdirectories), with a diagnostic listing the conflicting ids and versions (e.g. `Aspire.Hosting (13.4.1, 13.4.2)`). Only `Aspire*` packages are checked because the synthesized channel only routes those to the directory. This is intentional friction — `localhive.sh` accumulates auto-versioned builds in `Shipping`, so the directory must be cleaned (or freshly packed) before it can be used as an override.
 
 ### Resolution order