From 79d03e9a3158256f08bb697a938abaf39b3441f7 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Tue, 30 Sep 2025 14:12:37 -0700
Subject: [PATCH 01/27] Move internal versions method to helper class

---
 .../FromStagingPipelineCommand.cs             | 56 +------------------
 .../Sync/InternalVersionsHelper.cs            | 56 +++++++++++++++++++
 2 files changed, 58 insertions(+), 54 deletions(-)
 create mode 100644 eng/update-dependencies/Sync/InternalVersionsHelper.cs

diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index 4fdbce61f2..cbabbbad2a 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -1,6 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using Dotnet.Docker.Sync;
 using Microsoft.Extensions.Logging;
 
 namespace Dotnet.Docker;
@@ -44,7 +45,7 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         string dockerfileVersion = VersionHelper.ResolveMajorMinorVersion(releaseConfig.RuntimeBuild).ToString();
 
         // Record pipeline run ID for this dockerfileVersion, for later use by sync-internal-release command
-        RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId.ToString());
+        InternalVersionsHelper.RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId.ToString());
 
         var productVersions = (options.Internal, releaseConfig.SdkOnly) switch
         {
@@ -109,59 +110,6 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         return await updateDependencies.ExecuteAsync(updateDependenciesOptions);
     }
 
-    /// <summary>
-    /// Records the staging pipeline run ID in an easy to parse format. This
-    /// can be used by the sync-internal-release pipeline to record and
-    /// re-apply the same staging builds after resetting the state of the repo
-    /// to match the public release branch.
-    /// </summary>
-    /// <remarks>
-    /// This will only store one staging pipeline run ID per dockerfileVersion
-    /// </remarks>
-    /// <param name="dockerfileVersion">major-minor version</param>
-    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    private void RecordInternalVersion(string dockerfileVersion, string stagingPipelineRunId)
-    {
-        const string InternalVersionsFile = "internal-versions.txt";
-
-        // Internal versions file should have one line per dockerfileVersion
-        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
-        //
-        // The preferable way to do this would be to record the version in
-        // manifest.versions.json, however that would require one of the following:
-        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
-        //    important for keeping the file readable and reducing git merge conflicts
-        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
-        //
-        // So for now, the separate file and format is a compromise.
-
-        var versionsFilePath = Path.GetFullPath(SpecificCommand.VersionsFilename);
-        var versionsFileDir = Path.GetDirectoryName(versionsFilePath) ?? "";
-        var internalVersionFile = Path.Combine(versionsFileDir, InternalVersionsFile);
-        Dictionary<string, string> versions = [];
-
-        _logger.LogInformation(
-            "Recording staging pipeline build ID in {internalVersionFile}",
-            internalVersionFile);
-
-        try
-        {
-            // File already exists - read existing versions
-            versions = File.ReadAllLines(internalVersionFile)
-                .Select(line => line.Split('=', 2))
-                .Where(parts => parts.Length == 2)
-                .ToDictionary(parts => parts[0], parts => parts[1]);
-        }
-        catch (FileNotFoundException)
-        {
-            // File doesn't exist - it will be created
-        }
-
-        versions[dockerfileVersion] = stagingPipelineRunId;
-        var versionLines = versions.Select(kv => $"{kv.Key}={kv.Value}");
-        File.WriteAllLines(internalVersionFile, versionLines);
-    }
-
     /// <summary>
     /// Formats a storage account URL has a specific format:
     /// - Starts with "https://"
diff --git a/eng/update-dependencies/Sync/InternalVersionsHelper.cs b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
new file mode 100644
index 0000000000..863d48092a
--- /dev/null
+++ b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
@@ -0,0 +1,56 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker.Sync;
+
+internal static class InternalVersionsHelper
+{
+    /// <summary>
+    /// Records the staging pipeline run ID in an easy to parse format. This
+    /// can be used by the sync-internal-release pipeline to record and
+    /// re-apply the same staging builds after resetting the state of the repo
+    /// to match the public release branch.
+    /// </summary>
+    /// <remarks>
+    /// This will only store one staging pipeline run ID per dockerfileVersion
+    /// </remarks>
+    /// <param name="dockerfileVersion">major-minor version</param>
+    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
+    public static void RecordInternalVersion(string dockerfileVersion, string stagingPipelineRunId)
+    {
+        const string InternalVersionsFile = "internal-versions.txt";
+
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        //
+        // The preferable way to do this would be to record the version in
+        // manifest.versions.json, however that would require one of the following:
+        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
+        //    important for keeping the file readable and reducing git merge conflicts
+        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
+        //
+        // So for now, the separate file and format is a compromise.
+
+        var versionsFilePath = Path.GetFullPath(SpecificCommand.VersionsFilename);
+        var versionsFileDir = Path.GetDirectoryName(versionsFilePath) ?? "";
+        var internalVersionFile = Path.Combine(versionsFileDir, InternalVersionsFile);
+        Dictionary<string, string> versions = [];
+
+        try
+        {
+            // File already exists - read existing versions
+            versions = File.ReadAllLines(internalVersionFile)
+                .Select(line => line.Split('=', 2))
+                .Where(parts => parts.Length == 2)
+                .ToDictionary(parts => parts[0], parts => parts[1]);
+        }
+        catch (FileNotFoundException)
+        {
+            // File doesn't exist - it will be created
+        }
+
+        versions[dockerfileVersion] = stagingPipelineRunId;
+        var versionLines = versions.Select(kv => $"{kv.Key}={kv.Value}");
+        File.WriteAllLines(internalVersionFile, versionLines);
+    }
+}

From 771c236c5e0a9dac9cda283f2d377a269a838494 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Tue, 30 Sep 2025 14:50:22 -0700
Subject: [PATCH 02/27] Factor out parse/serialization logic for internal
 staging builds

---
 .../FromStagingPipelineCommand.cs             |  2 +-
 .../Sync/InternalVersionsHelper.cs            | 54 +++++++++++++++----
 2 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index cbabbbad2a..8ea2b1c6da 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -45,7 +45,7 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         string dockerfileVersion = VersionHelper.ResolveMajorMinorVersion(releaseConfig.RuntimeBuild).ToString();
 
         // Record pipeline run ID for this dockerfileVersion, for later use by sync-internal-release command
-        InternalVersionsHelper.RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId.ToString());
+        InternalVersionsHelper.RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId);
 
         var productVersions = (options.Internal, releaseConfig.SdkOnly) switch
         {
diff --git a/eng/update-dependencies/Sync/InternalVersionsHelper.cs b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
index 863d48092a..0ed8ca268f 100644
--- a/eng/update-dependencies/Sync/InternalVersionsHelper.cs
+++ b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
@@ -1,8 +1,46 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Immutable;
+
 namespace Dotnet.Docker.Sync;
 
+/// <summary>
+/// Records information about what internal staging pipeline run IDs were used
+/// for which .NET Dockerfile versions.
+/// </summary>
+/// <param name="Versions">
+/// Mapping of Major.Minor .NET version to staging pipeline run ID.
+/// </param>
+internal sealed record InternalStagingBuilds(ImmutableDictionary<string, int> Versions)
+{
+    /// <summary>
+    /// Parses <see cref=" InternalStagingBuilds"/> from lines of text.
+    /// </summary>
+    /// <remarks>
+    /// Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+    /// </remarks>
+    public static InternalStagingBuilds Parse(IEnumerable<string> lines)
+    {
+        var versions = lines
+            .Select(line => line.Split('=', 2))
+            .Where(parts => parts.Length == 2)
+            .ToImmutableDictionary(parts => parts[0], parts => int.Parse(parts[1]));
+
+        return new InternalStagingBuilds(versions);
+    }
+
+    /// <summary>
+    /// Returns a new <see cref="InternalStagingBuilds"/> with the specified
+    /// version added.
+    /// </summary>
+    public InternalStagingBuilds Add(string dockerfileVersion, int stagingPipelineRunId) =>
+        this with { Versions = Versions.SetItem(dockerfileVersion, stagingPipelineRunId) };
+
+    public override string ToString() =>
+        string.Join(Environment.NewLine, Versions.Select(kv => $"{kv.Key}={kv.Value}"));
+}
+
 internal static class InternalVersionsHelper
 {
     /// <summary>
@@ -16,7 +54,7 @@ internal static class InternalVersionsHelper
     /// </remarks>
     /// <param name="dockerfileVersion">major-minor version</param>
     /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    public static void RecordInternalVersion(string dockerfileVersion, string stagingPipelineRunId)
+    public static void RecordInternalVersion(string dockerfileVersion, int stagingPipelineRunId)
     {
         const string InternalVersionsFile = "internal-versions.txt";
 
@@ -34,23 +72,21 @@ public static void RecordInternalVersion(string dockerfileVersion, string stagin
         var versionsFilePath = Path.GetFullPath(SpecificCommand.VersionsFilename);
         var versionsFileDir = Path.GetDirectoryName(versionsFilePath) ?? "";
         var internalVersionFile = Path.Combine(versionsFileDir, InternalVersionsFile);
-        Dictionary<string, string> versions = [];
 
+        InternalStagingBuilds builds;
         try
         {
             // File already exists - read existing versions
-            versions = File.ReadAllLines(internalVersionFile)
-                .Select(line => line.Split('=', 2))
-                .Where(parts => parts.Length == 2)
-                .ToDictionary(parts => parts[0], parts => parts[1]);
+            var fileContents = File.ReadAllLines(internalVersionFile);
+            builds = InternalStagingBuilds.Parse(fileContents);
         }
         catch (FileNotFoundException)
         {
             // File doesn't exist - it will be created
+            builds = new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
         }
 
-        versions[dockerfileVersion] = stagingPipelineRunId;
-        var versionLines = versions.Select(kv => $"{kv.Key}={kv.Value}");
-        File.WriteAllLines(internalVersionFile, versionLines);
+        builds = builds.Add(dockerfileVersion, stagingPipelineRunId);
+        File.WriteAllText(internalVersionFile, builds.ToString());
     }
 }

From 9587f72f1674ac9b88bf0d2417c77c3545d3a910 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 08:44:36 -0700
Subject: [PATCH 03/27] Add helper method for constructing mock command

---
 .../SyncInternalReleaseTests.cs               | 35 +++++++++++--------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index 9dcd3584f9..309cea0ace 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -29,6 +29,21 @@ public sealed class SyncInternalReleaseTests
         TargetBranch = InternalReleaseBranch
     };
 
+    /// <summary>
+    /// Helper method to create a <see cref="SyncInternalReleaseCommand"/> instance with optional
+    /// mocked dependencies. If dependencies are not provided, default mocks will be used.
+    /// </summary>
+    private SyncInternalReleaseCommand CreateCommand(
+        IGitRepoHelperFactory? repoFactory = null,
+        ILogger<SyncInternalReleaseCommand>? logger = null)
+    {
+        // New parameters should be null by default and initialized with mocks if not specified.
+        return new(
+            repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
+            logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>()
+        );
+    }
+
     /// <summary>
     /// Calling the command with null or whitespace for any of the arguments should fail.
     /// </summary>
@@ -42,9 +57,7 @@ public async Task WhitespaceArgumentsFails()
             TargetBranch = "   "
         };
 
-        var command = new SyncInternalReleaseCommand(
-            Mock.Of<IGitRepoHelperFactory>(),
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand();
 
         await Should.ThrowAsync<ArgumentException>(() => command.ExecuteAsync(options));
     }
@@ -59,9 +72,7 @@ public async Task InternalSourceBranchFails()
     {
         var options = s_defaultOptions with { SourceBranch = "internal/foo" };
 
-        var command = new SyncInternalReleaseCommand(
-            Mock.Of<IGitRepoHelperFactory>(),
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand();
 
         await Should.ThrowAsync<InvalidBranchException>(() => command.ExecuteAsync(options));
     }
@@ -85,9 +96,7 @@ public async Task CreateInternalBranch()
         // Source branch exists on remote
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.SourceBranch)).ReturnsAsync(true);
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         var exitCode = await command.ExecuteAsync(options);
         exitCode.ShouldBe(0);
@@ -120,9 +129,7 @@ public async Task AlreadyUpToDate()
         repoMock.Setup(r => r.Remote.GetRemoteBranchShaAsync(options.SourceBranch)).ReturnsAsync(Sha);
         repoMock.Setup(r => r.Dispose());
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         // Command should succeed.
         var exitCode = await command.ExecuteAsync(options);
@@ -170,9 +177,7 @@ public async Task FastForward()
             .Setup(r => r.GetPullRequestInfoAsync(It.IsAny<string>()))
             .ReturnsAsync(Mock.Of<PullRequest>());
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         // Command should succeed.
         var exitCode = await command.ExecuteAsync(options);

From 7c1ec48e83f6139cb2bdd78391bf4e50ecb5b7a4 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 09:57:18 -0700
Subject: [PATCH 04/27] Extract ICommand interface from BaseCommand

---
 eng/update-dependencies/BaseCommand.cs           |  5 ++---
 .../DependencyInjectionExtensions.cs             |  2 +-
 eng/update-dependencies/ICommand.cs              | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 eng/update-dependencies/ICommand.cs

diff --git a/eng/update-dependencies/BaseCommand.cs b/eng/update-dependencies/BaseCommand.cs
index d5d459528d..402b3e7fc3 100644
--- a/eng/update-dependencies/BaseCommand.cs
+++ b/eng/update-dependencies/BaseCommand.cs
@@ -3,13 +3,12 @@
 
 using System.CommandLine;
 using System.CommandLine.NamingConventionBinder;
-using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 
 namespace Dotnet.Docker;
 
-public abstract class BaseCommand<TOptions>() where TOptions : IOptions
+public abstract class BaseCommand<TOptions>() : ICommand<TOptions> where TOptions : IOptions
 {
     public abstract Task<int> ExecuteAsync(TOptions options);
 
@@ -34,7 +33,7 @@ public static Command Create(string name, string description)
     private static BindingHandler Handler =>
         CommandHandler.Create<TOptions, IHost>(async (options, host) =>
             {
-                var thisCommand = host.Services.GetRequiredService<BaseCommand<TOptions>>();
+                var thisCommand = host.Services.GetRequiredService<ICommand<TOptions>>();
                 return await thisCommand.ExecuteAsync(options);
             });
 }
diff --git a/eng/update-dependencies/DependencyInjectionExtensions.cs b/eng/update-dependencies/DependencyInjectionExtensions.cs
index 18b2e76475..ccc3ba6f52 100644
--- a/eng/update-dependencies/DependencyInjectionExtensions.cs
+++ b/eng/update-dependencies/DependencyInjectionExtensions.cs
@@ -17,7 +17,7 @@ public static void AddCommand<TCommand, TOptions>(
             where TCommand : BaseCommand<TOptions>
             where TOptions : IOptions
     {
-        serviceCollection.AddSingleton<BaseCommand<TOptions>, TCommand>();
+        serviceCollection.AddSingleton<ICommand<TOptions>, TCommand>();
     }
 
     /// <summary>
diff --git a/eng/update-dependencies/ICommand.cs b/eng/update-dependencies/ICommand.cs
new file mode 100644
index 0000000000..8918bcfb79
--- /dev/null
+++ b/eng/update-dependencies/ICommand.cs
@@ -0,0 +1,16 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker;
+
+/// <summary>
+/// A generic CLI command that takes an options object.
+/// </summary>
+/// <typeparam name="TOptions">
+/// The type of options that the command accepts.
+/// </typeparam>
+/// <seealso cref="BaseCommand"/>
+public interface ICommand<TOptions> where TOptions : IOptions
+{
+    Task<int> ExecuteAsync(TOptions options);
+}

From 163b2415ef40cd4365731b26187e32082bfe74e4 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 09:59:07 -0700
Subject: [PATCH 05/27] Use InternalsVisibleTo for update dependencies tests

---
 eng/update-dependencies/Git/GitRemoteInfo.cs               | 2 +-
 eng/update-dependencies/Git/GitRepoHelper.cs               | 2 +-
 eng/update-dependencies/Git/GitRepoHelperFactory.cs        | 4 ++--
 eng/update-dependencies/Git/IGitRepoHelper.cs              | 2 +-
 eng/update-dependencies/Git/ILocalGitRepoHelper.cs         | 2 +-
 eng/update-dependencies/Git/IRemoteGitRepoHelper.cs        | 2 +-
 eng/update-dependencies/Git/InvalidBranchException.cs      | 2 +-
 eng/update-dependencies/Git/LocalGitRepoHelper.cs          | 4 ++--
 eng/update-dependencies/Git/RemoteGitRepoFactory.cs        | 4 ++--
 eng/update-dependencies/Git/RemoteGitRepoHelper.cs         | 2 +-
 eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs | 2 +-
 eng/update-dependencies/update-dependencies.csproj         | 6 ++++++
 12 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/eng/update-dependencies/Git/GitRemoteInfo.cs b/eng/update-dependencies/Git/GitRemoteInfo.cs
index ba85d48cb6..2530ef6329 100644
--- a/eng/update-dependencies/Git/GitRemoteInfo.cs
+++ b/eng/update-dependencies/Git/GitRemoteInfo.cs
@@ -8,4 +8,4 @@ namespace Dotnet.Docker.Git;
 /// </summary>
 /// <param name="Name">The name of the remote (e.g., "origin").</param>
 /// <param name="Url">The URL of the remote repository.</param>
-public record GitRemoteInfo(string Name, string Url);
+internal sealed record GitRemoteInfo(string Name, string Url);
diff --git a/eng/update-dependencies/Git/GitRepoHelper.cs b/eng/update-dependencies/Git/GitRepoHelper.cs
index 0357f1d1f0..1558bb1488 100644
--- a/eng/update-dependencies/Git/GitRepoHelper.cs
+++ b/eng/update-dependencies/Git/GitRepoHelper.cs
@@ -13,7 +13,7 @@ namespace Dotnet.Docker.Git;
 /// <remarks>
 /// Use <see cref="IGitRepoHelperFactory"/> to instantiate this.
 /// </remarks>
-public sealed class GitRepoHelper(
+internal sealed class GitRepoHelper(
     string remoteRepoUrl,
     ILocalGitRepoHelper localGitRepoHelper,
     IRemoteGitRepoHelper remoteGitRepoHelper,
diff --git a/eng/update-dependencies/Git/GitRepoHelperFactory.cs b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
index 1e2f9e5769..8db2d180bc 100644
--- a/eng/update-dependencies/Git/GitRepoHelperFactory.cs
+++ b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
@@ -11,12 +11,12 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface IGitRepoHelperFactory
+internal interface IGitRepoHelperFactory
 {
     Task<IGitRepoHelper> CreateAsync(string repoUri);
 }
 
-public sealed class GitRepoHelperFactory(
+internal sealed class GitRepoHelperFactory(
     IGitRepoCloner gitRepoCloner,
     ILocalGitRepoFactory localGitRepoFactory,
     IRemoteGitRepoFactory remoteFactory,
diff --git a/eng/update-dependencies/Git/IGitRepoHelper.cs b/eng/update-dependencies/Git/IGitRepoHelper.cs
index f413dc3c2a..9aed8f1467 100644
--- a/eng/update-dependencies/Git/IGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/IGitRepoHelper.cs
@@ -9,7 +9,7 @@ namespace Dotnet.Docker.Git;
 /// <summary>
 /// Handles operations that require interactions with both local and remote git repos.
 /// </summary>
-public interface IGitRepoHelper : IDisposable
+internal interface IGitRepoHelper : IDisposable
 {
     /// <summary>
     /// For any git operations that only affect the local repo.
diff --git a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
index 0457ce2386..472526b5d1 100644
--- a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
@@ -6,7 +6,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface ILocalGitRepoHelper
+internal interface ILocalGitRepoHelper
 {
     /// <summary>
     /// The local path where the repository is cloned.
diff --git a/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs b/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
index 1390e2d4d0..b946c28268 100644
--- a/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
@@ -6,7 +6,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface IRemoteGitRepoHelper
+internal interface IRemoteGitRepoHelper
 {
     /// <summary>
     /// Checks if a branch exists on the remote repository.
diff --git a/eng/update-dependencies/Git/InvalidBranchException.cs b/eng/update-dependencies/Git/InvalidBranchException.cs
index 26703c3ac0..2600e7e003 100644
--- a/eng/update-dependencies/Git/InvalidBranchException.cs
+++ b/eng/update-dependencies/Git/InvalidBranchException.cs
@@ -10,4 +10,4 @@ namespace Dotnet.Docker.Git;
 /// such as attempting to use a non-existent branch or an incorrectly named branch.
 /// </summary>
 /// <param name="message">The error message describing the invalid branch condition.</param>
-public sealed class InvalidBranchException(string message) : InvalidOperationException(message);
+internal sealed class InvalidBranchException(string message) : InvalidOperationException(message);
diff --git a/eng/update-dependencies/Git/LocalGitRepoHelper.cs b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
index 51f57d7f5e..1efe554651 100644
--- a/eng/update-dependencies/Git/LocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
@@ -10,7 +10,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public sealed class LocalGitRepoHelper(
+internal sealed class LocalGitRepoHelper(
     string localPath,
     ILocalGitRepo localGitRepo,
     ILogger<LocalGitRepoHelper> logger
@@ -67,7 +67,7 @@ public async Task<string> CommitAsync(string message, (string Name, string Email
         var commitSha = await _localGitRepo.GetShaForRefAsync("HEAD");
         return commitSha;
     }
-    
+
     /// <inheritdoc />
     public async Task<bool> IsAncestorAsync(string ancestorRef, string descendantRef)
     {
diff --git a/eng/update-dependencies/Git/RemoteGitRepoFactory.cs b/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
index a2a7815d6c..59d72bd4b9 100644
--- a/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
+++ b/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
@@ -10,7 +10,7 @@ namespace Dotnet.Docker.Git;
 /// <summary>
 /// Factory for creating <see cref="IRemoteGitRepo"/> instances based on repository URLs.
 /// </summary>
-public interface IRemoteGitRepoFactory
+internal interface IRemoteGitRepoFactory
 {
     /// <summary>
     /// Creates a remote Git repository client appropriate for the given repository URL.
@@ -21,7 +21,7 @@ public interface IRemoteGitRepoFactory
 }
 
 /// <inheritdoc />
-public sealed class RemoteGitRepoFactory(IServiceProvider serviceProvider) : IRemoteGitRepoFactory
+internal sealed class RemoteGitRepoFactory(IServiceProvider serviceProvider) : IRemoteGitRepoFactory
 {
     private readonly IServiceProvider _serviceProvider = serviceProvider;
 
diff --git a/eng/update-dependencies/Git/RemoteGitRepoHelper.cs b/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
index c44cdf89d3..20fd42dd84 100644
--- a/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
@@ -8,7 +8,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public sealed class RemoteGitRepoHelper(
+internal sealed class RemoteGitRepoHelper(
     string remoteRepoUrl,
     IRemoteGitRepo remoteGitRepo,
     ILocalGitRepo localGitRepo,
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index b9ae8f4d60..c2f6fc27da 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -18,7 +18,7 @@ namespace Dotnet.Docker.Sync;
 /// internal/release/* branch may contain .NET versions that are not yet publicly available.
 /// "In sync" does not necessarily mean that the commit SHAs of both branches are identical.
 /// </remarks>
-public sealed class SyncInternalReleaseCommand(
+internal sealed class SyncInternalReleaseCommand(
     IGitRepoHelperFactory gitRepoHelperFactory,
     ILogger<SyncInternalReleaseCommand> logger
 ) : BaseCommand<SyncInternalReleaseOptions>
diff --git a/eng/update-dependencies/update-dependencies.csproj b/eng/update-dependencies/update-dependencies.csproj
index 948948c2e7..aaf2315d41 100644
--- a/eng/update-dependencies/update-dependencies.csproj
+++ b/eng/update-dependencies/update-dependencies.csproj
@@ -9,6 +9,12 @@
     <RootNamespace>Dotnet.Docker</RootNamespace>
   </PropertyGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="UpdateDependencies.Tests" />
+    <!-- Allows Moq to create mocks of internal types -->
+    <InternalsVisibleTo Include="DynamicProxyGenAssembly2" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="Azure.Identity" Version="1.14.2" />
     <PackageReference Include="Azure.Storage.Blobs" Version="12.24.0" />

From 44873879d499fcddb0674d5d49d270d21d13a1f1 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 09:59:48 -0700
Subject: [PATCH 06/27] Add FromStagingPipelineCommand dependency to
 SyncInternalReleaseCommand

---
 eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs | 2 ++
 tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index c2f6fc27da..e8df83d971 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -20,10 +20,12 @@ namespace Dotnet.Docker.Sync;
 /// </remarks>
 internal sealed class SyncInternalReleaseCommand(
     IGitRepoHelperFactory gitRepoHelperFactory,
+    ICommand<FromStagingPipelineOptions> updateFromStagingPipeline,
     ILogger<SyncInternalReleaseCommand> logger
 ) : BaseCommand<SyncInternalReleaseOptions>
 {
     private readonly IGitRepoHelperFactory _gitRepoHelperFactory = gitRepoHelperFactory;
+    private readonly ICommand<FromStagingPipelineOptions> _updateFromStagingPipeline = updateFromStagingPipeline;
     private readonly ILogger<SyncInternalReleaseCommand> _logger = logger;
 
     public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index 309cea0ace..afd4e3d784 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -1,6 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using Dotnet.Docker;
 using Dotnet.Docker.Git;
 using Dotnet.Docker.Sync;
 using Microsoft.DotNet.DarcLib;
@@ -35,11 +36,13 @@ public sealed class SyncInternalReleaseTests
     /// </summary>
     private SyncInternalReleaseCommand CreateCommand(
         IGitRepoHelperFactory? repoFactory = null,
+        ICommand<FromStagingPipelineOptions>? fromStagingPipelineCommand = null,
         ILogger<SyncInternalReleaseCommand>? logger = null)
     {
         // New parameters should be null by default and initialized with mocks if not specified.
         return new(
             repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
+            fromStagingPipelineCommand ?? Mock.Of<ICommand<FromStagingPipelineOptions>>(),
             logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>()
         );
     }

From bd3497df80ae5994511f0c77264af0b0b34e5c34 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 10:55:36 -0700
Subject: [PATCH 07/27] Add git restore method

---
 .../Git/ILocalGitRepoHelper.cs                   | 16 ++++++++++++++++
 .../Git/LocalGitRepoHelper.cs                    |  6 ++++++
 2 files changed, 22 insertions(+)

diff --git a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
index 472526b5d1..4c49eeae4a 100644
--- a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
@@ -69,4 +69,20 @@ internal interface ILocalGitRepoHelper
     /// List all remotes for the local repository.
     /// </summary>
     Task<IEnumerable<GitRemoteInfo>> ListAllRemotesAsync();
+
+    /// <summary>
+    /// Restore the working tree with the contents from a restore source.
+    /// Uncommitted changes in the working tree will be lost.
+    /// </summary>
+    /// <remarks>
+    /// Because contents are restored to the working tree, they will not be
+    /// staged. If the changes resulting from this command need to be
+    /// committed, they must be staged first.
+    /// </remarks>
+    /// <param name="source">
+    /// Restore the working tree files with the content from this tree.
+    /// This can be a commit, branch or tag.
+    /// </param>
+    /// <see href="link">https://git-scm.com/docs/git-restore</see>
+    Task RestoreAsync(string source);
 }
diff --git a/eng/update-dependencies/Git/LocalGitRepoHelper.cs b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
index 1efe554651..1486ce426b 100644
--- a/eng/update-dependencies/Git/LocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
@@ -99,4 +99,10 @@ public async Task<IEnumerable<GitRemoteInfo>> ListAllRemotesAsync()
             // There are typically two entries per remote (fetch and push); we only want one
             .Distinct();
     }
+
+    /// <inheritdoc />
+    public async Task RestoreAsync(string source)
+    {
+        await _localGitRepo.ExecuteGitCommand("restore", "--source", source);
+    }
 }

From cf0d112775017bed89215350379f88d74a699e1d Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 12:01:52 -0700
Subject: [PATCH 08/27] Add --repo-root argmuent to existing commands

---
 eng/update-dependencies/BaseUrlUpdater.cs     |  9 ++++---
 .../CreatePullRequestOptions.cs               |  6 +++++
 .../CreatePullRequestOptionsExtensions.cs     | 10 ++++++++
 .../DockerfileShaUpdater.cs                   |  9 +++----
 .../FromStagingPipelineCommand.cs             |  5 +++-
 .../GitHubReleaseUpdaterBase.cs               |  4 ++--
 .../GitHubReleaseVersionUpdater.cs            |  4 ++--
 eng/update-dependencies/ManifestHelper.cs     |  9 ++++---
 eng/update-dependencies/NuGetConfigUpdater.cs |  6 ++---
 .../RocksToolboxUpdater.cs                    |  4 ++--
 eng/update-dependencies/SpecificCommand.cs    | 24 ++++++++-----------
 .../SpecificCommandOptions.cs                 |  5 ++++
 .../Sync/InternalVersionsHelper.cs            | 10 ++++----
 eng/update-dependencies/Tools.cs              | 10 ++++----
 .../VariableUpdaterBase.cs                    |  8 +++----
 eng/update-dependencies/VersionUpdater.cs     |  4 ++--
 16 files changed, 71 insertions(+), 56 deletions(-)
 create mode 100644 eng/update-dependencies/CreatePullRequestOptionsExtensions.cs

diff --git a/eng/update-dependencies/BaseUrlUpdater.cs b/eng/update-dependencies/BaseUrlUpdater.cs
index d9e7909061..d104c653c7 100644
--- a/eng/update-dependencies/BaseUrlUpdater.cs
+++ b/eng/update-dependencies/BaseUrlUpdater.cs
@@ -25,10 +25,10 @@ internal class BaseUrlUpdater : FileRegexUpdater
     /// If the base URL variable cannot be found in the manifest, the updater
     /// won't do anything.
     /// </summary>
-    public static IDependencyUpdater Create(string repoRoot, SpecificCommandOptions options)
+    public static IDependencyUpdater Create(SpecificCommandOptions options)
     {
         // Load manifest and extract variables once so the constructor doesn't duplicate this logic
-        var manifest = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename);
+        var manifest = ManifestHelper.LoadManifest(options.GetManifestVersionsFilePath());
         var manifestVariables = (JObject?)manifest["variables"];
 
         if (manifestVariables is null)
@@ -49,16 +49,15 @@ public static IDependencyUpdater Create(string repoRoot, SpecificCommandOptions
             return new EmptyDependencyUpdater();
         }
 
-        return new BaseUrlUpdater(repoRoot, options, manifestVariables, baseUrlVarName);
+        return new BaseUrlUpdater(options, manifestVariables, baseUrlVarName);
     }
 
     private BaseUrlUpdater(
-        string repoRoot,
         SpecificCommandOptions options,
         JObject manifestVariables,
         string manifestVariableName)
     {
-        Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+        Path = options.GetManifestVersionsFilePath();
         VersionGroupName = BaseUrlGroupName;
         _options = options;
         _manifestVariables = manifestVariables;
diff --git a/eng/update-dependencies/CreatePullRequestOptions.cs b/eng/update-dependencies/CreatePullRequestOptions.cs
index 46e88b2d51..d3250ecc13 100644
--- a/eng/update-dependencies/CreatePullRequestOptions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptions.cs
@@ -10,6 +10,11 @@ public abstract record CreatePullRequestOptions
 {
     private string? _targetBranch = null;
 
+    /// <summary>
+    /// The root of the dotnet-docker repo to run against.
+    /// </summary>
+    public string RepoRoot { get; init; } = Directory.GetCurrentDirectory();
+
     public string User { get; init; } = "";
     public string Email { get; init; } = "";
     public string Password { get; init; } = "";
@@ -26,6 +31,7 @@ public string TargetBranch
 
     public static List<Option> Options =>
     [
+        new Option<string>("--repo-root") { Description = "The root of the dotnet-docker repo to run against (defaults to current working directory)" },
         new Option<string>("--user") { Description = "GitHub or AzDO user used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--email") { Description = "GitHub or AzDO email used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--password") { Description = "GitHub or AzDO password used to make PR (if not specified, a PR will not be created)" },
diff --git a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
new file mode 100644
index 0000000000..73a0a98fbf
--- /dev/null
+++ b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
@@ -0,0 +1,10 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker;
+
+internal static class CreatePullRequestOptionsExtensions
+{
+    public static string GetManifestVersionsFilePath(this CreatePullRequestOptions options) =>
+        Path.Combine(options.RepoRoot, "manifest.versions.json");
+}
diff --git a/eng/update-dependencies/DockerfileShaUpdater.cs b/eng/update-dependencies/DockerfileShaUpdater.cs
index bdc3449219..8ee114150a 100644
--- a/eng/update-dependencies/DockerfileShaUpdater.cs
+++ b/eng/update-dependencies/DockerfileShaUpdater.cs
@@ -72,11 +72,12 @@ public DockerfileShaUpdater(
             _manifestVariables = new Lazy<JObject>(
                 () =>
                 {
+                    var versionsFile = options.GetManifestVersionsFilePath();
                     const string VariablesProperty = "variables";
-                    JToken? variables = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename)[VariablesProperty];
+                    JToken? variables = ManifestHelper.LoadManifest(versionsFile)[VariablesProperty];
                     if (variables is null)
                     {
-                        throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{SpecificCommand.VersionsFilename}'");
+                        throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{versionsFile}'");
                     }
                     return (JObject)variables;
                 });
@@ -91,9 +92,9 @@ public DockerfileShaUpdater(
         }
 
         public static IEnumerable<IDependencyUpdater> CreateUpdaters(
-            string productName, string dockerfileVersion, string repoRoot, SpecificCommandOptions options)
+            string productName, string dockerfileVersion, SpecificCommandOptions options)
         {
-            string versionsPath = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+            string versionsPath = options.GetManifestVersionsFilePath();
             string versions = File.ReadAllText(versionsPath);
 
             // The format of the sha variable name is '<productName>|<dockerfileVersion>|<os>|<arch>|sha'.
diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index 8ea2b1c6da..2d47d1f1be 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -45,7 +45,10 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         string dockerfileVersion = VersionHelper.ResolveMajorMinorVersion(releaseConfig.RuntimeBuild).ToString();
 
         // Record pipeline run ID for this dockerfileVersion, for later use by sync-internal-release command
-        InternalVersionsHelper.RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId);
+        InternalVersionsHelper.RecordInternalVersion(
+            options.RepoRoot,
+            dockerfileVersion,
+            options.StagingPipelineRunId);
 
         var productVersions = (options.Internal, releaseConfig.SdkOnly) switch
         {
diff --git a/eng/update-dependencies/GitHubReleaseUpdaterBase.cs b/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
index 827f5903ba..79291cd999 100644
--- a/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
+++ b/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
@@ -8,13 +8,13 @@
 namespace Dotnet.Docker;
 
 internal abstract partial class GitHubReleaseUpdaterBase(
-    string repoRoot,
+    string manifestVersionsFilePath,
     string toolName,
     string variableName,
     string owner,
     string repo)
     : VariableUpdaterBase(
-        repoRoot,
+        manifestVersionsFilePath,
         variableName)
 {
     protected string ToolName { get; } = toolName;
diff --git a/eng/update-dependencies/GitHubReleaseVersionUpdater.cs b/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
index 1756b1505a..b0541781f2 100644
--- a/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
+++ b/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
@@ -7,13 +7,13 @@ namespace Dotnet.Docker;
 /// Updates a variable to the latest GitHub Release tag
 /// </summary>
 internal class GitHubReleaseVersionUpdater(
-    string repoRoot,
+    string manifestVersionsFilePath,
     string toolName,
     string variableName,
     string owner,
     string repo)
     : GitHubReleaseUpdaterBase(
-        repoRoot,
+        manifestVersionsFilePath,
         toolName,
         variableName,
         owner,
diff --git a/eng/update-dependencies/ManifestHelper.cs b/eng/update-dependencies/ManifestHelper.cs
index 3d3fb2716d..692e07ac80 100644
--- a/eng/update-dependencies/ManifestHelper.cs
+++ b/eng/update-dependencies/ManifestHelper.cs
@@ -106,13 +106,12 @@ public static string GetVariableValue(string variableName, JObject variables)
             ?? throw new ArgumentException($"Manifest does not contain a value for {variableName}");
 
     /// <summary>
-    /// Loads the manifest from the given filename.
+    /// Loads the manifest from the given file path.
     /// </summary>
-    /// <param name="filename">Name, not path, of the manifest file located at the root of the repo.</param>
-    public static JObject LoadManifest(string filename)
+    /// <param name="filePath">Path of the manifest file located at the root of the repo.</param>
+    public static JObject LoadManifest(string filePath)
     {
-        string path = Path.Combine(SpecificCommand.RepoRoot, filename);
-        string contents = File.ReadAllText(path);
+        string contents = File.ReadAllText(filePath);
         return JObject.Parse(contents);
     }
 
diff --git a/eng/update-dependencies/NuGetConfigUpdater.cs b/eng/update-dependencies/NuGetConfigUpdater.cs
index 25fe51ecee..22ad5aa2b5 100644
--- a/eng/update-dependencies/NuGetConfigUpdater.cs
+++ b/eng/update-dependencies/NuGetConfigUpdater.cs
@@ -17,17 +17,15 @@ namespace Dotnet.Docker;
 internal class NuGetConfigUpdater : IDependencyUpdater
 {
     private const string PkgSrcSuffix = "_internal";
-    private readonly string _repoRoot;
     private readonly SpecificCommandOptions _options;
     private readonly string _configPath;
 
-    public NuGetConfigUpdater(string repoRoot, SpecificCommandOptions options)
+    public NuGetConfigUpdater(SpecificCommandOptions options)
     {
-        _repoRoot = repoRoot;
         _options = options;
 
         string configSuffix = _options.IsInternal ? ".internal" : _options.SourceBranch == "nightly" ? ".nightly" : string.Empty;
-        _configPath = Path.Combine(_repoRoot, $"tests/Microsoft.DotNet.Docker.Tests/TestAppArtifacts/NuGet.config{configSuffix}");
+        _configPath = Path.Combine(_options.RepoRoot, $"tests/Microsoft.DotNet.Docker.Tests/TestAppArtifacts/NuGet.config{configSuffix}");
     }
 
     public IEnumerable<DependencyUpdateTask> GetUpdateTasks(IEnumerable<IDependencyInfo> dependencyInfos)
diff --git a/eng/update-dependencies/RocksToolboxUpdater.cs b/eng/update-dependencies/RocksToolboxUpdater.cs
index 044762eaa6..f842ea15d3 100644
--- a/eng/update-dependencies/RocksToolboxUpdater.cs
+++ b/eng/update-dependencies/RocksToolboxUpdater.cs
@@ -14,9 +14,9 @@ internal static class RocksToolboxUpdater
 
     private const string Repo = "rocks-toolbox";
 
-    public static IDependencyUpdater GetUpdater(string repoRoot) =>
+    public static IDependencyUpdater GetUpdater(string manifestVersionsFilePath) =>
         new GitHubReleaseVersionUpdater(
-            repoRoot: repoRoot,
+            manifestVersionsFilePath: manifestVersionsFilePath,
             toolName: ToolName,
             variableName: $"{ToolName}|latest|version",
             owner: Owner,
diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index 2a0d2fd675..04b46f795f 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -18,8 +18,6 @@ namespace Dotnet.Docker
 {
     public class SpecificCommand : BaseCommand<SpecificCommandOptions>
     {
-        public const string ManifestFilename = "manifest.json";
-        public const string VersionsFilename = "manifest.versions.json";
 
         private static SpecificCommandOptions? s_options;
 
@@ -28,8 +26,6 @@ private static SpecificCommandOptions Options {
             set => s_options = value;
         }
 
-        public static string RepoRoot { get; } = Directory.GetCurrentDirectory();
-
         public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
         {
             Options = options;
@@ -57,7 +53,7 @@ public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
 
                 if (toolBuildInfos.Length != 0)
                 {
-                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(RepoRoot);
+                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(Options.GetManifestVersionsFilePath());
                     DependencyUpdateResults toolUpdateResults = UpdateFiles(toolBuildInfos, toolUpdaters);
                     updateResults.Add(toolUpdateResults);
                 }
@@ -151,7 +147,7 @@ private static IDependencyInfo CreateDependencyBuildInfo(string name, string? ve
 
         private static void PushToAzdoBranch(string commitMessage, string targetBranch)
         {
-            using Repository repo = new(RepoRoot);
+            using Repository repo = new(Options.RepoRoot);
 
             // Commit the existing changes
             Commands.Stage(repo, "*");
@@ -382,16 +378,16 @@ private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
 
             List<IDependencyUpdater> updaters =
             [
-                new NuGetConfigUpdater(RepoRoot, Options),
-                BaseUrlUpdater.Create(RepoRoot, Options)
+                new NuGetConfigUpdater(Options),
+                BaseUrlUpdater.Create(Options)
             ];
 
             foreach (string productName in Options.ProductVersions.Keys)
             {
-                updaters.Add(new VersionUpdater(VersionType.Build, productName, Options.DockerfileVersion, RepoRoot, Options));
-                updaters.Add(new VersionUpdater(VersionType.Product, productName, Options.DockerfileVersion, RepoRoot, Options));
+                updaters.Add(new VersionUpdater(VersionType.Build, productName, Options.DockerfileVersion, Options));
+                updaters.Add(new VersionUpdater(VersionType.Product, productName, Options.DockerfileVersion, Options));
 
-                foreach (IDependencyUpdater shaUpdater in DockerfileShaUpdater.CreateUpdaters(productName, Options.DockerfileVersion, RepoRoot, Options))
+                foreach (IDependencyUpdater shaUpdater in DockerfileShaUpdater.CreateUpdaters(productName, Options.DockerfileVersion, Options))
                 {
                     updaters.Add(shaUpdater);
                 }
@@ -400,10 +396,10 @@ private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
             return updaters;
         }
 
-        private static IEnumerable<IDependencyUpdater> GetGeneratedContentUpdaters() =>
+        private IEnumerable<IDependencyUpdater> GetGeneratedContentUpdaters() =>
         [
-            ScriptRunnerUpdater.GetDockerfileUpdater(RepoRoot),
-            ScriptRunnerUpdater.GetReadMeUpdater(RepoRoot)
+            ScriptRunnerUpdater.GetDockerfileUpdater(Options.RepoRoot),
+            ScriptRunnerUpdater.GetReadMeUpdater(Options.RepoRoot)
         ];
     }
 }
diff --git a/eng/update-dependencies/SpecificCommandOptions.cs b/eng/update-dependencies/SpecificCommandOptions.cs
index 17b7a0fbdb..2d010126c2 100644
--- a/eng/update-dependencies/SpecificCommandOptions.cs
+++ b/eng/update-dependencies/SpecificCommandOptions.cs
@@ -58,6 +58,11 @@ private static List<Option> GetOptions()
 
             List<Option> options =
             [
+                new Option<string>("--repo-root")
+                {
+                    Description = "The root of the dotnet-docker repo to run against."
+                        + " If not specified, the current working directory will be used."
+                },
                 new Option<IDictionary<string, string?>>("--product-versions", "--product-version")
                 {
                     Description = "Product versions to update (<product-name>=<version>)",
diff --git a/eng/update-dependencies/Sync/InternalVersionsHelper.cs b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
index 0ed8ca268f..f5b1b0101d 100644
--- a/eng/update-dependencies/Sync/InternalVersionsHelper.cs
+++ b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
@@ -43,6 +43,8 @@ public override string ToString() =>
 
 internal static class InternalVersionsHelper
 {
+    public const string InternalVersionsFileName = "internal-versions.txt";
+
     /// <summary>
     /// Records the staging pipeline run ID in an easy to parse format. This
     /// can be used by the sync-internal-release pipeline to record and
@@ -54,10 +56,8 @@ internal static class InternalVersionsHelper
     /// </remarks>
     /// <param name="dockerfileVersion">major-minor version</param>
     /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    public static void RecordInternalVersion(string dockerfileVersion, int stagingPipelineRunId)
+    public static void RecordInternalVersion(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
     {
-        const string InternalVersionsFile = "internal-versions.txt";
-
         // Internal versions file should have one line per dockerfileVersion
         // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
         //
@@ -69,9 +69,7 @@ public static void RecordInternalVersion(string dockerfileVersion, int stagingPi
         //
         // So for now, the separate file and format is a compromise.
 
-        var versionsFilePath = Path.GetFullPath(SpecificCommand.VersionsFilename);
-        var versionsFileDir = Path.GetDirectoryName(versionsFilePath) ?? "";
-        var internalVersionFile = Path.Combine(versionsFileDir, InternalVersionsFile);
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
 
         InternalStagingBuilds builds;
         try
diff --git a/eng/update-dependencies/Tools.cs b/eng/update-dependencies/Tools.cs
index 4702f285e7..e3e18cd0bf 100644
--- a/eng/update-dependencies/Tools.cs
+++ b/eng/update-dependencies/Tools.cs
@@ -28,11 +28,11 @@ public static async Task<GitHubReleaseInfo> GetToolBuildInfoAsync(string tool) =
             _ => throw new ArgumentException($"Unknown tool {tool}", nameof(tool)),
         };
 
-    public static IEnumerable<IDependencyUpdater> GetToolUpdaters(string repoRoot) =>
+    public static IEnumerable<IDependencyUpdater> GetToolUpdaters(string manifestVersionsFilePath) =>
     [
-        ..MinGitUpdater.GetUpdaters(repoRoot),
-        ..ChiselUpdater.GetUpdaters(repoRoot),
-        RocksToolboxUpdater.GetUpdater(repoRoot),
-        SyftUpdater.GetUpdater(repoRoot),
+        ..MinGitUpdater.GetUpdaters(manifestVersionsFilePath),
+        ..ChiselUpdater.GetUpdaters(manifestVersionsFilePath),
+        RocksToolboxUpdater.GetUpdater(manifestVersionsFilePath),
+        SyftUpdater.GetUpdater(manifestVersionsFilePath),
     ];
 }
diff --git a/eng/update-dependencies/VariableUpdaterBase.cs b/eng/update-dependencies/VariableUpdaterBase.cs
index d50aa2a2de..e2f9721476 100644
--- a/eng/update-dependencies/VariableUpdaterBase.cs
+++ b/eng/update-dependencies/VariableUpdaterBase.cs
@@ -12,10 +12,10 @@ internal abstract class VariableUpdaterBase : FileRegexUpdater
     protected string VariableName { get; }
     protected Lazy<JObject> ManifestVariables { get; }
 
-    public VariableUpdaterBase(string repoRoot, string variableName)
+    public VariableUpdaterBase(string manifestVersionsFilePath, string variableName)
     {
         VariableName = variableName;
-        Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+        Path = manifestVersionsFilePath;
         VersionGroupName = "val";
         Regex = ManifestHelper.GetManifestVariableRegex(variableName, @$"(?<{VersionGroupName}>\S*)");
 
@@ -23,10 +23,10 @@ public VariableUpdaterBase(string repoRoot, string variableName)
             () =>
             {
                 const string VariablesProperty = "variables";
-                JToken? variables = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename)[VariablesProperty];
+                JToken? variables = ManifestHelper.LoadManifest(manifestVersionsFilePath)[VariablesProperty];
                 if (variables is null)
                 {
-                    throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{SpecificCommand.VersionsFilename}'");
+                    throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{manifestVersionsFilePath}'");
                 }
                 return (JObject)variables;
             });
diff --git a/eng/update-dependencies/VersionUpdater.cs b/eng/update-dependencies/VersionUpdater.cs
index cc318b4d6a..131dec8179 100644
--- a/eng/update-dependencies/VersionUpdater.cs
+++ b/eng/update-dependencies/VersionUpdater.cs
@@ -23,7 +23,7 @@ public class VersionUpdater : FileRegexUpdater
         private readonly SpecificCommandOptions _options;
         private readonly VersionType _versionType;
 
-        public VersionUpdater(VersionType versionType, string productName, string dockerfileVersion, string repoRoot, SpecificCommandOptions options)
+        public VersionUpdater(VersionType versionType, string productName, string dockerfileVersion, SpecificCommandOptions options)
         {
             _productName = productName;
             _options = options;
@@ -32,7 +32,7 @@ public VersionUpdater(VersionType versionType, string productName, string docker
 
             Trace.TraceInformation($"Updating {versionVariableName}");
 
-            Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+            Path = options.GetManifestVersionsFilePath();
             VersionGroupName = s_versionGroupName;
             Regex = GetVersionVariableRegex(versionVariableName);
         }

From 2eb7c5edfb5f41dca880d6a09c8b61fecfd7531b Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 14:05:16 -0700
Subject: [PATCH 09/27] Make InternalVersionsHelper into a service

---
 .../FromStagingPipelineCommand.cs             |  6 +-
 eng/update-dependencies/Program.cs            |  1 +
 .../Sync/InternalVersionsHelper.cs            | 71 ++++++++++++-------
 .../Sync/SyncInternalReleaseCommand.cs        |  2 +
 .../SyncInternalReleaseTests.cs               |  2 +
 5 files changed, 56 insertions(+), 26 deletions(-)

diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index 2d47d1f1be..bd820a38b6 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -8,11 +8,13 @@ namespace Dotnet.Docker;
 
 internal partial class FromStagingPipelineCommand(
     ILogger<FromStagingPipelineCommand> logger,
-    PipelineArtifactProvider pipelineArtifactProvider)
+    PipelineArtifactProvider pipelineArtifactProvider,
+    IInternalVersionsService internalVersionsService)
     : BaseCommand<FromStagingPipelineOptions>
 {
     private readonly ILogger<FromStagingPipelineCommand> _logger = logger;
     private readonly PipelineArtifactProvider _pipelineArtifactProvider = pipelineArtifactProvider;
+    private readonly IInternalVersionsService _internalVersionsService = internalVersionsService;
 
     public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
     {
@@ -45,7 +47,7 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         string dockerfileVersion = VersionHelper.ResolveMajorMinorVersion(releaseConfig.RuntimeBuild).ToString();
 
         // Record pipeline run ID for this dockerfileVersion, for later use by sync-internal-release command
-        InternalVersionsHelper.RecordInternalVersion(
+        _internalVersionsService.RecordInternalStagingBuild(
             options.RepoRoot,
             dockerfileVersion,
             options.StagingPipelineRunId);
diff --git a/eng/update-dependencies/Program.cs b/eng/update-dependencies/Program.cs
index f965c1f061..b36497409f 100644
--- a/eng/update-dependencies/Program.cs
+++ b/eng/update-dependencies/Program.cs
@@ -128,6 +128,7 @@
 
                 services.AddSingleton<AzdoAuthProvider>();
                 services.AddSingleton<PipelineArtifactProvider>();
+                services.AddSingleton<IInternalVersionsService, InternalVersionsService>();
 
                 // Dependencies that can be updated using the FromComponentCommand
                 services.AddKeyedSingleton<IDependencyVersionSource, ChiselVersionSource>("chisel");
diff --git a/eng/update-dependencies/Sync/InternalVersionsHelper.cs b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
index f5b1b0101d..de7323c46c 100644
--- a/eng/update-dependencies/Sync/InternalVersionsHelper.cs
+++ b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
@@ -41,22 +41,57 @@ public override string ToString() =>
         string.Join(Environment.NewLine, Versions.Select(kv => $"{kv.Key}={kv.Value}"));
 }
 
-internal static class InternalVersionsHelper
+/// <summary>
+/// Abstraction for recording and reading internal staging build information
+/// local to the repo.
+/// </summary>
+/// <remarks>
+/// This can be used by the sync-internal-release pipeline to record and
+/// re-apply the same staging builds after resetting the state of the repo to
+/// match the public release branch.
+/// </remarks>
+internal interface IInternalVersionsService
 {
-    public const string InternalVersionsFileName = "internal-versions.txt";
-
     /// <summary>
-    /// Records the staging pipeline run ID in an easy to parse format. This
-    /// can be used by the sync-internal-release pipeline to record and
-    /// re-apply the same staging builds after resetting the state of the repo
-    /// to match the public release branch.
+    /// Records a staging pipeline run ID in the repo.
     /// </summary>
     /// <remarks>
-    /// This will only store one staging pipeline run ID per dockerfileVersion
+    /// This will only store one staging pipeline run ID per dockerfileVersion.
+    /// If a version already exists for the same dockerfileVersion, it will be
+    /// overwritten.
     /// </remarks>
     /// <param name="dockerfileVersion">major-minor version</param>
     /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    public static void RecordInternalVersion(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
+    void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId);
+
+    /// <summary>
+    /// Gets any previously recorded internal staging builds in the repo.
+    /// </summary>
+    InternalStagingBuilds GetInternalStagingBuilds(string repoRoot);
+}
+
+/// <inheritdoc/>
+internal sealed class InternalVersionsService : IInternalVersionsService
+{
+    private const string InternalVersionsFileName = "internal-versions.txt";
+
+    /// <inheritdoc/>
+    public InternalStagingBuilds GetInternalStagingBuilds(string repoRoot)
+    {
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
+        try
+        {
+            var fileContents = File.ReadAllLines(internalVersionFile);
+            return InternalStagingBuilds.Parse(fileContents);
+        }
+        catch (FileNotFoundException)
+        {
+            return new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
+        }
+    }
+
+    /// <inheritdoc/>
+    public void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
     {
         // Internal versions file should have one line per dockerfileVersion
         // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
@@ -69,22 +104,10 @@ public static void RecordInternalVersion(string repoRoot, string dockerfileVersi
         //
         // So for now, the separate file and format is a compromise.
 
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        var builds = GetInternalStagingBuilds(repoRoot).Add(dockerfileVersion, stagingPipelineRunId);
         var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
-
-        InternalStagingBuilds builds;
-        try
-        {
-            // File already exists - read existing versions
-            var fileContents = File.ReadAllLines(internalVersionFile);
-            builds = InternalStagingBuilds.Parse(fileContents);
-        }
-        catch (FileNotFoundException)
-        {
-            // File doesn't exist - it will be created
-            builds = new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
-        }
-
-        builds = builds.Add(dockerfileVersion, stagingPipelineRunId);
         File.WriteAllText(internalVersionFile, builds.ToString());
     }
 }
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index e8df83d971..910cd249cc 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -21,11 +21,13 @@ namespace Dotnet.Docker.Sync;
 internal sealed class SyncInternalReleaseCommand(
     IGitRepoHelperFactory gitRepoHelperFactory,
     ICommand<FromStagingPipelineOptions> updateFromStagingPipeline,
+    IInternalVersionsService internalVersionsService,
     ILogger<SyncInternalReleaseCommand> logger
 ) : BaseCommand<SyncInternalReleaseOptions>
 {
     private readonly IGitRepoHelperFactory _gitRepoHelperFactory = gitRepoHelperFactory;
     private readonly ICommand<FromStagingPipelineOptions> _updateFromStagingPipeline = updateFromStagingPipeline;
+    private readonly IInternalVersionsService _internalVersionsService = internalVersionsService;
     private readonly ILogger<SyncInternalReleaseCommand> _logger = logger;
 
     public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index afd4e3d784..e9d16e660b 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -37,12 +37,14 @@ public sealed class SyncInternalReleaseTests
     private SyncInternalReleaseCommand CreateCommand(
         IGitRepoHelperFactory? repoFactory = null,
         ICommand<FromStagingPipelineOptions>? fromStagingPipelineCommand = null,
+        IInternalVersionsService? internalVersionsService = null,
         ILogger<SyncInternalReleaseCommand>? logger = null)
     {
         // New parameters should be null by default and initialized with mocks if not specified.
         return new(
             repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
             fromStagingPipelineCommand ?? Mock.Of<ICommand<FromStagingPipelineOptions>>(),
+            internalVersionsService ?? Mock.Of<IInternalVersionsService>(),
             logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>()
         );
     }

From 398e89fa2c3675e95afba17b51fce1ef8b0b86ee Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Wed, 1 Oct 2025 14:06:59 -0700
Subject: [PATCH 10/27] Split InternalVersions* into one file per type

---
 .../Sync/IInternalVersionsService.cs          |  33 +++++
 .../Sync/InternalStagingBuilds.cs             |  42 +++++++
 .../Sync/InternalVersionsHelper.cs            | 113 ------------------
 .../Sync/InternalVersionsService.cs           |  48 ++++++++
 4 files changed, 123 insertions(+), 113 deletions(-)
 create mode 100644 eng/update-dependencies/Sync/IInternalVersionsService.cs
 create mode 100644 eng/update-dependencies/Sync/InternalStagingBuilds.cs
 delete mode 100644 eng/update-dependencies/Sync/InternalVersionsHelper.cs
 create mode 100644 eng/update-dependencies/Sync/InternalVersionsService.cs

diff --git a/eng/update-dependencies/Sync/IInternalVersionsService.cs b/eng/update-dependencies/Sync/IInternalVersionsService.cs
new file mode 100644
index 0000000000..576c29c7eb
--- /dev/null
+++ b/eng/update-dependencies/Sync/IInternalVersionsService.cs
@@ -0,0 +1,33 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker.Sync;
+
+/// <summary>
+/// Abstraction for recording and reading internal staging build information
+/// local to the repo.
+/// </summary>
+/// <remarks>
+/// This can be used by the sync-internal-release pipeline to record and
+/// re-apply the same staging builds after resetting the state of the repo to
+/// match the public release branch.
+/// </remarks>
+internal interface IInternalVersionsService
+{
+    /// <summary>
+    /// Records a staging pipeline run ID in the repo.
+    /// </summary>
+    /// <remarks>
+    /// This will only store one staging pipeline run ID per dockerfileVersion.
+    /// If a version already exists for the same dockerfileVersion, it will be
+    /// overwritten.
+    /// </remarks>
+    /// <param name="dockerfileVersion">major-minor version</param>
+    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
+    void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId);
+
+    /// <summary>
+    /// Gets any previously recorded internal staging builds in the repo.
+    /// </summary>
+    InternalStagingBuilds GetInternalStagingBuilds(string repoRoot);
+}
diff --git a/eng/update-dependencies/Sync/InternalStagingBuilds.cs b/eng/update-dependencies/Sync/InternalStagingBuilds.cs
new file mode 100644
index 0000000000..65136ad1b1
--- /dev/null
+++ b/eng/update-dependencies/Sync/InternalStagingBuilds.cs
@@ -0,0 +1,42 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Collections.Immutable;
+
+namespace Dotnet.Docker.Sync;
+
+/// <summary>
+/// Records information about what internal staging pipeline run IDs were used
+/// for which .NET Dockerfile versions.
+/// </summary>
+/// <param name="Versions">
+/// Mapping of Major.Minor .NET version to staging pipeline run ID.
+/// </param>
+internal sealed record InternalStagingBuilds(ImmutableDictionary<string, int> Versions)
+{
+    /// <summary>
+    /// Parses <see cref=" InternalStagingBuilds"/> from lines of text.
+    /// </summary>
+    /// <remarks>
+    /// Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+    /// </remarks>
+    public static InternalStagingBuilds Parse(IEnumerable<string> lines)
+    {
+        var versions = lines
+            .Select(line => line.Split('=', 2))
+            .Where(parts => parts.Length == 2)
+            .ToImmutableDictionary(parts => parts[0], parts => int.Parse(parts[1]));
+
+        return new InternalStagingBuilds(versions);
+    }
+
+    /// <summary>
+    /// Returns a new <see cref="InternalStagingBuilds"/> with the specified
+    /// version added.
+    /// </summary>
+    public InternalStagingBuilds Add(string dockerfileVersion, int stagingPipelineRunId) =>
+        this with { Versions = Versions.SetItem(dockerfileVersion, stagingPipelineRunId) };
+
+    public override string ToString() =>
+        string.Join(Environment.NewLine, Versions.Select(kv => $"{kv.Key}={kv.Value}"));
+}
diff --git a/eng/update-dependencies/Sync/InternalVersionsHelper.cs b/eng/update-dependencies/Sync/InternalVersionsHelper.cs
deleted file mode 100644
index de7323c46c..0000000000
--- a/eng/update-dependencies/Sync/InternalVersionsHelper.cs
+++ /dev/null
@@ -1,113 +0,0 @@
-// Licensed to the .NET Foundation under one or more agreements.
-// The .NET Foundation licenses this file to you under the MIT license.
-
-using System.Collections.Immutable;
-
-namespace Dotnet.Docker.Sync;
-
-/// <summary>
-/// Records information about what internal staging pipeline run IDs were used
-/// for which .NET Dockerfile versions.
-/// </summary>
-/// <param name="Versions">
-/// Mapping of Major.Minor .NET version to staging pipeline run ID.
-/// </param>
-internal sealed record InternalStagingBuilds(ImmutableDictionary<string, int> Versions)
-{
-    /// <summary>
-    /// Parses <see cref=" InternalStagingBuilds"/> from lines of text.
-    /// </summary>
-    /// <remarks>
-    /// Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
-    /// </remarks>
-    public static InternalStagingBuilds Parse(IEnumerable<string> lines)
-    {
-        var versions = lines
-            .Select(line => line.Split('=', 2))
-            .Where(parts => parts.Length == 2)
-            .ToImmutableDictionary(parts => parts[0], parts => int.Parse(parts[1]));
-
-        return new InternalStagingBuilds(versions);
-    }
-
-    /// <summary>
-    /// Returns a new <see cref="InternalStagingBuilds"/> with the specified
-    /// version added.
-    /// </summary>
-    public InternalStagingBuilds Add(string dockerfileVersion, int stagingPipelineRunId) =>
-        this with { Versions = Versions.SetItem(dockerfileVersion, stagingPipelineRunId) };
-
-    public override string ToString() =>
-        string.Join(Environment.NewLine, Versions.Select(kv => $"{kv.Key}={kv.Value}"));
-}
-
-/// <summary>
-/// Abstraction for recording and reading internal staging build information
-/// local to the repo.
-/// </summary>
-/// <remarks>
-/// This can be used by the sync-internal-release pipeline to record and
-/// re-apply the same staging builds after resetting the state of the repo to
-/// match the public release branch.
-/// </remarks>
-internal interface IInternalVersionsService
-{
-    /// <summary>
-    /// Records a staging pipeline run ID in the repo.
-    /// </summary>
-    /// <remarks>
-    /// This will only store one staging pipeline run ID per dockerfileVersion.
-    /// If a version already exists for the same dockerfileVersion, it will be
-    /// overwritten.
-    /// </remarks>
-    /// <param name="dockerfileVersion">major-minor version</param>
-    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId);
-
-    /// <summary>
-    /// Gets any previously recorded internal staging builds in the repo.
-    /// </summary>
-    InternalStagingBuilds GetInternalStagingBuilds(string repoRoot);
-}
-
-/// <inheritdoc/>
-internal sealed class InternalVersionsService : IInternalVersionsService
-{
-    private const string InternalVersionsFileName = "internal-versions.txt";
-
-    /// <inheritdoc/>
-    public InternalStagingBuilds GetInternalStagingBuilds(string repoRoot)
-    {
-        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
-        try
-        {
-            var fileContents = File.ReadAllLines(internalVersionFile);
-            return InternalStagingBuilds.Parse(fileContents);
-        }
-        catch (FileNotFoundException)
-        {
-            return new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
-        }
-    }
-
-    /// <inheritdoc/>
-    public void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
-    {
-        // Internal versions file should have one line per dockerfileVersion
-        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
-        //
-        // The preferable way to do this would be to record the version in
-        // manifest.versions.json, however that would require one of the following:
-        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
-        //    important for keeping the file readable and reducing git merge conflicts
-        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
-        //
-        // So for now, the separate file and format is a compromise.
-
-        // Internal versions file should have one line per dockerfileVersion
-        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
-        var builds = GetInternalStagingBuilds(repoRoot).Add(dockerfileVersion, stagingPipelineRunId);
-        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
-        File.WriteAllText(internalVersionFile, builds.ToString());
-    }
-}
diff --git a/eng/update-dependencies/Sync/InternalVersionsService.cs b/eng/update-dependencies/Sync/InternalVersionsService.cs
new file mode 100644
index 0000000000..8e299b5206
--- /dev/null
+++ b/eng/update-dependencies/Sync/InternalVersionsService.cs
@@ -0,0 +1,48 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Collections.Immutable;
+
+namespace Dotnet.Docker.Sync;
+
+/// <inheritdoc/>
+internal sealed class InternalVersionsService : IInternalVersionsService
+{
+    private const string InternalVersionsFileName = "internal-versions.txt";
+
+    /// <inheritdoc/>
+    public InternalStagingBuilds GetInternalStagingBuilds(string repoRoot)
+    {
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
+        try
+        {
+            var fileContents = File.ReadAllLines(internalVersionFile);
+            return InternalStagingBuilds.Parse(fileContents);
+        }
+        catch (FileNotFoundException)
+        {
+            return new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
+        }
+    }
+
+    /// <inheritdoc/>
+    public void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
+    {
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        //
+        // The preferable way to do this would be to record the version in
+        // manifest.versions.json, however that would require one of the following:
+        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
+        //    important for keeping the file readable and reducing git merge conflicts
+        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
+        //
+        // So for now, the separate file and format is a compromise.
+
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        var builds = GetInternalStagingBuilds(repoRoot).Add(dockerfileVersion, stagingPipelineRunId);
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
+        File.WriteAllText(internalVersionFile, builds.ToString());
+    }
+}

From cb3230086c22b4229e322c815200737d7b1ffb39 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 08:21:01 -0700
Subject: [PATCH 11/27] Implement first pass at re-applying internal builds

---
 .../FromStagingPipelineOptions.cs             |  16 +-
 .../Sync/SyncInternalReleaseCommand.cs        | 138 ++++++++++++++++--
 .../Sync/SyncInternalReleaseOptions.cs        |  14 +-
 .../SyncInternalReleaseTests.cs               | 130 +++++++++++++++++
 4 files changed, 275 insertions(+), 23 deletions(-)

diff --git a/eng/update-dependencies/FromStagingPipelineOptions.cs b/eng/update-dependencies/FromStagingPipelineOptions.cs
index 980403bc87..02e6880882 100644
--- a/eng/update-dependencies/FromStagingPipelineOptions.cs
+++ b/eng/update-dependencies/FromStagingPipelineOptions.cs
@@ -8,7 +8,7 @@ namespace Dotnet.Docker;
 
 internal record FromStagingPipelineOptions : CreatePullRequestOptions, IOptions
 {
-    public const string StagingStorageAccountOption = "--staging-storage-account";
+    public const string StagingStorageAccountOptionName = "--staging-storage-account";
     public const string InternalOption = "--internal";
 
     /// <summary>
@@ -37,14 +37,16 @@ internal record FromStagingPipelineOptions : CreatePullRequestOptions, IOptions
         ..CreatePullRequestOptions.Arguments,
     ];
 
+    public static Option<string> StagingStorageAccountOption = new(StagingStorageAccountOptionName)
+    {
+        Description = "The Azure Storage Account to use as a source for the update."
+            + " This should be one of two storage accounts: dotnetstagetest or dotnetstage."
+            + " For example: https://dotnetstagetest.blob.core.windows.net/"
+    };
+
     public static new List<Option> Options { get; } =
     [
-        new Option<string>(StagingStorageAccountOption)
-        {
-            Description = "The Azure Storage Account to use as a source for the update."
-                + " This should be one of two storage accounts: dotnetstagetest or dotnetstage."
-                + " For example: https://dotnetstagetest.blob.core.windows.net/"
-        },
+        StagingStorageAccountOption,
         new Option<bool>(InternalOption)
         {
             Description = "Whether or not to use the internal versions of the staged build. When not using an internal"
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index 910cd249cc..30f1a5e4ce 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -89,25 +89,22 @@ await repo.Remote.CreateRemoteBranchAsync(
         if (targetIsAncestorOfSource)
         {
             _logger.LogInformation(
-                "Branch {TargetBranch} is an ancestor of {SourceBranch}",
+                "Branch {TargetBranch} is an ancestor of {SourceBranch} - creating fast-forward PR",
                 options.TargetBranch, options.SourceBranch);
 
             // "ff" here is an abbreviation for "fast-forward" - just want to keep branch names short
-            var pullRequestBranch = GetPrBranchName(action: "ff", options);
-
-            var pullRequestCreationInfo = new PullRequestCreationInfo(
-                Title: $"Fast-forward {options.TargetBranch} to {options.SourceBranch}",
-                Body: "",
-                BaseBranch: options.TargetBranch,
-                HeadBranch: pullRequestBranch);
+            var fastForwardPrBranch = GetPrBranchName(action: "ff", options);
+            await repo.Remote.CreateRemoteBranchAsync(
+                newBranch: fastForwardPrBranch,
+                baseBranch: options.SourceBranch);
 
-            await repo.Remote.CreateRemoteBranchAsync(newBranch: pullRequestBranch, baseBranch: options.SourceBranch);
-            var pullRequestApiUrl = await repo.Remote.CreatePullRequestAsync(pullRequestCreationInfo);
-            var pullRequestInfo = await repo.Remote.GetPullRequestInfoAsync(pullRequestApiUrl);
+            await CreatePullRequest(
+                repo: repo,
+                title: $"Fast-forward {options.TargetBranch} to {options.SourceBranch}",
+                body: "",
+                targetBranch: options.TargetBranch,
+                sourceBranch: fastForwardPrBranch);
 
-            _logger.LogInformation(
-                "Created pull request {PrTitle} at {PrUrl}",
-                pullRequestInfo.Title, pullRequestApiUrl);
             return 0;
         }
 
@@ -115,7 +112,118 @@ await repo.Remote.CreateRemoteBranchAsync(
             "Branch {TargetBranch} is not an ancestor of {SourceBranch}",
             options.TargetBranch, options.SourceBranch);
 
-        throw new NotImplementedException("Scenario is not yet implemented.");
+        // If we reach this point, then we know that:
+        // 1. Both branches exist on the remote.
+        // 2. The branches are at different commits.
+        // 3. The branches have diverged.
+        //
+        // Now we need to:
+        // 1. Read the internal-versions.txt file from the target branch to determine the
+        //    staging pipeline run IDs that were used for each internal .NET version.
+        // 2. Reset the target branch to the state of the source branch.
+        // 3. Re-apply internal .NET version updates.
+
+        // At this point, we need to verify that we have everything we need to
+        // access internal builds, commit changes, and submit a pull request.
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.StagingStorageAccount);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.CommitterName);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.CommitterEmail);
+        var commitAuthor = (Name: options.CommitterName, Email: options.CommitterEmail);
+
+        // Checkout both branches locally so that we can work with them directly.
+        await repo.CheckoutRemoteBranchAsync(options.SourceBranch);
+        await repo.CheckoutRemoteBranchAsync(options.TargetBranch);
+
+        var internalBuilds = _internalVersionsService.GetInternalStagingBuilds(repo.Local.LocalPath);
+
+        // Reset the target branch to match the source branch.
+        var prBranchName = GetPrBranchName(action: "sync", options);
+        await repo.Local.CreateAndCheckoutLocalBranchAsync(prBranchName);
+        await repo.Local.RestoreAsync(source: options.SourceBranch);
+        await repo.Local.StageAsync(".");
+        await repo.Local.CommitAsync(
+            message: $"Reset {options.TargetBranch} to match {options.SourceBranch} commit {sourceSha}",
+            author: commitAuthor);
+
+        // Re-apply internal .NET version updates for each recorded staging pipeline run ID.
+        foreach (var (dockerfileVersion, stagingPipelineRunId) in internalBuilds.Versions)
+        {
+            _logger.LogInformation(
+                "Re-applying internal build {BuildNumber} for .NET {DockerfileVersion}",
+                stagingPipelineRunId, dockerfileVersion);
+
+            await ApplyInternalBuildAsync(
+                localRepo: repo.Local,
+                stagingPipelineRunId: stagingPipelineRunId,
+                stagingStorageAccount: options.StagingStorageAccount,
+                committerIdentity: commitAuthor);
+        }
+
+        // Finally, submit a pull request with all of the changes.
+        await repo.PushLocalBranchAsync(prBranchName);
+        await CreatePullRequest(
+            repo: repo,
+            title: $"Sync {options.TargetBranch} with {options.SourceBranch}",
+            body: "",
+            targetBranch: options.TargetBranch,
+            sourceBranch: prBranchName);
+
+        return 0;
+    }
+
+    /// <summary>
+    /// Helper method that creates a pull request and logs the result.
+    /// </summary>
+    private async Task CreatePullRequest(
+        IGitRepoHelper repo,
+        string title,
+        string body,
+        string targetBranch,
+        string sourceBranch)
+    {
+        var pullRequestCreationInfo = new PullRequestCreationInfo(
+            Title: title,
+            Body: body,
+            BaseBranch: targetBranch,
+            HeadBranch: sourceBranch);
+
+        _logger.LogInformation("Creating pull request {PullRequestInfo}", pullRequestCreationInfo);
+        var pullRequestApiUrl = await repo.Remote.CreatePullRequestAsync(pullRequestCreationInfo);
+        var pullRequestInfo = await repo.Remote.GetPullRequestInfoAsync(pullRequestApiUrl);
+
+        _logger.LogInformation(
+            "Created pull request {PullRequestTitle} at {PullRequestUrl}",
+            pullRequestInfo.Title, pullRequestApiUrl);
+    }
+
+    /// <summary>
+    /// Apply an internal build by invoking the FromStagingPipelineCommand.
+    /// </summary>
+    /// <param name="stagingPipelineRunId">
+    /// ID of the Azure DevOps pipeline run to get build information from.
+    /// </param>
+    /// <param name="committerIdentity">
+    /// The identity to use when committing changes.
+    /// </param>
+    private async Task ApplyInternalBuildAsync(
+        ILocalGitRepoHelper localRepo,
+        int stagingPipelineRunId,
+        string stagingStorageAccount,
+        (string Name, string Email) committerIdentity)
+    {
+        var fromStagingPipelineOptions = new FromStagingPipelineOptions
+        {
+            RepoRoot = localRepo.LocalPath,
+            Internal = true,
+            StagingPipelineRunId = stagingPipelineRunId,
+            StagingStorageAccount = stagingStorageAccount,
+        };
+
+        await _updateFromStagingPipeline.ExecuteAsync(fromStagingPipelineOptions);
+        _logger.LogInformation("Applied internal build {BuildNumber}", stagingPipelineRunId);
+
+        await localRepo.StageAsync(".");
+        await localRepo.CommitAsync($"Update dependencies from build {stagingPipelineRunId}", committerIdentity);
     }
 
     private static string GetPrBranchName(string action, SyncInternalReleaseOptions options)
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
index b867ea274a..359d2b536e 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
@@ -12,13 +12,25 @@ public sealed record SyncInternalReleaseOptions : IOptions
     public string SourceBranch { get; set; } = string.Empty;
     public string TargetBranch { get; set; } = string.Empty;
     public string PrBranchPrefix { get; set; } = "pr";
+    public string CommitterName { get; set; } = string.Empty;
+    public string CommitterEmail { get; set; } = string.Empty;
+    public string StagingStorageAccount { get; set; } = string.Empty;
 
     public static List<Option> Options =>
     [
         new Option<string>("--pr-branch-prefix")
         {
             Description = "Prefix to use for branches created for pull requests",
-        }
+        },
+        new Option<string>("--committer-name")
+        {
+            Description = "Name used for git commits",
+        },
+        new Option<string>("--committer-email")
+        {
+            Description = "Email used for git commits",
+        },
+        FromStagingPipelineOptions.StagingStorageAccountOption,
     ];
 
     public static List<Argument> Arguments =>
diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index e9d16e660b..5878c41131 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -1,6 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Immutable;
 using Dotnet.Docker;
 using Dotnet.Docker.Git;
 using Dotnet.Docker.Sync;
@@ -17,6 +18,7 @@ public sealed class SyncInternalReleaseTests
     private const string AzdoProject = "test-project";
     private const string AzdoRepo = "test-repo";
     private const string RemoteAzdoUrl = $"https://dev.azure.com/{AzdoOrg}/{AzdoProject}/_git/{AzdoRepo}";
+    private const string LocalRepoPath = "/path/to/local-repo";
 
     /// <summary>
     /// Default set of command options with some correct values. These can be used in most tests.
@@ -198,4 +200,132 @@ public async Task FastForward()
             Times.Once
         );
     }
+
+    [Fact]
+    public async Task Sync()
+    {
+        var options = s_defaultOptions with
+        {
+            CommitterName = "Test User",
+            CommitterEmail = "testuser@example.com",
+            StagingStorageAccount = "dotnetstage"
+        };
+
+        // Target and source branches both exist, but at different commits,
+        // and the target branch is not an ancestor of the source branch.
+        var gitScenario = new GitTestScenario(localRepoPath: LocalRepoPath, remoteRepoUrl: RemoteAzdoUrl)
+            .AddRemoteBranch(options.SourceBranch, "0000000000000000000000000000000000000001")
+            .AddRemoteBranch(options.TargetBranch, "0000000000000000000000000000000000000002");
+
+        // Actual value of the pull request URL is not important here, just that we allow one to
+        // be created and pretend it exists afterwards.
+        const string PullRequestUrl = nameof(PullRequestUrl);
+        var pullRequestIsCreated = false;
+        gitScenario.RepoMock
+            .Setup(repo => repo.Remote.CreatePullRequestAsync(It.IsAny<PullRequestCreationInfo>()))
+            .Callback(() => pullRequestIsCreated = true)
+            .ReturnsAsync(PullRequestUrl);
+        gitScenario.RepoMock
+            .Setup(repo => repo.Remote.GetPullRequestInfoAsync(PullRequestUrl))
+            .ReturnsAsync(() => pullRequestIsCreated
+                ? Mock.Of<PullRequest>()
+                : throw new Exception($"PR {PullRequestUrl} was not created first"));
+
+        // For this scenario, two internal versions have been checked in to this repo.
+        var internalVersions = new Dictionary<string, int> { { "8.0", 8000000 }, { "10.0", 1000000 } };
+        var internalVersionsService = CreateInternalVersionsService(LocalRepoPath, internalVersions);
+
+        var fromStagingPipelineCommandMock = new Mock<ICommand<FromStagingPipelineOptions>>();
+
+        var syncCommand = CreateCommand(
+            repoFactory: gitScenario.RepoFactoryMock.Object,
+            fromStagingPipelineCommand: fromStagingPipelineCommandMock.Object,
+            internalVersionsService: internalVersionsService);
+
+        // Run the command
+        var exitCode = await syncCommand.ExecuteAsync(options);
+        exitCode.ShouldBe(0);
+
+        // Verify that we re-applied all internal versions
+        foreach ((string dotnetVersion, int buildId) in internalVersions)
+        {
+            fromStagingPipelineCommandMock.Verify(command =>
+                command.ExecuteAsync(It.Is<FromStagingPipelineOptions>(o =>
+                    o.RepoRoot == LocalRepoPath
+                    && o.StagingPipelineRunId == buildId
+                    && o.StagingStorageAccount == options.StagingStorageAccount
+                )),
+                Times.Once
+            );
+        }
+
+        // Verify that we created the expected number of commits.
+        // There should be one commit for resetting the target branch to match
+        // the source branch, and then one commit for each internal version
+        // that was re-applied.
+        var numberOfCommits = 1 + internalVersions.Count;
+        gitScenario.RepoMock.Verify(
+            repo => repo.Local.CommitAsync(
+                It.IsAny<string>(),
+                It.Is<(string Name, string Email)>(author =>
+                    author.Name == options.CommitterName && author.Email == options.CommitterEmail
+                )
+            ),
+            Times.Exactly(numberOfCommits)
+        );
+
+        // Verify that we pushed the updated target branch.
+        gitScenario.RepoMock.Verify(repo => repo.PushLocalBranchAsync(It.IsAny<string>()), Times.Once());
+
+        // Verify that we created exactly one pull request.
+        gitScenario.RepoMock.Verify(
+            repo => repo.Remote.CreatePullRequestAsync(
+                It.Is<PullRequestCreationInfo>(
+                    pr => pr.HeadBranch != options.SourceBranch && pr.BaseBranch == options.TargetBranch
+                )
+            ),
+            Times.Once()
+        );
+    }
+
+    /// <summary>
+    /// Helper method to create a mock version of <see cref="IInternalVersionsService"/>
+    /// </summary>
+    private static IInternalVersionsService CreateInternalVersionsService(
+        string repoPath, Dictionary<string, int> versions)
+    {
+        var internalStagingBuilds = new InternalStagingBuilds(versions.ToImmutableDictionary());
+
+        var mock = new Mock<IInternalVersionsService>();
+        mock.Setup(s => s.GetInternalStagingBuilds(repoPath))
+            .Returns(internalStagingBuilds);
+
+        return mock.Object;
+    }
+
+    private class GitTestScenario
+    {
+        public Mock<IGitRepoHelper> RepoMock { get; } = new();
+        public Mock<IGitRepoHelperFactory> RepoFactoryMock { get; } = new();
+
+        public GitTestScenario(string localRepoPath, string remoteRepoUrl)
+        {
+            RepoMock.Setup(r => r.Local.LocalPath).Returns(localRepoPath);
+            RepoFactoryMock.Setup(f => f.CreateAsync(remoteRepoUrl)).ReturnsAsync(RepoMock.Object);
+        }
+
+        public GitTestScenario AddRemoteBranch(string branchName, string commitSha)
+        {
+            RepoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(branchName)).ReturnsAsync(true);
+            RepoMock.Setup(r => r.Remote.GetRemoteBranchShaAsync(branchName)).ReturnsAsync(commitSha);
+            return this;
+        }
+
+        public GitTestScenario SetAncestor(string descendantBranch, string ancestorBranch)
+        {
+            RepoMock.Setup(r => r.Local.IsAncestorAsync($"origin/{ancestorBranch}", $"origin/{descendantBranch}"))
+                .ReturnsAsync(true);
+            return this;
+        }
+    }
 }

From 996a5f73fb94f359efd0a5de0262ecbe538f45ab Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 09:20:53 -0700
Subject: [PATCH 12/27] Clean up tests and add more comments

---
 .../SyncInternalReleaseTests.cs               | 62 ++++++++++++-------
 1 file changed, 41 insertions(+), 21 deletions(-)

diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index 5878c41131..70b07db2a6 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -32,25 +32,6 @@ public sealed class SyncInternalReleaseTests
         TargetBranch = InternalReleaseBranch
     };
 
-    /// <summary>
-    /// Helper method to create a <see cref="SyncInternalReleaseCommand"/> instance with optional
-    /// mocked dependencies. If dependencies are not provided, default mocks will be used.
-    /// </summary>
-    private SyncInternalReleaseCommand CreateCommand(
-        IGitRepoHelperFactory? repoFactory = null,
-        ICommand<FromStagingPipelineOptions>? fromStagingPipelineCommand = null,
-        IInternalVersionsService? internalVersionsService = null,
-        ILogger<SyncInternalReleaseCommand>? logger = null)
-    {
-        // New parameters should be null by default and initialized with mocks if not specified.
-        return new(
-            repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
-            fromStagingPipelineCommand ?? Mock.Of<ICommand<FromStagingPipelineOptions>>(),
-            internalVersionsService ?? Mock.Of<IInternalVersionsService>(),
-            logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>()
-        );
-    }
-
     /// <summary>
     /// Calling the command with null or whitespace for any of the arguments should fail.
     /// </summary>
@@ -201,13 +182,19 @@ public async Task FastForward()
         );
     }
 
+    /// <summary>
+    /// If the target and source branches have diverged, then a pull request
+    /// should be created that resets the target branch to match the source
+    /// branch, re-applying any internal .NET version updates that already
+    /// existed on the target branch.
+    /// </summary>
     [Fact]
     public async Task Sync()
     {
         var options = s_defaultOptions with
         {
             CommitterName = "Test User",
-            CommitterEmail = "testuser@example.com",
+            CommitterEmail = "test@example.com",
             StagingStorageAccount = "dotnetstage"
         };
 
@@ -246,7 +233,7 @@ public async Task Sync()
         var exitCode = await syncCommand.ExecuteAsync(options);
         exitCode.ShouldBe(0);
 
-        // Verify that we re-applied all internal versions
+        // Verify that we re-applied all internal versions by calling the downstream command.
         foreach ((string dotnetVersion, int buildId) in internalVersions)
         {
             fromStagingPipelineCommandMock.Verify(command =>
@@ -288,6 +275,21 @@ public async Task Sync()
         );
     }
 
+    /// <summary>
+    /// Helper method to create a <see cref="SyncInternalReleaseCommand"/> instance with optional
+    /// mocked dependencies. If dependencies are not provided, default mocks will be used.
+    /// </summary>
+    private SyncInternalReleaseCommand CreateCommand(
+        IGitRepoHelperFactory? repoFactory = null,
+        ICommand<FromStagingPipelineOptions>? fromStagingPipelineCommand = null,
+        IInternalVersionsService? internalVersionsService = null,
+        ILogger<SyncInternalReleaseCommand>? logger = null) =>
+            // New parameters should be null by default and initialized with mocks if not specified.
+            new(repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
+                fromStagingPipelineCommand ?? Mock.Of<ICommand<FromStagingPipelineOptions>>(),
+                internalVersionsService ?? Mock.Of<IInternalVersionsService>(),
+                logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+
     /// <summary>
     /// Helper method to create a mock version of <see cref="IInternalVersionsService"/>
     /// </summary>
@@ -303,17 +305,31 @@ private static IInternalVersionsService CreateInternalVersionsService(
         return mock.Object;
     }
 
+    /// <summary>
+    /// Helper class for setting up scenarios on a <see cref="IGitRepoHelper"/> mock.
+    /// </summary>
     private class GitTestScenario
     {
         public Mock<IGitRepoHelper> RepoMock { get; } = new();
+
+        /// <summary>
+        /// Factory that returns <see cref="RepoMock"/> when
+        /// <see cref="IGitRepoHelperFactory.CreateAsync"/> is called.
+        /// </summary>
         public Mock<IGitRepoHelperFactory> RepoFactoryMock { get; } = new();
 
+        /// <summary>
+        /// Create a new scenario for the given local and remote repos.
+        /// </summary>
         public GitTestScenario(string localRepoPath, string remoteRepoUrl)
         {
             RepoMock.Setup(r => r.Local.LocalPath).Returns(localRepoPath);
             RepoFactoryMock.Setup(f => f.CreateAsync(remoteRepoUrl)).ReturnsAsync(RepoMock.Object);
         }
 
+        /// <summary>
+        /// Pretend that a branch exists on the remote with the given name and commit SHA.
+        /// </summary>
         public GitTestScenario AddRemoteBranch(string branchName, string commitSha)
         {
             RepoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(branchName)).ReturnsAsync(true);
@@ -321,6 +337,10 @@ public GitTestScenario AddRemoteBranch(string branchName, string commitSha)
             return this;
         }
 
+        /// <summary>
+        /// Declare that <paramref name="ancestorBranch"/> is an ancestor of
+        /// <paramref name="descendantBranch"/>.
+        /// </summary>
         public GitTestScenario SetAncestor(string descendantBranch, string ancestorBranch)
         {
             RepoMock.Setup(r => r.Local.IsAncestorAsync($"origin/{ancestorBranch}", $"origin/{descendantBranch}"))

From ff5af1a888b7addc2866dcbfc1fc44a331976314 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 10:11:11 -0700
Subject: [PATCH 13/27] Add extra logging to GitRepoHelperFactory

---
 eng/update-dependencies/Git/GitRepoHelperFactory.cs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/eng/update-dependencies/Git/GitRepoHelperFactory.cs b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
index 8db2d180bc..70996dfcbf 100644
--- a/eng/update-dependencies/Git/GitRepoHelperFactory.cs
+++ b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
@@ -17,12 +17,14 @@ internal interface IGitRepoHelperFactory
 }
 
 internal sealed class GitRepoHelperFactory(
+    ILogger<GitRepoHelperFactory> logger,
     IGitRepoCloner gitRepoCloner,
     ILocalGitRepoFactory localGitRepoFactory,
     IRemoteGitRepoFactory remoteFactory,
     IServiceProvider serviceProvider
 ) : IGitRepoHelperFactory
 {
+    private readonly ILogger<GitRepoHelperFactory> _logger = logger;
     private readonly IGitRepoCloner _gitRepoCloner = gitRepoCloner;
     private readonly ILocalGitRepoFactory _localGitRepoFactory = localGitRepoFactory;
     private readonly IRemoteGitRepoFactory _remoteFactory = remoteFactory;
@@ -38,6 +40,7 @@ await _gitRepoCloner.CloneAsync(
             targetDirectory: localCloneDir,
             checkoutSubmodules: false,
             gitDirectory: null);
+        _logger.LogInformation("Cloned '{RepoUri}' to '{LocalCloneDir}'", repoUri, localCloneDir);
 
         var localGitRepo = _localGitRepoFactory.Create(new NativePath(localCloneDir));
         var localGitRepoHelper = new LocalGitRepoHelper(

From 4bd8a4963a2da3494d8b0242b56f95a8873660e4 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:47:11 -0700
Subject: [PATCH 14/27] Checkout ref instead of checkout branch for remote
 branches

---
 eng/update-dependencies/Git/GitRepoHelper.cs       | 2 +-
 eng/update-dependencies/Git/ILocalGitRepoHelper.cs | 6 +++---
 eng/update-dependencies/Git/LocalGitRepoHelper.cs  | 7 +++----
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/eng/update-dependencies/Git/GitRepoHelper.cs b/eng/update-dependencies/Git/GitRepoHelper.cs
index 1558bb1488..af052a17ce 100644
--- a/eng/update-dependencies/Git/GitRepoHelper.cs
+++ b/eng/update-dependencies/Git/GitRepoHelper.cs
@@ -55,7 +55,7 @@ public async Task CheckoutRemoteBranchAsync(string branchName)
             throw new InvalidBranchException($"Branch '{branchName}' does not exist on remote.");
         }
 
-        await Local.CheckoutBranchAsync(branchName);
+        await Local.CheckoutRefAsync($"origin/{branchName}");
     }
 
     /// <inheritdoc />
diff --git a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
index 4c49eeae4a..368e86e554 100644
--- a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
@@ -22,10 +22,10 @@ internal interface ILocalGitRepoHelper
     Task<string> CommitAsync(string message, (string Name, string Email) author);
 
     /// <summary>
-    /// Check out a local branch.
+    /// Check out a git ref locally.
     /// </summary>
-    /// <param name="branchName">A branch that exists locally.</param>
-    Task CheckoutBranchAsync(string branchName);
+    /// <param name="gitRef">A git ref that exists locally.</param>
+    Task CheckoutRefAsync(string gitRef);
 
     /// <summary>
     /// Create a new local branch. This does not push the branch to the remote.
diff --git a/eng/update-dependencies/Git/LocalGitRepoHelper.cs b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
index 1486ce426b..fa54c8dd44 100644
--- a/eng/update-dependencies/Git/LocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
@@ -33,11 +33,10 @@ public async Task CreateAndCheckoutLocalBranchAsync(string branchName)
     }
 
     /// <inheritdoc />
-    public Task CheckoutBranchAsync(string branchName)
+    public Task CheckoutRefAsync(string gitRef)
     {
-        var branchRef = $"refs/heads/{branchName}";
-        _logger.LogInformation("Checking out ref {BranchRef}", branchRef);
-        return _localGitRepo.CheckoutAsync(branchRef);
+        _logger.LogInformation("Checking out ref {GitRef}", gitRef);
+        return _localGitRepo.CheckoutAsync(gitRef);
     }
 
     /// <inheritdoc />

From 5545b067cec47630569c01ee6bd749633a498831 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:49:06 -0700
Subject: [PATCH 15/27] Add extra git logging

---
 .../Git/LocalGitRepoHelper.cs                 | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/eng/update-dependencies/Git/LocalGitRepoHelper.cs b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
index fa54c8dd44..5de9bc9914 100644
--- a/eng/update-dependencies/Git/LocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
@@ -62,8 +62,22 @@ public async Task StageAsync(params IEnumerable<string> paths)
     /// <inheritdoc />
     public async Task<string> CommitAsync(string message, (string Name, string Email) author)
     {
+        var gitStatusLines = await _localGitRepo.RunGitCommandAsync(["status"]);
+        var gitStatus = string.Join(Environment.NewLine, gitStatusLines);
+        _logger.LogInformation(
+            """
+            Git status:
+            {gitStatus}
+            """,
+            gitStatus);
+
         await _localGitRepo.CommitAsync(message, allowEmpty: false, author);
         var commitSha = await _localGitRepo.GetShaForRefAsync("HEAD");
+
+        _logger.LogInformation(
+            "Created commit {commitSha}, message: '{commitMessage}' ({authorName} <{authorEmail}>)",
+            commitSha, message, author.Name, author.Email);
+
         return commitSha;
     }
 
@@ -100,8 +114,9 @@ public async Task<IEnumerable<GitRemoteInfo>> ListAllRemotesAsync()
     }
 
     /// <inheritdoc />
-    public async Task RestoreAsync(string source)
+    public Task RestoreAsync(string source)
     {
-        await _localGitRepo.ExecuteGitCommand("restore", "--source", source);
+        _logger.LogInformation("Restoring working tree from source {Source}", source);
+        return _localGitRepo.ExecuteGitCommand("restore", "--source", source, ".");
     }
 }

From c4b5cd76d7d257528101c8d53986b659148f9568 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:50:23 -0700
Subject: [PATCH 16/27] Prevent duplicate logging when calling SpecificCommand
 more than once

---
 eng/update-dependencies/SpecificCommand.cs | 24 +++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index 04b46f795f..f077ab93d7 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -18,7 +18,6 @@ namespace Dotnet.Docker
 {
     public class SpecificCommand : BaseCommand<SpecificCommandOptions>
     {
-
         private static SpecificCommandOptions? s_options;
 
         private static SpecificCommandOptions Options {
@@ -29,12 +28,15 @@ private static SpecificCommandOptions Options {
         public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
         {
             Options = options;
+            int exitCode = 0;
+
+            ErrorTraceListener errorTraceListener = new();
+            TextWriterTraceListener consoleTraceListener = new TextWriterTraceListener(Console.Out);
+            Trace.Listeners.Add(errorTraceListener);
+            Trace.Listeners.Add(consoleTraceListener);
 
             try
             {
-                ErrorTraceListener errorTraceListener = new();
-                Trace.Listeners.Add(errorTraceListener);
-                Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));
 
                 IDependencyInfo[] productBuildInfos = Options.ProductVersions
                     .Select(kvp => CreateDependencyBuildInfo(kvp.Key, kvp.Value))
@@ -114,10 +116,18 @@ public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
             catch (Exception e)
             {
                 Console.Error.WriteLine($"Failed to update dependencies:{Environment.NewLine}{e}");
-                Environment.Exit(1);
+                exitCode = 1;
+            }
+            finally
+            {
+                Trace.Listeners.Remove(errorTraceListener);
+                Trace.Listeners.Remove(consoleTraceListener);
+                errorTraceListener.Dispose();
+                consoleTraceListener.Dispose();
+                s_options = null;
             }
 
-            return 0;
+            return exitCode;
         }
 
         private static DependencyUpdateResults UpdateFiles(
@@ -396,7 +406,7 @@ private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
             return updaters;
         }
 
-        private IEnumerable<IDependencyUpdater> GetGeneratedContentUpdaters() =>
+        private static IEnumerable<IDependencyUpdater> GetGeneratedContentUpdaters() =>
         [
             ScriptRunnerUpdater.GetDockerfileUpdater(Options.RepoRoot),
             ScriptRunnerUpdater.GetReadMeUpdater(Options.RepoRoot)

From 9c4414ce1fed7584a52d0e54ff3dfebd6f37ca40 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:50:43 -0700
Subject: [PATCH 17/27] Allow multi-line log output

---
 eng/update-dependencies/Program.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/update-dependencies/Program.cs b/eng/update-dependencies/Program.cs
index b36497409f..f4e126f650 100644
--- a/eng/update-dependencies/Program.cs
+++ b/eng/update-dependencies/Program.cs
@@ -62,7 +62,7 @@
                 logging.AddSimpleConsole(options =>
                 {
                     options.IncludeScopes = true;
-                    options.SingleLine = true;
+                    options.SingleLine = false;
                 });
             })
         .ConfigureServices(services =>

From 9d4f4b0e011c8805cb966bf2d5d299834e9f766e Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:52:44 -0700
Subject: [PATCH 18/27] Use existing CreatePullRequestOptions for
 SyncInternalReleaseCommand

---
 .../Sync/SyncInternalReleaseCommand.cs        | 40 ++++++++++++++-----
 .../Sync/SyncInternalReleaseOptions.cs        | 34 +++-------------
 2 files changed, 35 insertions(+), 39 deletions(-)

diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index 30f1a5e4ce..ca36edc9bb 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -32,10 +32,17 @@ ILogger<SyncInternalReleaseCommand> logger
 
     public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
     {
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.RemoteUrl);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoOrganization);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoProject);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoRepo);
         ArgumentException.ThrowIfNullOrWhiteSpace(options.TargetBranch);
         ArgumentException.ThrowIfNullOrWhiteSpace(options.SourceBranch);
 
+        // AzdoOrganization is a URL like https://dev.azure.com/<org>
+        // A valid Azure DevOps repository URL is formatted like https://dev.azure.com/<org>/<project>/_git/<repo>
+        var remoteUri = new Uri($"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_git/{options.AzdoRepo}");
+        var remoteUrl = remoteUri.ToString();
+
         // Do not allow syncing starting from an internal branch.
         if (options.SourceBranch.StartsWith("internal/", StringComparison.OrdinalIgnoreCase))
         {
@@ -43,7 +50,7 @@ public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
                 $"The source branch '{options.SourceBranch}' cannot be an internal branch.");
         }
 
-        using var repo = await _gitRepoHelperFactory.CreateAsync(options.RemoteUrl);
+        using var repo = await _gitRepoHelperFactory.CreateAsync(remoteUrl);
 
         // Verify that the source branch exists on the remote.
         var sourceBranchExists = await repo.Remote.RemoteBranchExistsAsync(options.SourceBranch);
@@ -126,9 +133,9 @@ await CreatePullRequest(
         // At this point, we need to verify that we have everything we need to
         // access internal builds, commit changes, and submit a pull request.
         ArgumentException.ThrowIfNullOrWhiteSpace(options.StagingStorageAccount);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.CommitterName);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.CommitterEmail);
-        var commitAuthor = (Name: options.CommitterName, Email: options.CommitterEmail);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.User);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.Email);
+        var commitAuthor = (Name: options.User, Email: options.Email);
 
         // Checkout both branches locally so that we can work with them directly.
         await repo.CheckoutRemoteBranchAsync(options.SourceBranch);
@@ -148,11 +155,8 @@ await repo.Local.CommitAsync(
         // Re-apply internal .NET version updates for each recorded staging pipeline run ID.
         foreach (var (dockerfileVersion, stagingPipelineRunId) in internalBuilds.Versions)
         {
-            _logger.LogInformation(
-                "Re-applying internal build {BuildNumber} for .NET {DockerfileVersion}",
-                stagingPipelineRunId, dockerfileVersion);
-
             await ApplyInternalBuildAsync(
+                options: options,
                 localRepo: repo.Local,
                 stagingPipelineRunId: stagingPipelineRunId,
                 stagingStorageAccount: options.StagingStorageAccount,
@@ -206,21 +210,37 @@ private async Task CreatePullRequest(
     /// The identity to use when committing changes.
     /// </param>
     private async Task ApplyInternalBuildAsync(
+        SyncInternalReleaseOptions options,
         ILocalGitRepoHelper localRepo,
         int stagingPipelineRunId,
         string stagingStorageAccount,
         (string Name, string Email) committerIdentity)
     {
+        // Example build URL: https://dev.azure.com/<org>/<project>/_build/results?buildId=<stagingPipelineRunId>
+        var buildUrl = $"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_build/results?buildId={stagingPipelineRunId}";
+
+        _logger.LogInformation(
+            "Applying internal build {BuildNumber} ({BuildUrl})",
+            stagingPipelineRunId, buildUrl);
+        _logger.LogInformation(
+            "Ignore any git-related logging output below, because git "
+            + "operations are being managed by a different command.");
+
         var fromStagingPipelineOptions = new FromStagingPipelineOptions
         {
             RepoRoot = localRepo.LocalPath,
             Internal = true,
             StagingPipelineRunId = stagingPipelineRunId,
             StagingStorageAccount = stagingStorageAccount,
+            AzdoOrganization = options.AzdoOrganization,
+            AzdoProject = options.AzdoProject,
+            AzdoRepo = options.AzdoRepo,
         };
 
         await _updateFromStagingPipeline.ExecuteAsync(fromStagingPipelineOptions);
-        _logger.LogInformation("Applied internal build {BuildNumber}", stagingPipelineRunId);
+        _logger.LogInformation(
+            "Finished applying internal build {BuildNumber} ({BuildUrl})",
+            stagingPipelineRunId, buildUrl);
 
         await localRepo.StageAsync(".");
         await localRepo.CommitAsync($"Update dependencies from build {stagingPipelineRunId}", committerIdentity);
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
index 359d2b536e..4f5b4cb455 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
@@ -1,51 +1,27 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System.Collections.Generic;
 using System.CommandLine;
 
 namespace Dotnet.Docker.Sync;
 
-public sealed record SyncInternalReleaseOptions : IOptions
+public sealed record SyncInternalReleaseOptions : CreatePullRequestOptions, IOptions
 {
-    public string RemoteUrl { get; set; } = string.Empty;
-    public string SourceBranch { get; set; } = string.Empty;
-    public string TargetBranch { get; set; } = string.Empty;
     public string PrBranchPrefix { get; set; } = "pr";
-    public string CommitterName { get; set; } = string.Empty;
-    public string CommitterEmail { get; set; } = string.Empty;
     public string StagingStorageAccount { get; set; } = string.Empty;
 
-    public static List<Option> Options =>
+    public static new List<Option> Options =>
     [
         new Option<string>("--pr-branch-prefix")
         {
             Description = "Prefix to use for branches created for pull requests",
         },
-        new Option<string>("--committer-name")
-        {
-            Description = "Name used for git commits",
-        },
-        new Option<string>("--committer-email")
-        {
-            Description = "Email used for git commits",
-        },
         FromStagingPipelineOptions.StagingStorageAccountOption,
+        ..CreatePullRequestOptions.Options,
     ];
 
-    public static List<Argument> Arguments =>
+    public static new List<Argument> Arguments =>
     [
-        new Argument<string>("remote-url")
-        {
-            Description = "The URL of the remote git repository to sync (e.g., https://dev.azure.com/org/project/_git/repo)"
-        },
-        new Argument<string>("source-branch")
-        {
-            Description = "The source branch to sync from (typically a release/* branch)"
-        },
-        new Argument<string>("target-branch")
-        {
-            Description = "The target branch to sync to (typically an internal/release/* branch)"
-        },
+        ..CreatePullRequestOptions.Arguments,
     ];
 }

From 096672471eaa2c3bb753af897d76a941647ec474 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:53:24 -0700
Subject: [PATCH 19/27] Make FromStagingPipelineCommand respect repo root

---
 eng/update-dependencies/FromStagingPipelineCommand.cs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index bd820a38b6..b8b2e8b207 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -96,6 +96,7 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         var updateDependencies = new SpecificCommand();
         var updateDependenciesOptions = new SpecificCommandOptions()
         {
+            RepoRoot = options.RepoRoot,
             DockerfileVersion = dockerfileVersion.ToString(),
             ProductVersions = productVersions,
 

From a4c388ae1cfe16b516ea8f8257bb15f144df1067 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 13:55:48 -0700
Subject: [PATCH 20/27] Reset using source branch sha instead of branch name

---
 .../Sync/SyncInternalReleaseCommand.cs                    | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index ca36edc9bb..a2c3eccbc5 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -70,8 +70,10 @@ await repo.Remote.CreateRemoteBranchAsync(
             return 0;
         }
 
-        var sourceSha = await repo.Remote.GetRemoteBranchShaAsync(options.SourceBranch);
-        var targetSha = await repo.Remote.GetRemoteBranchShaAsync(options.TargetBranch);
+        var sourceSha = await repo.Remote.GetRemoteBranchShaAsync(options.SourceBranch)
+            ?? throw new Exception("Failed to get source branch SHA even though branch exists on remote.");
+        var targetSha = await repo.Remote.GetRemoteBranchShaAsync(options.TargetBranch)
+            ?? throw new Exception("Failed to get target branch SHA even though branch exists on remote.");
 
         // If both branches are at the same commit, then there is nothing to do.
         if (sourceSha == targetSha)
@@ -146,7 +148,7 @@ await CreatePullRequest(
         // Reset the target branch to match the source branch.
         var prBranchName = GetPrBranchName(action: "sync", options);
         await repo.Local.CreateAndCheckoutLocalBranchAsync(prBranchName);
-        await repo.Local.RestoreAsync(source: options.SourceBranch);
+        await repo.Local.RestoreAsync(source: sourceSha);
         await repo.Local.StageAsync(".");
         await repo.Local.CommitAsync(
             message: $"Reset {options.TargetBranch} to match {options.SourceBranch} commit {sourceSha}",

From 79f1a4150582caa059b21fadb86db54336e1ea90 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 15:01:02 -0700
Subject: [PATCH 21/27] Fix argument name for GetToolUpdaters

---
 eng/update-dependencies/SpecificCommand.cs |  2 +-
 eng/update-dependencies/Tools.cs           | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index f077ab93d7..18ad4c7382 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -55,7 +55,7 @@ public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
 
                 if (toolBuildInfos.Length != 0)
                 {
-                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(Options.GetManifestVersionsFilePath());
+                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(repoRoot: Options.RepoRoot);
                     DependencyUpdateResults toolUpdateResults = UpdateFiles(toolBuildInfos, toolUpdaters);
                     updateResults.Add(toolUpdateResults);
                 }
diff --git a/eng/update-dependencies/Tools.cs b/eng/update-dependencies/Tools.cs
index e3e18cd0bf..4702f285e7 100644
--- a/eng/update-dependencies/Tools.cs
+++ b/eng/update-dependencies/Tools.cs
@@ -28,11 +28,11 @@ public static async Task<GitHubReleaseInfo> GetToolBuildInfoAsync(string tool) =
             _ => throw new ArgumentException($"Unknown tool {tool}", nameof(tool)),
         };
 
-    public static IEnumerable<IDependencyUpdater> GetToolUpdaters(string manifestVersionsFilePath) =>
+    public static IEnumerable<IDependencyUpdater> GetToolUpdaters(string repoRoot) =>
     [
-        ..MinGitUpdater.GetUpdaters(manifestVersionsFilePath),
-        ..ChiselUpdater.GetUpdaters(manifestVersionsFilePath),
-        RocksToolboxUpdater.GetUpdater(manifestVersionsFilePath),
-        SyftUpdater.GetUpdater(manifestVersionsFilePath),
+        ..MinGitUpdater.GetUpdaters(repoRoot),
+        ..ChiselUpdater.GetUpdaters(repoRoot),
+        RocksToolboxUpdater.GetUpdater(repoRoot),
+        SyftUpdater.GetUpdater(repoRoot),
     ];
 }

From ca0901e493088c44ed3c805dcdd50aa9443dd319 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 15:05:16 -0700
Subject: [PATCH 22/27] Add helper for shuttling around Manifest version
 variables and use "branch" variable instead of SourceBranch for determining
 repo lineage

---
 eng/update-dependencies/BaseUrlUpdater.cs     | 23 +++++------
 .../CreatePullRequestOptions.cs               | 14 ++-----
 .../DockerfileShaUpdater.cs                   | 37 +++++++++---------
 eng/update-dependencies/ManifestHelper.cs     | 19 ++++++---
 eng/update-dependencies/ManifestVariables.cs  | 39 +++++++++++++++++++
 eng/update-dependencies/NuGetConfigUpdater.cs | 18 ++++++---
 eng/update-dependencies/SpecificCommand.cs    | 26 ++++++++-----
 7 files changed, 114 insertions(+), 62 deletions(-)
 create mode 100644 eng/update-dependencies/ManifestVariables.cs

diff --git a/eng/update-dependencies/BaseUrlUpdater.cs b/eng/update-dependencies/BaseUrlUpdater.cs
index d104c653c7..4b65bfbdef 100644
--- a/eng/update-dependencies/BaseUrlUpdater.cs
+++ b/eng/update-dependencies/BaseUrlUpdater.cs
@@ -17,7 +17,7 @@ internal class BaseUrlUpdater : FileRegexUpdater
 {
     private const string BaseUrlGroupName = "BaseUrlValue";
     private readonly SpecificCommandOptions _options;
-    private readonly JObject _manifestVariables;
+    private readonly ManifestVariables _manifestVariables;
     private readonly string _manifestVariableName;
 
     /// <summary>
@@ -25,25 +25,22 @@ internal class BaseUrlUpdater : FileRegexUpdater
     /// If the base URL variable cannot be found in the manifest, the updater
     /// won't do anything.
     /// </summary>
-    public static IDependencyUpdater Create(SpecificCommandOptions options)
+    public static IDependencyUpdater Create(ManifestVariables manifestVariables, SpecificCommandOptions options)
     {
-        // Load manifest and extract variables once so the constructor doesn't duplicate this logic
-        var manifest = ManifestHelper.LoadManifest(options.GetManifestVersionsFilePath());
-        var manifestVariables = (JObject?)manifest["variables"];
-
         if (manifestVariables is null)
         {
             Trace.TraceWarning("BaseUrlUpdater: manifest variables missing - skipping base URL update.");
             return new EmptyDependencyUpdater();
         }
 
+        var upstreamBranch = manifestVariables.GetValue("branch");
         string baseUrlVarName = ManifestHelper.GetBaseUrlVariableName(
-            options.DockerfileVersion,
-            options.SourceBranch,
-            options.VersionSourceName,
-            options.IsSdkOnly);
+            dockerfileVersion: options.DockerfileVersion,
+            branch: upstreamBranch,
+            versionSourceName: options.VersionSourceName,
+            sdkOnlyRelease: options.IsSdkOnly);
 
-        if (!manifestVariables.ContainsKey(baseUrlVarName))
+        if (!manifestVariables.HasValue(baseUrlVarName))
         {
             Trace.TraceWarning($"BaseUrlUpdater: variable '{baseUrlVarName}' not found - skipping base URL update.");
             return new EmptyDependencyUpdater();
@@ -54,7 +51,7 @@ public static IDependencyUpdater Create(SpecificCommandOptions options)
 
     private BaseUrlUpdater(
         SpecificCommandOptions options,
-        JObject manifestVariables,
+        ManifestVariables manifestVariables,
         string manifestVariableName)
     {
         Path = options.GetManifestVersionsFilePath();
@@ -71,7 +68,7 @@ protected override string TryGetDesiredValue(IEnumerable<IDependencyInfo> depend
         usedDependencyInfos = Enumerable.Empty<IDependencyInfo>();
 
         string baseUrlVersionVarName = _manifestVariableName;
-        string unresolvedBaseUrl = _manifestVariables[baseUrlVersionVarName]?.ToString() ??
+        string unresolvedBaseUrl = _manifestVariables.Variables[baseUrlVersionVarName]?.ToString() ??
             throw new InvalidOperationException($"Variable with name '{baseUrlVersionVarName}' is missing.");
 
         if (_options.IsInternal)
diff --git a/eng/update-dependencies/CreatePullRequestOptions.cs b/eng/update-dependencies/CreatePullRequestOptions.cs
index d3250ecc13..f1b3cfa6d4 100644
--- a/eng/update-dependencies/CreatePullRequestOptions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptions.cs
@@ -8,8 +8,6 @@ namespace Dotnet.Docker;
 
 public abstract record CreatePullRequestOptions
 {
-    private string? _targetBranch = null;
-
     /// <summary>
     /// The root of the dotnet-docker repo to run against.
     /// </summary>
@@ -22,12 +20,8 @@ public abstract record CreatePullRequestOptions
     public string AzdoProject { get; init; } = "";
     public string AzdoRepo { get; init; } = "";
     public string VersionSourceName { get; init; } = "";
-    public string SourceBranch { get; init; } = "nightly";
-    public string TargetBranch
-    {
-        get => _targetBranch ?? SourceBranch;
-        init => _targetBranch = value;
-    }
+    public string SourceBranch { get; init; } = "";
+    public string TargetBranch { get; init; } = "nightly";
 
     public static List<Option> Options =>
     [
@@ -39,8 +33,8 @@ public string TargetBranch
         new Option<string>("--azdo-project") { Description = "Name of the AzDO project" },
         new Option<string>("--azdo-repo") { Description = "Name of the AzDO repo" },
         new Option<string>("--version-source-name") { Description = "The name of the source from which the version information was acquired." },
-        new Option<string>("--source-branch") { Description = "Branch where the Dockerfiles are hosted" },
-        new Option<string>("--target-branch") { Description = "Target branch of the generated PR (defaults to value of source-branch)" },
+        new Option<string>("--source-branch") { Description = "If synchronizing multiple branches, the branch to pull updates from" },
+        new Option<string>("--target-branch") { Description = "Pull request will be submitted targeting this branch" },
     ];
 
     public static List<Argument> Arguments => [];
diff --git a/eng/update-dependencies/DockerfileShaUpdater.cs b/eng/update-dependencies/DockerfileShaUpdater.cs
index 8ee114150a..fa6c82d88c 100644
--- a/eng/update-dependencies/DockerfileShaUpdater.cs
+++ b/eng/update-dependencies/DockerfileShaUpdater.cs
@@ -40,10 +40,17 @@ public class DockerfileShaUpdater : FileRegexUpdater
         private readonly SpecificCommandOptions _options;
         private readonly string _versions;
         private readonly Dictionary<string, string> _urls;
-        private readonly Lazy<JObject> _manifestVariables;
+        private readonly ManifestVariables _manifestVariables;
 
         public DockerfileShaUpdater(
-            string productName, string dockerfileVersion, string? buildVersion, string arch, string os, string versions, SpecificCommandOptions options)
+            string productName,
+            string dockerfileVersion,
+            string? buildVersion,
+            string arch,
+            string os,
+            string versions,
+            SpecificCommandOptions options,
+            ManifestVariables manifestVariables)
         {
             _productName = productName;
             _dockerfileVersion = new Version(dockerfileVersion);
@@ -52,6 +59,7 @@ public DockerfileShaUpdater(
             _os = os;
             _versions = versions;
             _options = options;
+            _manifestVariables = manifestVariables;
 
             // Maps a product name to a set of one or more candidate URLs referencing the associated artifact. The order of the URLs
             // should be in priority order with each subsequent URL being the fallback.
@@ -69,19 +77,6 @@ public DockerfileShaUpdater(
                 { "sdk",                            "$DOTNET_BASE_URL/Sdk/$VERSION_DIR/dotnet-sdk-$VERSION_FILE-$OS-$ARCH.$ARCHIVE_EXT" },
             };
 
-            _manifestVariables = new Lazy<JObject>(
-                () =>
-                {
-                    var versionsFile = options.GetManifestVersionsFilePath();
-                    const string VariablesProperty = "variables";
-                    JToken? variables = ManifestHelper.LoadManifest(versionsFile)[VariablesProperty];
-                    if (variables is null)
-                    {
-                        throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{versionsFile}'");
-                    }
-                    return (JObject)variables;
-                });
-
             if (!string.IsNullOrEmpty(_options.InternalAccessToken))
             {
                 s_httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
@@ -92,7 +87,10 @@ public DockerfileShaUpdater(
         }
 
         public static IEnumerable<IDependencyUpdater> CreateUpdaters(
-            string productName, string dockerfileVersion, SpecificCommandOptions options)
+            string productName,
+            string dockerfileVersion,
+            SpecificCommandOptions options,
+            ManifestVariables variables)
         {
             string versionsPath = options.GetManifestVersionsFilePath();
             string versions = File.ReadAllText(versionsPath);
@@ -117,7 +115,8 @@ public static IEnumerable<IDependencyUpdater> CreateUpdaters(
                         GetArch(parts),
                         GetOs(parts),
                         versions,
-                        options)
+                        options,
+                        variables)
                     {
                         Path = versionsPath,
                         VersionGroupName = ShaValueGroupName
@@ -138,7 +137,7 @@ public static IEnumerable<IDependencyUpdater> CreateUpdaters(
         {
             usedBuildInfos = [dependencyBuildInfos.First(info => info.SimpleName == _productName)];
 
-            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Value, _options);
+            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Variables, _options);
             // Remove Aspire Dashboard case once https://github.com/dotnet/aspire/issues/2035 is fixed.
             string archiveExt = _os.Contains("win") || _productName.Contains("aspire-dashboard") ? "zip" : "tar.gz";
             string versionDir = _buildVersion ?? "";
@@ -276,7 +275,7 @@ private static string GetArch(string[] variableParts)
             // corresponding build in the daily build location, for example, will not be signed due. So when we're targeting
             // the daily build location, we wouldn't use the release checksums file and instead use the other means of
             // retrieving the checksums.
-            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Value, _options);
+            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Variables, _options);
             if (baseUrl != ReleaseDotnetBaseCdnUrl)
             {
                 return null;
diff --git a/eng/update-dependencies/ManifestHelper.cs b/eng/update-dependencies/ManifestHelper.cs
index 692e07ac80..d961559021 100644
--- a/eng/update-dependencies/ManifestHelper.cs
+++ b/eng/update-dependencies/ManifestHelper.cs
@@ -1,8 +1,6 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System;
-using System.IO;
 using System.Text.RegularExpressions;
 using Newtonsoft.Json.Linq;
 
@@ -21,8 +19,19 @@ public static partial class ManifestHelper
     /// </summary>
     /// <param name="manifestVariables">JSON object of the variables from the manifest.</param>
     /// <param name="options">Configured options from the app.</param>
-    public static string GetBaseUrl(JObject manifestVariables, SpecificCommandOptions options) =>
-        ResolveVariableValue(GetBaseUrlVariableName(options.DockerfileVersion, options.SourceBranch, options.VersionSourceName), manifestVariables);
+    public static string GetBaseUrl(JObject manifestVariables, SpecificCommandOptions options)
+    {
+        // The upstream branch represents which GitHub branch the current
+        // branch branched off of. This is either "nightly" or "main".
+        var upstreamBranch = ResolveVariableValue("branch", manifestVariables);
+
+        var baseUrlVariableName = GetBaseUrlVariableName(
+            dockerfileVersion: options.DockerfileVersion,
+            branch: upstreamBranch,
+            versionSourceName: options.VersionSourceName);
+
+        return ResolveVariableValue(baseUrlVariableName, manifestVariables);
+    }
 
     /// <summary>
     /// Constructs the name of the product version base URL variable.
@@ -137,7 +146,7 @@ public static Regex GetManifestVariableRegex(string variableName, string valuePa
     /// </summary>
     /// <param name="value">Variable value to be resolved.</param>
     /// <param name="variables">JSON object of the variables from the manifest.</param>
-    private static string ResolveVariables(string value, JObject variables)
+    public static string ResolveVariables(string value, JObject variables)
     {
         MatchCollection matches = Regex.Matches(value, VariablePattern);
         foreach (Match match in matches)
diff --git a/eng/update-dependencies/ManifestVariables.cs b/eng/update-dependencies/ManifestVariables.cs
new file mode 100644
index 0000000000..df7dbe85e8
--- /dev/null
+++ b/eng/update-dependencies/ManifestVariables.cs
@@ -0,0 +1,39 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Newtonsoft.Json.Linq;
+
+namespace Dotnet.Docker;
+
+/// <summary>
+/// Object that holds variables defined in a manifest file.
+/// </summary>
+public class ManifestVariables(JObject variables)
+{
+    public static ManifestVariables FromFile(string filePath)
+    {
+        var manifestObject = ManifestHelper.LoadManifest(filePath);
+        var manifestVariables = (JObject?)manifestObject["variables"] ?? [];
+        return new ManifestVariables(manifestVariables);
+    }
+
+    /// <summary>
+    /// The raw JSON object containing the variables from the manifest.
+    /// </summary>
+    public JObject Variables { get; } = variables;
+
+    /// <summary>
+    /// Checks whether the manifest contains a value for <paramref name="variableName"/>.
+    /// </summary>
+    public bool HasValue(string variableName) => Variables.ContainsKey(variableName);
+
+    /// <summary>
+    /// Resolves the value of a manifest variable, recursively resolving any
+    /// variables referenced in the value.
+    /// </summary>
+    public string GetValue(string variableName)
+    {
+        string variableValue = ManifestHelper.GetVariableValue(variableName, Variables);
+        return ManifestHelper.ResolveVariables(variableValue, Variables);
+    }
+}
diff --git a/eng/update-dependencies/NuGetConfigUpdater.cs b/eng/update-dependencies/NuGetConfigUpdater.cs
index 22ad5aa2b5..59595eb1f7 100644
--- a/eng/update-dependencies/NuGetConfigUpdater.cs
+++ b/eng/update-dependencies/NuGetConfigUpdater.cs
@@ -1,10 +1,6 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
 using System.Text;
 using System.Xml.Linq;
 using Microsoft.DotNet.VersionTools.Dependencies;
@@ -20,11 +16,21 @@ internal class NuGetConfigUpdater : IDependencyUpdater
     private readonly SpecificCommandOptions _options;
     private readonly string _configPath;
 
-    public NuGetConfigUpdater(SpecificCommandOptions options)
+    public NuGetConfigUpdater(ManifestVariables manifestVariables, SpecificCommandOptions options)
     {
         _options = options;
 
-        string configSuffix = _options.IsInternal ? ".internal" : _options.SourceBranch == "nightly" ? ".nightly" : string.Empty;
+        // The upstream branch represents which GitHub branch the current
+        // branch branched off of. This is either "nightly" or "main".
+        string upstreamBranch = manifestVariables.GetValue("branch");
+
+        string configSuffix = (_options.IsInternal, upstreamBranch) switch
+        {
+            (true, _) => ".internal",
+            (false, "nightly") => ".nightly",
+            _ => string.Empty
+        };
+
         _configPath = Path.Combine(_options.RepoRoot, $"tests/Microsoft.DotNet.Docker.Tests/TestAppArtifacts/NuGet.config{configSuffix}");
     }
 
diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index 18ad4c7382..b7113f4dd4 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
@@ -13,6 +14,7 @@
 using Microsoft.DotNet.VersionTools.Automation.GitHubApi;
 using Microsoft.DotNet.VersionTools.Dependencies;
 using Microsoft.DotNet.VersionTools.Dependencies.BuildOutput;
+using Newtonsoft.Json.Linq;
 
 namespace Dotnet.Docker
 {
@@ -37,18 +39,21 @@ public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
 
             try
             {
-
                 IDependencyInfo[] productBuildInfos = Options.ProductVersions
                     .Select(kvp => CreateDependencyBuildInfo(kvp.Key, kvp.Value))
                     .ToArray();
                 IDependencyInfo[] toolBuildInfos =
                     await Task.WhenAll(Options.Tools.Select(Tools.GetToolBuildInfoAsync));
 
+                // Load manifest variables once, up front
+                var manifestFilePath = options.GetManifestVersionsFilePath();
+                var manifestVariables = ManifestVariables.FromFile(manifestFilePath);
+
                 List<DependencyUpdateResults> updateResults = [];
 
                 if (productBuildInfos.Length != 0)
                 {
-                    IEnumerable<IDependencyUpdater> productUpdaters = GetProductUpdaters();
+                    IEnumerable<IDependencyUpdater> productUpdaters = GetProductUpdaters(manifestVariables);
                     DependencyUpdateResults productUpdateResults = UpdateFiles(productBuildInfos, productUpdaters);
                     updateResults.Add(productUpdateResults);
                 }
@@ -381,15 +386,15 @@ private static void DirectoryCopy(string sourceDirName, string destDirName)
             }
         }
 
-        private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
+        private static IEnumerable<IDependencyUpdater> GetProductUpdaters(ManifestVariables manifestVariables)
         {
             // NOTE: The order in which the updaters are returned/invoked is important as there are cross dependencies
             // (e.g. sha updater requires the version numbers to be updated within the Dockerfiles)
 
             List<IDependencyUpdater> updaters =
             [
-                new NuGetConfigUpdater(Options),
-                BaseUrlUpdater.Create(Options)
+                new NuGetConfigUpdater(manifestVariables, Options),
+                BaseUrlUpdater.Create(manifestVariables, Options)
             ];
 
             foreach (string productName in Options.ProductVersions.Keys)
@@ -397,10 +402,13 @@ private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
                 updaters.Add(new VersionUpdater(VersionType.Build, productName, Options.DockerfileVersion, Options));
                 updaters.Add(new VersionUpdater(VersionType.Product, productName, Options.DockerfileVersion, Options));
 
-                foreach (IDependencyUpdater shaUpdater in DockerfileShaUpdater.CreateUpdaters(productName, Options.DockerfileVersion, Options))
-                {
-                    updaters.Add(shaUpdater);
-                }
+                var shaUpdaters = DockerfileShaUpdater.CreateUpdaters(
+                    productName: productName,
+                    dockerfileVersion: Options.DockerfileVersion,
+                    options: Options,
+                    variables: manifestVariables);
+
+                updaters.AddRange(shaUpdaters);
             }
 
             return updaters;

From 7167d00e4f265c134b022b0729d91434eeafbaf4 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 15:17:09 -0700
Subject: [PATCH 23/27] Throw if sub-command had a non-zero exit code

---
 .../Sync/SyncInternalReleaseCommand.cs                    | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index a2c3eccbc5..191fc40767 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -239,7 +239,13 @@ private async Task ApplyInternalBuildAsync(
             AzdoRepo = options.AzdoRepo,
         };
 
-        await _updateFromStagingPipeline.ExecuteAsync(fromStagingPipelineOptions);
+        var exitCode = await _updateFromStagingPipeline.ExecuteAsync(fromStagingPipelineOptions);
+        if (exitCode != 0)
+        {
+            throw new InvalidOperationException(
+                $"Failed to apply internal build {stagingPipelineRunId}. Command exited with code {exitCode}.");
+        }
+
         _logger.LogInformation(
             "Finished applying internal build {BuildNumber} ({BuildUrl})",
             stagingPipelineRunId, buildUrl);

From c6c5bf96a95d048236de5038c53533a46daea0a2 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 15:28:24 -0700
Subject: [PATCH 24/27] Fix tests

---
 .../CreatePullRequestOptionsExtensions.cs     | 14 ++++++++++
 .../Sync/SyncInternalReleaseCommand.cs        | 11 +-------
 .../SyncInternalReleaseTests.cs               | 27 +++++++++++--------
 3 files changed, 31 insertions(+), 21 deletions(-)

diff --git a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
index 73a0a98fbf..1148098258 100644
--- a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
@@ -7,4 +7,18 @@ internal static class CreatePullRequestOptionsExtensions
 {
     public static string GetManifestVersionsFilePath(this CreatePullRequestOptions options) =>
         Path.Combine(options.RepoRoot, "manifest.versions.json");
+
+    public static string GetAzdoRepoUrl(this CreatePullRequestOptions options)
+    {
+        // Validate that we have all the required pieces to construct the repo URL.
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoOrganization);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoProject);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoRepo);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.TargetBranch);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.SourceBranch);
+
+        // AzdoOrganization is a URL like https://dev.azure.com/<org>
+        // A valid Azure DevOps repository URL is formatted like https://dev.azure.com/<org>/<project>/_git/<repo>
+        return $"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_git/{options.AzdoRepo}";
+    }
 }
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index 191fc40767..ba972ef90d 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -32,16 +32,7 @@ ILogger<SyncInternalReleaseCommand> logger
 
     public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
     {
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoOrganization);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoProject);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoRepo);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.TargetBranch);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.SourceBranch);
-
-        // AzdoOrganization is a URL like https://dev.azure.com/<org>
-        // A valid Azure DevOps repository URL is formatted like https://dev.azure.com/<org>/<project>/_git/<repo>
-        var remoteUri = new Uri($"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_git/{options.AzdoRepo}");
-        var remoteUrl = remoteUri.ToString();
+        var remoteUrl = options.GetAzdoRepoUrl();
 
         // Do not allow syncing starting from an internal branch.
         if (options.SourceBranch.StartsWith("internal/", StringComparison.OrdinalIgnoreCase))
diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index 70b07db2a6..62dd13de09 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -14,10 +14,11 @@ public sealed class SyncInternalReleaseTests
 {
     private const string ReleaseBranch = "release/1";
     private const string InternalReleaseBranch = $"internal/{ReleaseBranch}";
-    private const string AzdoOrg = "test-org";
+    private const string AzdoOrgName = "test-org";
+    private const string AzdoOrgUrl = $"https://dev.azure.com/{AzdoOrgName}";
     private const string AzdoProject = "test-project";
     private const string AzdoRepo = "test-repo";
-    private const string RemoteAzdoUrl = $"https://dev.azure.com/{AzdoOrg}/{AzdoProject}/_git/{AzdoRepo}";
+    private const string RemoteAzdoUrl = $"{AzdoOrgUrl}/{AzdoProject}/_git/{AzdoRepo}";
     private const string LocalRepoPath = "/path/to/local-repo";
 
     /// <summary>
@@ -27,7 +28,9 @@ public sealed class SyncInternalReleaseTests
     /// </summary>
     private static readonly SyncInternalReleaseOptions s_defaultOptions = new()
     {
-        RemoteUrl = RemoteAzdoUrl,
+        AzdoOrganization = AzdoOrgUrl,
+        AzdoProject = AzdoProject,
+        AzdoRepo = AzdoRepo,
         SourceBranch = ReleaseBranch,
         TargetBranch = InternalReleaseBranch
     };
@@ -40,7 +43,9 @@ public async Task WhitespaceArgumentsFails()
     {
         var options = new SyncInternalReleaseOptions
         {
-            RemoteUrl = "   ",
+            AzdoOrganization = "   ",
+            AzdoProject = "   ",
+            AzdoRepo = "   ",
             SourceBranch = "   ",
             TargetBranch = "   "
         };
@@ -76,7 +81,7 @@ public async Task CreateInternalBranch()
 
         var repoMock = new Mock<IGitRepoHelper>();
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup:
         // Target branch does not exist on remote
@@ -106,7 +111,7 @@ public async Task AlreadyUpToDate()
         // not explicitly set up in this test.
         var repoMock = new Mock<IGitRepoHelper>(MockBehavior.Strict);
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup: Both target and source branches exist on remote.
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.TargetBranch)).ReturnsAsync(true);
@@ -143,7 +148,7 @@ public async Task FastForward()
         repoMock.Setup(r => r.Remote).Returns(remoteRepoMock.Object);
 
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup: Both target and source branches exist on remote.
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.TargetBranch)).ReturnsAsync(true);
@@ -193,8 +198,8 @@ public async Task Sync()
     {
         var options = s_defaultOptions with
         {
-            CommitterName = "Test User",
-            CommitterEmail = "test@example.com",
+            User = "Test User",
+            Email = "test@example.com",
             StagingStorageAccount = "dotnetstage"
         };
 
@@ -254,8 +259,8 @@ public async Task Sync()
         gitScenario.RepoMock.Verify(
             repo => repo.Local.CommitAsync(
                 It.IsAny<string>(),
-                It.Is<(string Name, string Email)>(author =>
-                    author.Name == options.CommitterName && author.Email == options.CommitterEmail
+                It.Is<(string Name, string Email)>(
+                    author => author.Name == options.User && author.Email == options.Email
                 )
             ),
             Times.Exactly(numberOfCommits)

From 2edd452e2bdc0525a1b957648dcbf02a8b239b1a Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Thu, 2 Oct 2025 15:30:07 -0700
Subject: [PATCH 25/27] Add branch variables to manifest.versions.json

---
 manifest.versions.json | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/manifest.versions.json b/manifest.versions.json
index c108bd27f1..9630e112ae 100644
--- a/manifest.versions.json
+++ b/manifest.versions.json
@@ -1,5 +1,7 @@
 {
   "variables": {
+    "branch": "nightly",
+
     "base-url|public|maintenance|main": "https://builds.dotnet.microsoft.com/dotnet",
     "base-url|public|maintenance|nightly": "https://builds.dotnet.microsoft.com/dotnet",
     "base-url|public|preview|main": "https://builds.dotnet.microsoft.com/dotnet",

From 3c1599289fccd9688a42b7971aa20a13c21ba742 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Fri, 3 Oct 2025 08:29:13 -0700
Subject: [PATCH 26/27] Reference new Azdo URL extension in SpecificCommand

---
 eng/update-dependencies/SpecificCommand.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index b7113f4dd4..e79da23452 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -184,7 +184,7 @@ private static void PushToAzdoBranch(string commitMessage, string targetBranch)
                 "azuredevops"
             );
 
-            var url = $"{Options.AzdoOrganization}{Options.AzdoProject}/_git/{Options.AzdoRepo}";
+            var url = Options.GetAzdoRepoUrl();
             Trace.WriteLine($"Adding remote {remoteName} with URL {url}");
             Remote remote = repo.Network.Remotes.Add(remoteName, url);
 

From 397806b0804731db3b56cafc7b42d99f99eac594 Mon Sep 17 00:00:00 2001
From: Logan Bussell <loganbussell@microsoft.com>
Date: Fri, 3 Oct 2025 08:43:58 -0700
Subject: [PATCH 27/27] Always trim org name

---
 .../CreatePullRequestOptions.cs                    | 14 ++++++++++++--
 .../CreatePullRequestOptionsExtensions.cs          |  2 +-
 .../Sync/SyncInternalReleaseCommand.cs             |  2 +-
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/eng/update-dependencies/CreatePullRequestOptions.cs b/eng/update-dependencies/CreatePullRequestOptions.cs
index f1b3cfa6d4..36f0bdc737 100644
--- a/eng/update-dependencies/CreatePullRequestOptions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptions.cs
@@ -8,6 +8,8 @@ namespace Dotnet.Docker;
 
 public abstract record CreatePullRequestOptions
 {
+    private string _azdoOrganizationUrl = "";
+
     /// <summary>
     /// The root of the dotnet-docker repo to run against.
     /// </summary>
@@ -16,7 +18,11 @@ public abstract record CreatePullRequestOptions
     public string User { get; init; } = "";
     public string Email { get; init; } = "";
     public string Password { get; init; } = "";
-    public string AzdoOrganization { get; init; } = "";
+    public string AzdoOrganization
+    {
+        get => _azdoOrganizationUrl;
+        init => _azdoOrganizationUrl = value.TrimEnd('/');
+    }
     public string AzdoProject { get; init; } = "";
     public string AzdoRepo { get; init; } = "";
     public string VersionSourceName { get; init; } = "";
@@ -29,7 +35,11 @@ public abstract record CreatePullRequestOptions
         new Option<string>("--user") { Description = "GitHub or AzDO user used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--email") { Description = "GitHub or AzDO email used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--password") { Description = "GitHub or AzDO password used to make PR (if not specified, a PR will not be created)" },
-        new Option<string>("--azdo-organization") { Description = "Name of the AzDO organization" },
+        new Option<string>("--azdo-organization")
+        {
+            Description = "URL of the AzDO organization (like https://dev.azure.com/<orgname>), with or without a trailing slash."
+                + " The Azure Pipelines variable 'System.CollectionUri' provides this value.",
+        },
         new Option<string>("--azdo-project") { Description = "Name of the AzDO project" },
         new Option<string>("--azdo-repo") { Description = "Name of the AzDO repo" },
         new Option<string>("--version-source-name") { Description = "The name of the source from which the version information was acquired." },
diff --git a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
index 1148098258..83893deff8 100644
--- a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
@@ -19,6 +19,6 @@ public static string GetAzdoRepoUrl(this CreatePullRequestOptions options)
 
         // AzdoOrganization is a URL like https://dev.azure.com/<org>
         // A valid Azure DevOps repository URL is formatted like https://dev.azure.com/<org>/<project>/_git/<repo>
-        return $"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_git/{options.AzdoRepo}";
+        return $"{options.AzdoOrganization}/{options.AzdoProject}/_git/{options.AzdoRepo}";
     }
 }
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index ba972ef90d..05835ef748 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -210,7 +210,7 @@ private async Task ApplyInternalBuildAsync(
         (string Name, string Email) committerIdentity)
     {
         // Example build URL: https://dev.azure.com/<org>/<project>/_build/results?buildId=<stagingPipelineRunId>
-        var buildUrl = $"{options.AzdoOrganization.TrimEnd('/')}/{options.AzdoProject}/_build/results?buildId={stagingPipelineRunId}";
+        var buildUrl = $"{options.AzdoOrganization}/{options.AzdoProject}/_build/results?buildId={stagingPipelineRunId}";
 
         _logger.LogInformation(
             "Applying internal build {BuildNumber} ({BuildUrl})",