[release/v7.5] Split TPN manifest and Component Governance manifest by adityapatwardhan · Pull Request #26967 · PowerShell/PowerShell

adityapatwardhan · 2026-03-09T21:32:21Z

Backport of #26891 to release/v7.5

Triggered by @adityapatwardhan on behalf of @TravisEz13

Original CL Label: CL-BuildPackaging

/cc @PowerShell/powershell-maintainers

Impact

REQUIRED: Choose either Tooling Impact or Customer Impact (or both). At least one checkbox must be selected.

Tooling Impact

Required tooling change
Optional tooling change (include reasoning)

Splits cgmanifest.json into tools/cgmanifest/main/ and tools/cgmanifest/tpn/ directories. Updates CI and build scripts to reference the new paths. Adds ClearlyDefined cache persistence and Find-LastHarvestedVersion.ps1 script.

Customer Impact

Customer reported
Found internally

Regression

REQUIRED: Check exactly one box.

Yes
No

This is not a regression.

Testing

Existing CI tests cover the cgmanifest paths. Build packaging pipelines will validate the new manifest locations.

Risk

REQUIRED: Check exactly one box.

High
Medium
Low

This is a file reorganization of the cgmanifest into separate TPN and CG manifests plus addition of ClearlyDefined cache and version-finding tooling. No runtime behavior changes.

Merge Conflicts

48 version-number conflicts in tools/cgmanifest/main/cgmanifest.json resolved by keeping the release/v7.5 package versions (ours) since master has newer .NET 10 versions not applicable to v7.5.

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Backport to release/v7.5 that reorganizes component governance manifests into separate main and TPN manifests, and extends the ClearlyDefined tooling to better handle harvesting and caching while updating CI/build references to the new paths.

Changes:

Split cgmanifest.json into tools/cgmanifest/main/cgmanifest.json and tools/cgmanifest/tpn/cgmanifest.json, and updated scripts/pipelines to use the new locations.
Enhanced ClearlyDefined tooling with cache persistence utilities and version-search helpers (plus a new Find-LastHarvestedVersion.ps1 helper).
Updated notice generation to scan the TPN manifest directory and adjusted .vsts-ci/* path filters for the new cgmanifest layout.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`tools/packaging/packaging.psm1`	Updates packaging logic to reference the new main CG manifest path.
`tools/findMissingNotices.ps1`	Adds TPN-manifest generation logic and a `-ForceHarvestedOnly` mode using ClearlyDefined harvest status.
`tools/clearlyDefined/src/ClearlyDefined/ClearlyDefined.psm1`	Adds cache persistence + search/version helper functions; adjusts harvesting and cache TTL behavior.
`tools/clearlyDefined/Find-LastHarvestedVersion.ps1`	New helper to find the last harvested version via ClearlyDefined (with NuGet fallback).
`tools/clearlyDefined/ClearlyDefined.ps1`	Points validation/harvest script at the new main CG manifest path.
`tools/cgmanifest/tpn/cgmanifest.json`	Adds the TPN-specific component list manifest.
`tools/cgmanifest/main/cgmanifest.json`	Adds the main component governance manifest.
`.vsts-ci/windows-arm64.yml`	Updates PR path filtering for cgmanifest changes.
`.vsts-ci/psresourceget-acr.yml`	Updates PR path filtering for cgmanifest changes.
`.vsts-ci/mac.yml`	Updates PR path filtering for cgmanifest changes.
`.vsts-ci/linux-internal.yml`	Updates PR path filtering for cgmanifest changes.
`.pipelines/templates/compliance/generateNotice.yml`	Targets Component Detection at the TPN manifest directory.

Copilot · 2026-03-09T21:36:59Z

tools/findMissingNotices.ps1

+    # Build a lookup table of harvest status by package name + version
+    $harvestStatus = @{}
+    foreach ($item in $fullList) {
+        $key = "$($item.Name)|$($item.PackageVersion)"
+        $harvestStatus[$key] = $item.harvested
+    }


Get-ClearlyDefinedData returns the raw ClearlyDefined definition object (with added cachedTime/harvested/harvestedResult) which includes coordinates.name and coordinates.revision, not Name/PackageVersion. Building the harvest-status key from $item.Name and $item.PackageVersion will end up using empty keys and misclassify everything as unharvested. Use $item.coordinates.name + $item.coordinates.revision (or add explicit Name/PackageVersion properties in Get-ClearlyDefinedData).

Copilot · 2026-03-09T21:36:59Z

tools/findMissingNotices.ps1

+    foreach ($item in $finalHarvestData) {
+        $matchingNewRegistration = $newRegistrations | Where-Object {
+            $_.Component.Nuget.Name -eq $item.Name -and
+            $_.Component.Nuget.Version -eq $item.PackageVersion
+        }


$item.Name / $item.PackageVersion are used to match registrations, but those properties are not present on the objects output by Get-ClearlyDefinedData (package name/version are under $item.coordinates.name and $item.coordinates.revision). As written, $matchingNewRegistration will never match and the TPN manifest update loop will produce incorrect/empty output.

Copilot · 2026-03-09T21:36:59Z

tools/findMissingNotices.ps1

+    if ($needHarvest.Count -gt 0) {
+        Write-Verbose "Found $($needHarvest.Count) packages that need harvesting. Starting harvest..." -Verbose
+        $needHarvest | Select-Object -ExpandProperty coordinates | ConvertFrom-ClearlyDefinedCoordinates | Start-ClearlyDefinedHarvest


ConvertFrom-ClearlyDefinedCoordinates expects a coordinate string (e.g. nuget/nuget/-/Name/Version), but Get-ClearlyDefinedData returns a definition object whose .coordinates property is a structured object. Piping Select -ExpandProperty coordinates | ConvertFrom-ClearlyDefinedCoordinates will fail (or produce wrong results). Start-ClearlyDefinedHarvest can bind directly from the .coordinates object (type/name/revision).

Copilot · 2026-03-09T21:37:00Z

tools/clearlyDefined/src/ClearlyDefined/ClearlyDefined.psm1

+        Start-job -ScriptBlock {
+            Invoke-WebRequest -Method Post  -Uri 'https://api.clearlydefined.io/harvest' -Body $using:body -ContentType 'application/json' -MaximumRetryCount $using:maxRetryCount -RetryIntervalSec $using:retryIntervalSec
+        }


Start-ClearlyDefinedHarvest now starts a background job and returns immediately. In non-interactive script execution (CI), the PowerShell session can exit before jobs run/complete, meaning harvest requests may never be sent; it can also spawn an unbounded number of jobs when harvesting many packages. Consider keeping the synchronous Invoke-WebRequest (or add throttled async execution with Wait-Job/Receive-Job and proper cleanup) to preserve the function’s behavior and reliability.

Copilot · 2026-03-09T21:37:00Z

.vsts-ci/windows-arm64.yml

    - .github/ISSUE_TEMPLATE/*
    - .vsts-ci/misc-analysis.yml
-    - tools/cgmanifest.json
+    - tools/cgmanifest/*


Azure Pipelines path filters treat * as a single path segment; tools/cgmanifest/* likely won’t match nested paths like tools/cgmanifest/main/cgmanifest.json. If the intent is to exclude all cgmanifest changes, this should be tools/cgmanifest/** so changes under main/ and tpn/ are covered.

Copilot · 2026-03-09T21:37:00Z

.vsts-ci/psresourceget-acr.yml

    - .github/workflows/*
    - .vsts-ci/misc-analysis.yml
-    - tools/cgmanifest.json
+    - tools/cgmanifest/*


Azure Pipelines path filters treat * as a single path segment; tools/cgmanifest/* likely won’t match nested paths like tools/cgmanifest/main/cgmanifest.json. If the intent is to exclude all cgmanifest changes, this should be tools/cgmanifest/** so changes under main/ and tpn/ are covered.

Copilot · 2026-03-09T21:37:00Z

.vsts-ci/mac.yml

    - .vsts-ci/windows.yml
    - .vsts-ci/windows/*
-    - tools/cgmanifest.json
+    - tools/cgmanifest/*


Azure Pipelines path filters treat * as a single path segment; tools/cgmanifest/* likely won’t match nested paths like tools/cgmanifest/main/cgmanifest.json. If the intent is to exclude all cgmanifest changes, this should be tools/cgmanifest/** so changes under main/ and tpn/ are covered.

Copilot · 2026-03-09T21:37:01Z

.vsts-ci/linux-internal.yml

    - .vsts-ci/windows.yml
    - .vsts-ci/windows/*
-    - tools/cgmanifest.json
+    - tools/cgmanifest/*


Azure Pipelines path filters treat * as a single path segment; tools/cgmanifest/* likely won’t match nested paths like tools/cgmanifest/main/cgmanifest.json. If the intent is to exclude all cgmanifest changes, this should be tools/cgmanifest/** so changes under main/ and tpn/ are covered.

Split TPN manifest and Component Governance manifest (PowerShell#26891)

92645a5

Co-authored-by: Copilot <[email protected]>

adityapatwardhan requested a review from a team as a code owner March 9, 2026 21:32

Copilot AI review requested due to automatic review settings March 9, 2026 21:32

adityapatwardhan added the CL-BuildPackaging Indicates that a PR should be marked as a build or packaging change in the Change Log label Mar 9, 2026

Copilot started reviewing on behalf of adityapatwardhan March 9, 2026 21:32 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

daxian-dbw approved these changes Mar 9, 2026

View reviewed changes

adityapatwardhan merged commit d4d5585 into PowerShell:release/v7.5 Mar 9, 2026
42 checks passed

adityapatwardhan deleted the backport/release/v7.5/26891-6e2b4c784 branch March 9, 2026 23:21

daxian-dbw mentioned this pull request Mar 10, 2026

[release/v7.6] Split TPN manifest and Component Governance manifest #26978

Merged

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release/v7.5] Split TPN manifest and Component Governance manifest#26967

[release/v7.5] Split TPN manifest and Component Governance manifest#26967
adityapatwardhan merged 1 commit intoPowerShell:release/v7.5from
adityapatwardhan:backport/release/v7.5/26891-6e2b4c784

adityapatwardhan commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

adityapatwardhan commented Mar 9, 2026

Impact

Tooling Impact

Customer Impact

Regression

Testing

Risk

Merge Conflicts

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants