Fix SDK 10 native tool verification on macOS ARM64

Author: kusutori

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
         if: matrix.rid != 'win-arm64'
         run: |
           $version = ([xml](Get-Content src/Tonarink.Cli/Tonarink.Cli.csproj -Raw)).Project.PropertyGroup.Version
-          ./tools/Verify-CliTool.ps1 -AssetDirectory artifacts/cli/nuget -Version $version -InstallerSdkVersion '${{ steps.installer-sdk.outputs.dotnet-version }}'
+          ./tools/Verify-CliTool.ps1 -AssetDirectory artifacts/cli/nuget -Version $version -InstallerSdkVersion '${{ steps.installer-sdk.outputs.dotnet-version }}' -RuntimeIdentifier '${{ matrix.rid }}'
 
   ui:
     runs-on: windows-latest

.github/workflows/release-cli.yml

@@ -123,7 +123,7 @@ jobs:
         run: |
           Copy-Item artifacts/cli/native/*.nupkg artifacts/cli/verify
           Copy-Item artifacts/cli/native/tonarink-cli-* artifacts/cli/verify
-          ./tools/Verify-CliTool.ps1 -AssetDirectory artifacts/cli/verify -Version '${{ needs.version.outputs.version }}' -InstallerSdkVersion '${{ steps.installer-sdk.outputs.dotnet-version }}'
+          ./tools/Verify-CliTool.ps1 -AssetDirectory artifacts/cli/verify -Version '${{ needs.version.outputs.version }}' -InstallerSdkVersion '${{ steps.installer-sdk.outputs.dotnet-version }}' -RuntimeIdentifier '${{ matrix.rid }}'
       - uses: actions/upload-artifact@v4
         with:
           name: cli-native-${{ matrix.rid }}

tools/Verify-CliTool.ps1

@@ -6,7 +6,10 @@ param(
     [Parameter(Mandatory)]
     [string]$Version,
     [Parameter(Mandatory)]
-    [string]$InstallerSdkVersion
+    [string]$InstallerSdkVersion,
+    [Parameter(Mandatory)]
+    [ValidateSet('win-x64', 'win-arm64', 'linux-x64', 'linux-arm64', 'osx-x64', 'osx-arm64')]
+    [string]$RuntimeIdentifier
 )
 
 $ErrorActionPreference = 'Stop'
@@ -17,10 +20,34 @@ $profile = Join-Path $work 'profile'
 $config = Join-Path $work 'NuGet.Config'
 $assetRoot = (Resolve-Path -LiteralPath $AssetDirectory).Path
 $feed = [Security.SecurityElement]::Escape($assetRoot)
-# Only local artifacts can satisfy this install, never an older published version.
-Set-Content -LiteralPath $config -Value "<configuration><packageSources><clear/><add key=`"cli-build`" value=`"$feed`" /></packageSources></configuration>"
+# Only local artifacts can satisfy the CLI install, never a published version.
+# SDK 10 still resolves a legacy apphost template for tools/any on macOS ARM64
+# before creating the native executable launcher. Allow only that SDK support
+# package from NuGet.org; the CLI and every RID package must come from this build.
+Set-Content -LiteralPath $config -Value @"
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="cli-build" value="$feed" />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <clear />
+    <packageSource key="cli-build">
+      <package pattern="tonarink-cli" />
+      <package pattern="tonarink-cli.*" />
+    </packageSource>
+    <packageSource key="nuget.org">
+      <package pattern="Microsoft.NETCore.App.Host.*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>
+"@
 $sdkCli = Join-Path $env:DOTNET_ROOT "sdk/$InstallerSdkVersion/dotnet.dll"
-dotnet exec $sdkCli tool install tonarink-cli --tool-path $toolDirectory --version $Version --configfile $config --no-cache
+$dotnetHost = Join-Path $env:DOTNET_ROOT $(if ($IsWindows) { 'dotnet.exe' } else { 'dotnet' })
+$hostOS, $architecture = $RuntimeIdentifier.Split('-')
+# Use the selected SDK installation's host, rather than another dotnet on PATH.
+& $dotnetHost exec $sdkCli tool install tonarink-cli --tool-path $toolDirectory --version $Version --configfile $config --no-cache
 if ($LASTEXITCODE -ne 0) { throw 'AOT tool installation failed.' }
 # Native tools use a .cmd launcher on Windows and an executable launcher on Unix.
 $cli = Join-Path $toolDirectory 'tonarink-cli'
@@ -30,8 +57,6 @@ if ($LASTEXITCODE -ne 0) { throw 'Tool help failed.' }
 if ($LASTEXITCODE -ne 0) { throw 'Localized tool help failed.' }
 # Check the distributed archive, not only the staging binary. On Unix this also
 # catches a lost executable bit: deliberately do not chmod after extraction.
-$hostOS = if ($IsWindows) { 'win' } elseif ($IsMacOS) { 'osx' } else { 'linux' }
-$architecture = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()
 $archiveExtension = if ($IsWindows) { 'zip' } else { 'tar.gz' }
 $archive = Join-Path $assetRoot "tonarink-cli-$Version-$hostOS-$architecture.$archiveExtension"
 $portableDirectory = Join-Path $work 'portable'