Skip to content

[release/6.0] Enable CastGuard in Windows native builds - #7896

Open
github-actions[bot] wants to merge 1 commit into
release/6.0from
backport/pr-7793-to-release/6.0
Open

github-actions[bot] wants to merge 1 commit into
release/6.0from
backport/pr-7793-to-release/6.0

Conversation

@github-actions

@github-actions github-actions Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

Backport of #7793 to release/6.0

/cc @matouskozak

Customer Impact

Update native builds with enabled CastGuard

Testing

Tested build passes on internal pipeline

Risk

Low, already used in main for couple weeks.

## Summary

- Add `/guard:cast` alongside the existing options.
- Replace the compiler `/DEBUG` option with `/Z7` so the object files
contain compiler debug metadata that BinSkim can use to verify the
hardening settings.
- Add a short Windows build prerequisite noting that the C++ toolset
must support `/guard:cast`.

---------

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a64691c7-3c54-4513-8fbf-ab39a2eb744b
@matouskozak
matouskozak requested a balanced review from Copilot November 11, 2026 10:34

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Windows/MSVC builds and BinSkim verification of release/6.0 x86, x64, and ARM64 artifacts are needed to confirm CastGuard instrumentation and usable debug metadata, which source inspection alone cannot establish.

No open issues 🎉

What changed in this PR

Backports #7793 to release/6.0, enabling CastGuard for ML.NET’s Windows native builds and improving debug metadata for hardening verification.

Changes:

  • Add /guard:cast alongside the existing compiler options.
  • Replace compiler /DEBUG with /Z7 to embed debug metadata in object files for BinSkim verification.
  • Document the requirement for a C++ toolset that supports /guard:cast.
File Description
src/​Native/​CMakeLists.txt Enable CastGuard and embedded compiler debug metadata on Windows.
docs/​building/​windows-instructions.md Add the CastGuard-compatible toolset prerequisite.

Review effort: Balanced

Copilot AI commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install Dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

@codecov

codecov Bot commented Nov 11, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release/6.0@0a48f5c). Learn more about missing BASE report.

Additional details and impacted files
@@              Coverage Diff               @@
##             release/6.0    #7896   +/-   ##
==============================================
  Coverage               ?   70.26%           
==============================================
  Files                  ?     1419           
  Lines                  ?   272603           
  Branches               ?    27940           
==============================================
  Hits                   ?   191546           
  Misses                 ?    73639           
  Partials               ?     7418           
Flag Coverage Δ
Debug 70.26% <ø> (?)
production 64.52% <ø> (?)
test 89.78% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

svick added a commit that referenced this pull request Nov 12, 2026
## Summary

Partial backport of #7760 to `release/6.0`: add only
`eng/install-dependencies.sh`, unchanged from the original PR and
preserving its executable bit.

## Why this is needed

Copilot code review uses the setup configuration from `main`, which
invokes `sudo ./eng/install-dependencies.sh`, while checking out the
PR's code. The wrapper is missing from `release/6.0`, so review setup
for #7896 failed before dependency installation:

```text
sudo: './eng/install-dependencies.sh': command not found
```

See the [failure
comment](#7896 (comment))
and [workflow
run](https://github.com/dotnet/machinelearning/actions/runs/43004781956).

Adding the wrapper supplies the entry point expected by that setup
configuration. It delegates to the existing Arcade dependency installer
and adds OpenMP installation.

## Why only this part is backported

The missing wrapper is sufficient to explain and fix this specific setup
failure. Its required helper scripts already exist on `release/6.0`; no
Arcade update is needed.

The release branch's own setup workflow already installs the Arcade
dependencies and `libomp-dev` directly, so changing it is unnecessary
for this fix. The remaining documentation, test cleanup, and CI
call-site changes from #7760 are unrelated to the missing entry point
and would expand the servicing change without helping resolve this
failure.

## Validation

- Verified that the script contents exactly match #7760 and that its Git
mode is `100755`.
- Confirmed both required helper scripts exist.

> [!NOTE]
> This PR description and backport were prepared with GitHub Copilot.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: c994e9a3-e808-41bd-92b6-f7f1d8791b8b
@matouskozak
matouskozak enabled auto-merge (squash) November 13, 2026 09:20
@matouskozak
matouskozak disabled auto-merge November 13, 2026 09:21
@matouskozak
matouskozak enabled auto-merge (squash) November 13, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants