2026-01-07T11:52:26.9300720Z ##[section]Starting: Component Detection (auto-injected by policy)
2026-01-07T11:52:26.9308431Z ==============================================================================
2026-01-07T11:52:26.9308564Z Task         : Component Governance Detection
2026-01-07T11:52:26.9308648Z Description  : Include with your build to enable automatic Component Governance detection.
2026-01-07T11:52:26.9308764Z Version      : 0.2521216.1
2026-01-07T11:52:26.9308837Z Author       : Microsoft Corporation
2026-01-07T11:52:26.9308924Z Help         : Please try our [support bot](http://aka.ms/1esbot?service=cg) for questions and troubleshooting. See http://aka.ms/cgdocs for more information or reach out using the guidance at https://aka.ms/cg-support if you run into problems with this task.
2026-01-07T11:52:26.9309135Z ==============================================================================
2026-01-07T11:52:27.5661278Z Loading task manifest...
2026-01-07T11:52:27.5705455Z Component Detection starting up...
2026-01-07T11:52:27.5866781Z ##[info]Telemetry ID: 39c475f3-7d91-43a3-93f2-45d2ebb66389
2026-01-07T11:52:27.8328966Z ##[debug]No configuration based pilots for AutoInjection are eligible for this build. Querying piloting API...
2026-01-07T11:52:27.8330773Z ##[info]Looking for pipeline eligiblity for AutoInjection in Piloting Service...
2026-01-07T11:52:27.8905874Z ##[debug]CG URL: https://governance.dev.azure.com/dnceng-public/_apis/componentgovernance
2026-01-07T11:52:27.9567888Z ##[debug]Retrieved Governance.AutoInjectionPipelineRollout service based piloting status: "false"
2026-01-07T11:52:27.9569360Z ##[debug]AutoInjection piloting service result: {"eligibleForPilot":false,"servicePilotResponse":false}
2026-01-07T11:52:27.9571206Z ##[info]Looking for pipeline information in Product Catalog...
2026-01-07T11:52:27.9897819Z ##[debug]Checking for Component Governance Policy in GitOps...
2026-01-07T11:52:28.0379432Z ##[debug]CG URL: https://governance.dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_apis/componentgovernance
2026-01-07T11:52:28.0381398Z ##[info]GitHub hostname 'github.com' is not enabled for policy retrieval.
2026-01-07T11:52:28.0381843Z ##[debug]Component Governance Policy not found from Gitops. Scanning source branch for the Policy File...
2026-01-07T11:52:28.0386530Z ##[debug]searching for policy file in path: [D:\a\_work\1\s\.azuredevops\policies\open_source_security_pr_policy.yml]
2026-01-07T11:52:28.0388111Z ##[debug]Policy file does not exist at path: D:\a\_work\1\s\.azuredevops\policies\open_source_security_pr_policy.yml
2026-01-07T11:52:28.0389172Z ##[info]Evaluating Branch...
2026-01-07T11:52:28.0389573Z ##[info]SourceBranch: refs/heads/main
2026-01-07T11:52:28.0395958Z ##[info]DefaultBranch: refs/heads/main
2026-01-07T11:52:28.0398229Z ##[info]Result: Will Scan. Reason: SourceBranch equals DefaultBranch. Default branches are automatically scanned.
2026-01-07T11:52:28.0406770Z Starting scan for open source vulnerabilities
2026-01-07T11:52:28.0409361Z OS Platform: win32
2026-01-07T11:52:28.0409637Z OS Architecture: x64
2026-01-07T11:52:28.0409877Z OS Version:  10.0.20348
2026-01-07T11:52:28.0410345Z Node Version: v20.19.4
2026-01-07T11:52:28.1648887Z Retrieving component detection tool.
2026-01-07T11:52:29.1334631Z Decompressing file D:\a\_work\_tasks\ComponentGovernanceComponentDetection_f2f0881f-4b99-4a1c-80ea-f5b13fd6cec4\0.2521216.1\ComponentDetectionNative\component-detection-win-x64.zip to D:\a\_work\_tasks\ComponentGovernanceComponentDetection_f2f0881f-4b99-4a1c-80ea-f5b13fd6cec4\0.2521216.1\ComponentDetectionNative\component-detection-win-x64
2026-01-07T11:52:30.0818971Z Finished retrieving component detection tool successfully.
2026-01-07T11:52:30.0819944Z Running self-contained version of Component Detection with version v0.2.63.
2026-01-07T11:52:30.0833044Z Governed Repository ProjectId: undefined
2026-01-07T11:52:30.0839429Z No directory exclusion patterns specified
2026-01-07T11:52:30.0857110Z No docker output file was found
2026-01-07T11:52:30.0859988Z Default timeout of 600 seconds will be used.
2026-01-07T11:52:30.0860368Z Skipping pip report due to invalid PIP_INDEX_URL.
2026-01-07T11:52:30.0867284Z Default max threads of 5 will be used. You may override this by setting ComponentDetection.MaxDetectionThreads.
2026-01-07T11:52:30.0913611Z [command]D:\a\_work\_tasks\ComponentGovernanceComponentDetection_f2f0881f-4b99-4a1c-80ea-f5b13fd6cec4\0.2521216.1\ComponentDetectionNative\component-detection-win-x64\component-detection-win-x64\win-x64\ComponentDetector.exe detect --LogLevel Verbose --Output D:\a\_work\1\a --CorrelationId 39c475f3-7d91-43a3-93f2-45d2ebb66389 --RecordProdTelemetry --SourceDirectory D:\a\_work\1 --SourceFileRoot D:\a\_work\1\s --Url https://governance.dev.azure.com/dnceng-public/ --BuildIdentifier 1245670 --BuildDisplayType maui-pr-devicetests --AutoInjected --Timeout 600 --MaxDetectionThreads 5 --AlertWarningLevel High --BuildTaskInput eyJzY2FuVHlwZSI6IlJlZ2lzdGVyIiwiYXV0b0luamVjdGVkIjoidHJ1ZSIsIndoYXRpZiI6ImZhbHNlIiwidXNlRGVmYXVsdERldGVjdG9ycyI6InRydWUiLCJ2ZXJib3NpdHkiOiJWZXJib3NlIiwic291cmNlU2NhblBhdGgiOiJEOlxcYVxcX3dvcmtcXDEiLCJhbGVydFdhcm5pbmdMZXZlbCI6IkhpZ2giLCJmYWlsT25BbGVydCI6ImZhbHNlIiwibGVnYWN5SW5qZWN0aW9uIjoiVHJ1ZSJ9 --RequestorVsid b1abc09f-39bc-6992-b094-654236ad30e8 --ScanType Register --TaskVersion 0.2521216.1 --TakeSnapshot --IsBuildTaskRequest --BuildType vsts://6fcc92e5-73a7-4f88-8d13-d9045b45fb27/cbb18261-c48f-4abb-8651-8cdcb5474649/314/a261511a-7c1f-5c79-dac5-f0d7e2d65ddf --BuildDisplayIdentifier 10.0.30-ci+azdo.1245670 --SourceType github://dotnet/maui/main --BuildProjectId cbb18261-c48f-4abb-8651-8cdcb5474649 --RepoProjectId None --SourceDisplayType main --SourceIdentifier a6e9730b11c09baacab650c28e4844240009cea9 --SourceDisplayIdentifier a6e9730b --PhaseDisplayName "Run DeviceTests Android (Mono)"
2026-01-07T11:52:30.4556682Z ##[debug]Gradle dev-only lockfiles 
2026-01-07T11:52:30.4558595Z ##[debug]Gradle dev-only configurations 
2026-01-07T11:52:30.5952984Z Run correlation id: "39c475f3-7d91-43a3-93f2-45d2ebb66389"
2026-01-07T11:52:30.5953448Z Log file: D:\a\_work\1\a\GovCompDisc_Log_20260107115230365_1348.log
2026-01-07T11:52:30.6032565Z Manifest file: D:\a\_work\1\a\GovCompDisc_Manifest_20260107115230374.json
2026-01-07T11:52:30.6033141Z Metadata file: D:\a\_work\1\a\GovCompDisc_Metadata_20260107115230374.json
2026-01-07T11:52:30.6146947Z ##[debug]Finished applying restrictions to detectors.
2026-01-07T11:52:30.6167097Z Finding components...
2026-01-07T11:52:30.6235244Z ##[debug]Removing NewPipDetector from active experiments
2026-01-07T11:52:30.6283226Z ##[debug]Setting CocoaPods process detector timeout to 595 seconds.
2026-01-07T11:52:30.6309966Z ##[debug]Setting DotNet process detector timeout to 595 seconds.
2026-01-07T11:52:30.6310745Z ##[debug]Setting Go process detector timeout to 595 seconds.
2026-01-07T11:52:30.6311574Z ##[debug]Setting Gradle process detector timeout to 595 seconds.
2026-01-07T11:52:30.6312840Z ##[debug]Setting Ivy process detector timeout to 235 seconds.
2026-01-07T11:52:30.6366349Z ##[debug]Logging patterns ivy.xml for D:\a\_work\1
2026-01-07T11:52:30.6366763Z ##[debug]Logging patterns *.lockfile for D:\a\_work\1
2026-01-07T11:52:30.6367630Z ##[debug]Logging patterns project.assets.json for D:\a\_work\1
2026-01-07T11:52:30.6368000Z ##[debug]Logging patterns go.mod:go.sum for D:\a\_work\1
2026-01-07T11:52:30.6368356Z ##[debug]Logging patterns Podfile.lock for D:\a\_work\1
2026-01-07T11:52:30.6489116Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Gradle.GradleComponentDetector
2026-01-07T11:52:30.6489904Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Ivy.IvyDetector
2026-01-07T11:52:30.6490550Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.DotNet.DotNetComponentDetector
2026-01-07T11:52:30.6491034Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Go.GoComponentDetector
2026-01-07T11:52:30.6491453Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.CocoaPods.PodComponentDetector
2026-01-07T11:52:30.6682548Z ##[debug]Setting Linux process detector timeout to 595 seconds.
2026-01-07T11:52:30.6683655Z ##[debug]Setting LinuxApplicationLayer process detector timeout to 235 seconds.
2026-01-07T11:52:30.6684333Z Starting enumeration of D:\a\_work\1
2026-01-07T11:52:30.6703168Z No instructions received to scan container images.
2026-01-07T11:52:30.6703830Z No instructions received to scan container images.
2026-01-07T11:52:30.7555190Z ##[debug]Removing CorextV2Detector from active experiments
2026-01-07T11:52:30.7557116Z ##[debug]Adding 0 Components from Linux to Control Group for LinuxApplicationLayer
2026-01-07T11:52:30.7558012Z ##[debug]Adding 0 Components from LinuxApplicationLayer to Experiment Group for LinuxApplicationLayer
2026-01-07T11:52:30.7558593Z ##[debug]Setting MvnCli process detector timeout to 595 seconds.
2026-01-07T11:52:30.7565322Z ##[debug]Setting Npm process detector timeout to 595 seconds.
2026-01-07T11:52:30.7570424Z ##[debug]Setting NpmWithRoots process detector timeout to 595 seconds.
2026-01-07T11:52:30.7571155Z ##[debug]Setting NpmLockfile3 process detector timeout to 595 seconds.
2026-01-07T11:52:30.7571589Z ##[debug]Setting NuGet process detector timeout to 595 seconds.
2026-01-07T11:52:30.7587363Z ##[debug]Setting NuGetPackagesConfig process detector timeout to 595 seconds.
2026-01-07T11:52:30.7588085Z ##[debug]Setting NuGetProjectCentric process detector timeout to 595 seconds.
2026-01-07T11:52:30.7588701Z ##[debug]Setting PipReport process detector timeout to 595 seconds.
2026-01-07T11:52:30.7589281Z ##[debug]Setting Pnpm process detector timeout to 595 seconds.
2026-01-07T11:52:30.7589937Z ##[debug]Setting Poetry process detector timeout to 235 seconds.
2026-01-07T11:52:30.7590481Z ##[debug]Logging patterns poetry.lock for D:\a\_work\1
2026-01-07T11:52:30.7591075Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Poetry.PoetryComponentDetector
2026-01-07T11:52:30.7603148Z ##[debug]Setting Ruby process detector timeout to 595 seconds.
2026-01-07T11:52:30.7603899Z ##[debug]Setting RustSbom process detector timeout to 595 seconds.
2026-01-07T11:52:30.7604503Z ##[debug]Setting Vcpkg process detector timeout to 595 seconds.
2026-01-07T11:52:30.7605070Z ##[debug]Setting Yarn process detector timeout to 595 seconds.
2026-01-07T11:52:30.7605606Z ##[debug]Setting UvLock process detector timeout to 235 seconds.
2026-01-07T11:52:30.7606172Z ##[debug]Logging patterns uv.lock for D:\a\_work\1
2026-01-07T11:52:30.7606805Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Uv.UvLockComponentDetector
2026-01-07T11:52:30.7607478Z ##[debug]Setting CgManifest process detector timeout to 595 seconds.
2026-01-07T11:52:30.7608111Z ##[debug]Setting Conda process detector timeout to 235 seconds.
2026-01-07T11:52:30.7608775Z ##[debug]Logging patterns environment.yml:environment.yaml for D:\a\_work\1
2026-01-07T11:52:30.7609492Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.CondaComponentDetector
2026-01-07T11:52:30.8714687Z ##[debug]Setting CorextCG process detector timeout to 595 seconds.
2026-01-07T11:52:30.8720849Z ##[debug]Setting CorextV2CG process detector timeout to 235 seconds.
2026-01-07T11:52:30.8726095Z ##[debug]Logging patterns officePackageList.json:packageList.inc:packageList.lst:*.csproj:*.proj:*.props:*.targets:*.vcxproj for D:\a\_work\1
2026-01-07T11:52:30.8737671Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.CorextV2ComponentDetector
2026-01-07T11:52:30.8791654Z ##[debug]Setting Maven process detector timeout to 595 seconds.
2026-01-07T11:52:30.8832401Z ##[debug]Setting NuGetCentralPackageManagement process detector timeout to 595 seconds.
2026-01-07T11:52:31.2216897Z Enumerated 33797 files and 5159 directories in "00:00:00.5525599"
2026-01-07T11:52:31.2301237Z Skipping corext csproj processing because no Corext Config files or manifest found
2026-01-07T11:52:31.2374764Z ##[debug]Adding 0 Components from UvLock to Experiment Group for UvLockDetectorExperiment
2026-01-07T11:52:31.9002090Z ##[debug]Logging patterns pom.xml for D:\a\_work\1
2026-01-07T11:52:31.9003742Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Maven.MvnCliComponentDetector
2026-01-07T11:52:32.7950889Z ##[debug]Logging patterns package.json for D:\a\_work\1
2026-01-07T11:52:32.7962242Z ##[debug]Logging patterns package-lock.json:npm-shrinkwrap.json:lerna.json for D:\a\_work\1
2026-01-07T11:52:32.7963242Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Npm.NpmComponentDetectorWithRoots
2026-01-07T11:52:32.7965606Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Npm.NpmComponentDetector
2026-01-07T11:52:32.8007121Z ##[debug]Adding 0 Components from Npm to Control Group for LinuxApplicationLayer
2026-01-07T11:52:32.8244185Z ##[debug]Adding 0 Components from NpmWithRoots to Control Group for LinuxApplicationLayer
2026-01-07T11:52:32.8245227Z ##[debug]Logging patterns package-lock.json:npm-shrinkwrap.json:lerna.json for D:\a\_work\1
2026-01-07T11:52:32.8245858Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Npm.NpmLockfile3Detector
2026-01-07T11:52:32.8258604Z ##[debug]Logging patterns *.nupkg:*.nuspec:nuget.config:paket.lock for D:\a\_work\1
2026-01-07T11:52:32.8259075Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.NuGet.NuGetComponentDetector
2026-01-07T11:52:32.8376394Z ##[debug]Logging patterns packages.config for D:\a\_work\1
2026-01-07T11:52:32.8379422Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.NuGet.NuGetPackagesConfigDetector
2026-01-07T11:52:32.8380597Z ##[debug]Adding 0 Components from NpmLockfile3 to Control Group for LinuxApplicationLayer
2026-01-07T11:52:32.8381139Z ##[debug]Logging patterns project.assets.json for D:\a\_work\1
2026-01-07T11:52:32.8382256Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.NuGet.NuGetProjectModelProjectCentricComponentDetector
2026-01-07T11:52:32.8866424Z ##[debug]Logging patterns setup.py:requirements.txt for D:\a\_work\1
2026-01-07T11:52:32.8867413Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Pip.PipReportComponentDetector
2026-01-07T11:52:32.8867875Z Version '$version$' from D:\a\_work\1\s\src\Compatibility\Core\src\iOS\Xamarin.Forms.Platform.iOS.nuspec could not be parsed as a NuGet version
2026-01-07T11:52:32.8868359Z ##[debug]Logging patterns shrinkwrap.yaml:pnpm-lock.yaml for D:\a\_work\1
2026-01-07T11:52:32.8868742Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Pnpm.PnpmComponentDetectorFactory
2026-01-07T11:52:32.8869238Z ##[warning]Lock file D:\a\_work\1\s\artifacts\tmp\Debug\Microsoft.DotNet.XHarness.CLI\10.0.0-prerelease.25575.2\.store\microsoft.dotnet.xharness.cli\10.0.0-prerelease.25575.2\project.assets.json does not contain a PackageSpec.
2026-01-07T11:52:32.8906695Z ##[debug]Logging patterns Gemfile.lock for D:\a\_work\1
2026-01-07T11:52:32.8907172Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Ruby.RubyComponentDetector
2026-01-07T11:52:32.9063682Z ##[debug]Logging patterns Cargo.toml:Cargo.lock:*.cargo-sbom.json for D:\a\_work\1
2026-01-07T11:52:32.9066115Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Rust.RustSbomDetector
2026-01-07T11:52:32.9067697Z Preparing Rust component detection
2026-01-07T11:52:32.9068107Z ##[debug]Logging patterns vcpkg.spdx.json:manifest-info.json for D:\a\_work\1
2026-01-07T11:52:32.9068827Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Vcpkg.VcpkgComponentDetector
2026-01-07T11:52:32.9212511Z Detection mode: "FALLBACK"
2026-01-07T11:52:32.9216339Z No Cargo.toml files found; ownership and metadata cache unavailable
2026-01-07T11:52:32.9246877Z FALLBACK mode: Processing 0 Cargo.toml/Cargo.lock files
2026-01-07T11:52:32.9260620Z ##[debug]Logging patterns yarn.lock for D:\a\_work\1
2026-01-07T11:52:32.9262228Z ##[debug]Registered Microsoft.ComponentDetection.Detectors.Yarn.YarnLockComponentDetector
2026-01-07T11:52:32.9282065Z ##[debug]Logging patterns cgmanifest.json for D:\a\_work\1
2026-01-07T11:52:32.9282529Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.ComponentManifestComponentDetector
2026-01-07T11:52:32.9371106Z ##[debug]Logging patterns packageList.lst:officePackageList.json:*.csproj:packageList.inc for D:\a\_work\1
2026-01-07T11:52:32.9372258Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.CorextComponentDetector
2026-01-07T11:52:32.9431062Z Discovered cg manifest file at: D:\a\_work\1\s\src\Templates\src\cgmanifest.json
2026-01-07T11:52:32.9549241Z Skipping corext csproj processing because no Corext Config files or manifest found
2026-01-07T11:52:32.9551175Z ##[debug]Logging patterns pom.xml for D:\a\_work\1
2026-01-07T11:52:32.9551841Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.MavenComponentDetector
2026-01-07T11:52:32.9672069Z ##[debug]Logging patterns *packages.props:*Packages.props:*package.props:*Package.props for D:\a\_work\1
2026-01-07T11:52:32.9672671Z ##[debug]Registered Microsoft.ComponentDetection.Internal.AzureDevOps.NuGetCentralPackageManagementComponentDetector
2026-01-07T11:52:33.0302949Z No compatible Conda installation found on system. Conda detection will not run.
2026-01-07T11:52:33.2415262Z ##[debug]MvnCli detector: Nested pom.xml files processed successfully, retrieving generated dependency graphs.
2026-01-07T11:52:34.9198999Z ##[error]The Operation will be canceled. The next steps may not contain expected logs.
2026-01-07T11:52:34.9688088Z ##[error]The operation was canceled.
2026-01-07T11:52:34.9692319Z ##[section]Finishing: Component Detection (auto-injected by policy)