Fix GPG and central package management tests locally and on Helix

[akoeplinger]

SignTool's DEB and RPM integrity tests assumed GPG was unavailable on every non-Linux platform. Probe GPG availability with Process.Run while preserving the production Windows verification bypass.

CentralPackageManagementTests was failing locally because the repository-wide SwixBuild PackageVersion overlapped with an implicit reference in the Arcade SDK. Moving version 1.1.922 into the Workloads test project as a project-local PackageVersion fixes that failure while preserving the test toolset dependency.

This failure escaped Helix coverage because the CPM guard silently returned when it could not find a repository checkout. Copy Directory.Packages.props and SDK tools props/targets into the test payload and always check those inputs, so Helix now exercises the guard too. Fail explicitly for missing, empty, or unreadable required inputs instead of silently passing.

Validation: SignTool suite passed (189 passed, 12 skipped); CPM guard passed; Workloads tests passed on macOS (2 passed, 25 skipped), resolving SwixBuild 1.1.922. An isolated payload outside the checkout passed and correctly failed with an injected conflict or missing package file. Windows SWIX integration and a live Helix run were not performed.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
Copilot-Session: 9f27e529-3921-42bd-9a9b-4932badf6b59

[Copilot]

🟡 Changes recommended

The new GPG probe uses Process.Run(...), which is not defined in the repo/BCL and will fail to compile without adjustment.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates Arcade’s test suites to better reflect real-world environments (local and Helix), particularly around GPG-based package integrity verification and Central Package Management (CPM) guard coverage.

Changes:

• Probe GPG availability at runtime to decide whether DEB/RPM signature verification can run (while preserving the Windows bypass).
• Move the SwixBuild version pin from repo-wide CPM into the Workloads test project to avoid CPM/implicit-reference conflicts.
• Make CPM guard tests runnable on Helix by shipping required inputs in the test payload and asserting the inputs are present/non-empty.

File summaries

File	Description
src/Microsoft.DotNet.SignTool.Tests/SignToolTests.cs	Add GPG availability probing and adjust expected signing behavior accordingly.
src/Microsoft.DotNet.Build.Tasks.Workloads.Tests/Microsoft.DotNet.Build.Tasks.Workloads.Tests.csproj	Pin SwixBuild version locally in the test project.
src/Microsoft.DotNet.Arcade.Sdk.Tests/Microsoft.DotNet.Arcade.Sdk.Tests.csproj	Include CPM guard inputs (Directory.Packages.props + SDK tools props/targets) in test output for Helix.
src/Microsoft.DotNet.Arcade.Sdk.Tests/CentralPackageManagementTests.cs	Run CPM guard using shipped inputs and fail when required inputs are missing/empty.
Directory.Packages.props	Remove repo-wide SwixBuild PackageVersion entry.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[joeloff]

If Arcade can move forward to the 1.1.922 build, the workload tests can start using the same version I think.

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped to tests and package versioning inputs, and the updated logic aligns with the stated goal of exercising the checks both locally and on Helix.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite