[mthalman]

Backport of dotnet/dotnet#5607

Resolves this error:

    /vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data.
    /vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json.
        0 Warning(s)

Example build

[Copilot]

Pull request overview

Backports a source-build change to prevent NuGet Audit from attempting to reach nuget.org during offline/blocked CI restores by removing blocked entries from the auditSources section in generated NuGet.config files.

Changes:

• Opt-in specific repo-project builds (xdt, nuget-client) to remove blocked audit sources via RemoveBlockedAuditSources=true.
• Add and wire up a new MSBuild task (RemoveBlockedAuditSourcesFromNuGetConfig) into the UpdateNuGetConfig pipeline.
• Introduce the new task implementation under Microsoft.DotNet.UnifiedBuild.Tasks.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/SourceBuild/content/repo-projects/xdt.proj	Enables RemoveBlockedAuditSources for xdt source-build project.
src/SourceBuild/content/repo-projects/nuget-client.proj	Enables RemoveBlockedAuditSources for nuget-client source-build project.
src/SourceBuild/content/repo-projects/Directory.Build.targets	Registers and invokes the new task during UpdateNuGetConfig.
src/SourceBuild/content/eng/tools/tasks/Microsoft.DotNet.UnifiedBuild.Tasks/RemoveBlockedAuditSourcesFromNuGetConfig.cs	Implements XML edit to remove blocked entries from auditSources.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.