[dborgards]

What does this change?

CI stopped in setup-dotnet before any build: the floating 10.0.x request followed aka.ms to dotnetorigin.blob.core.windows.net, which returned HTTP 409 (Public access is not permitted on this storage account). All four failing jobs on #455 failed again after one retry.

All eight setup steps in CI, CodeQL, Docs and Release now request the same SDK 10.0.403 by exact version. The pinned installer's exact-version path bypasses aka.ms and downloads from builds.dotnet.microsoft.com, which serves the same archive successfully. The SDK selected by the original floating request was already 10.0.403; this changes the resolution/download path, not the selected version. Action SHAs and the developer SDK policy in global.json are unchanged.

Closes #456. Unblocks #455 once this fix is merged and incorporated there. The maintainer explicitly authorized this second concurrent authored PR as an exception to the usual one-PR rule.

Type of change

• feat — new behaviour (minor release)
• fix / perf — bug or performance fix (patch release)
• docs / test / refactor / chore / ci — no release
• Breaking change

Checklist

• Build with -p:CI=true, test (net10.0), dotnet format --verify-no-changes, and pack + eng/verify-packages.py all pass locally
• Public API changes are documented with XML comments — no public API change
• New behaviour is covered by a test — downloaded/installed the exact SDK using the pinned official installer and ran the full gate with it; actual runner validation follows in this PR
• The requirement or ADR this relates to is referenced — CI: setup-dotnet downloads fail with HTTP 409 before builds start #456; no product requirement changes

Validation

• Reproduced HTTP 409 on the origin endpoint and HTTP 200 for the same SDK/runtime files on builds.dotnet.microsoft.com.
• The pinned installer dry-run for exact 10.0.403 selects the regular Microsoft feed. A fresh macOS arm64 installation completed successfully; SDK reports 10.0.403. Linux x64, Windows x64 and macOS x64 SDK archives also returned HTTP 200.
• Using that isolated SDK: Release CI build, zero warnings/errors; 2882/2882 net10 tests; format verification; fresh pack with all 9 packages verified.
• All 50 verification-script tests pass; requirement traceability passes with no new gaps. All workflow YAML parses; all 8 setup steps request the same exact SDK; git diff --check passes.
• No executable production code changed, so there are no changed executable lines requiring patch coverage.

Installer limitation

The pinned setup action separately attempts the latest LTS runtime before installing the requested SDK. That preliminary download can still warn about the broken redirect; upstream code deliberately treats this preliminary failure as nonfatal. The exact SDK install includes its runtime and must succeed. This PR's runner checks validate the complete action, including Windows; it does not publish a release.

Runner evidence

The version job on this head installed SDK 10.0.403 directly from builds.dotnet.microsoft.com and passed. Its preliminary runtime install also succeeded: the aka.ms runtime redirect now points to the regular Microsoft host rather than the origin account. This external state differs from the two failed runs of #455, so its failed workflows have been retried once more while this pin remains under review.

[cursor]

PR Summary

Low Risk
Workflow-only SDK pin with no application or security logic changes; main risk is CI drift if 10.0.403 is later unavailable without a follow-up bump.

Overview
Pins the .NET SDK in GitHub Actions so setup-dotnet stops failing before any build. Every workflow that installs the SDK now requests 10.0.403 instead of floating 10.0.x.

Floating 10.0.x was resolving through aka.ms to dotnetorigin.blob.core.windows.net, which returned HTTP 409 and broke CI, CodeQL, docs, and release jobs. An exact version uses the direct builds.dotnet.microsoft.com path (same SDK as before; only the download route changes). Updates eight Setup .NET steps across ci.yml, codeql.yml, docs.yml, and release.yml, with comments referencing #456. Action SHAs and global.json are unchanged.

^{Reviewed by Cursor Bugbot for commit 7ef8a54. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T20:24:42.769685Z	7ef8a54	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!