From aaf44aada5e0d5fe85047de68e84137eeb95015a Mon Sep 17 00:00:00 2001
From: "Jason Williams (Xbox)" <jaswill@microsoft.com>
Date: Thu, 14 May 2026 13:44:55 -0700
Subject: [PATCH] Fix CI builds: pin exact SDK version, add locked-mode restore

- Change global.json rollForward from 'latestPatch' to 'disable' to
  prevent implicit package version drift that breaks locked-mode restore.
- Add pr trigger for main branch to build-pipeline.yml.
- Update dotnet.yml and codeql.yml GitHub Actions to use global.json
  instead of floating 10.0.x, and add --locked-mode to restore.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .azurePipelines/build-pipeline.yml | 5 +++++
 .github/workflows/codeql.yml       | 4 ++--
 .github/workflows/dotnet.yml       | 4 ++--
 global.json                        | 2 +-
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.azurePipelines/build-pipeline.yml b/.azurePipelines/build-pipeline.yml
index 476309ac..7012c667 100644
--- a/.azurePipelines/build-pipeline.yml
+++ b/.azurePipelines/build-pipeline.yml
@@ -1,5 +1,10 @@
 trigger: none
 
+pr:
+  branches:
+    include:
+      - main
+
 parameters:
   - name: Version
     default: '1.0.0'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 95c9af9f..1d6cd53b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -73,10 +73,10 @@ jobs:
 
     - uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: '10.0.x'
+        global-json-file: global.json
 
     - name: Restore dependencies
-      run: dotnet restore src/PackageUploader.sln
+      run: dotnet restore src/PackageUploader.sln --locked-mode
 
     - name: Build solution
       run: dotnet build src/PackageUploader.sln --configuration Release --no-restore
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 8545d477..5ff93eca 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -19,9 +19,9 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
-        dotnet-version: 10.0.x
+        global-json-file: global.json
     - name: Restore dependencies
-      run: dotnet restore
+      run: dotnet restore --locked-mode
       working-directory: ./src
     - name: Build
       run: dotnet build --no-restore
diff --git a/global.json b/global.json
index 4e3d13c6..fbae32fd 100644
--- a/global.json
+++ b/global.json
@@ -1,7 +1,7 @@
 {
     "sdk": {
         "version": "10.0.203",
-        "rollForward": "latestPatch"
+        "rollForward": "disable"
     },
     "test": {
         "runner": "Microsoft.Testing.Platform"