Null-guard feedKeys/feedOverrides in SetupTargetFeedConfigV3 (fixes NRE on keyless Entra publish)

src/Microsoft.DotNet.Build.Tasks.Feed.Tests/SetupTargetFeedConfigV3Tests.cs

@@ -496,5 +496,39 @@ public void MustHaveSeparateTargetFeedSpecificationsForShippingAndNonShipping()
             Action shouldPassNonShippingOnly = () => new TargetFeedSpecification(new TargetFeedContentType[] { TargetFeedContentType.Package }, "FooFeed", AssetSelection.NonShippingOnly);
             shouldPassNonShippingOnly.Should().NotThrow();
         }
+
+        [Fact]
+        public void NullFeedKeysAndOverridesAreTreatedAsEmpty()
+        {
+            // MSBuild passes null (not an empty array) for an empty ItemGroup, e.g. when publishing
+            // with Entra/WIF auth and no feed key is supplied. The constructor must tolerate this.
+            var buildEngine = new MockBuildEngine();
+            var channelConfig = PublishingConstants.ChannelInfos.First(c => c.Id == 2);
+
+            SetupTargetFeedConfigV3 config = null;
+            Action construct = () => config = new SetupTargetFeedConfigV3(
+                channelConfig,
+                isInternalBuild: true,
+                isStableBuild: false,
+                repositoryName: "test-repo",
+                commitSha: "c0c0c0c0",
+                publishInstallersAndChecksums: true,
+                feedKeys: null,
+                feedOverrides: null,
+                [$"{LatestLinkShortUrlPrefix}/{BuildQuality}"],
+                buildEngine,
+                symbolVisibility);
+
+            construct.Should().NotThrow();
+
+            var feeds = config.Setup();
+
+            feeds.Should().NotBeEmpty();
+            // With no feed keys supplied, the AzDO feeds are still produced (not dropped) but resolve
+            // to a null token so the publisher falls back to Entra-based authentication downstream.
+            var azdoFeeds = feeds.Where(f => f.Type == FeedType.AzDoNugetFeed).ToList();
+            azdoFeeds.Should().NotBeEmpty();
+            azdoFeeds.Should().OnlyContain(f => f.Token == null);
+        }
     }
 }

src/Microsoft.DotNet.Build.Tasks.Feed/src/model/SetupTargetFeedConfigV3.cs

@@ -71,8 +71,10 @@ public SetupTargetFeedConfigV3(
             StablePackagesFeed = stablePackagesFeed;
             SymbolServerVisibility = symbolPublishVisibility;
             Flatten = flatten;
-            FeedKeys = feedKeys.ToImmutableDictionary(i => i.ItemSpec, i => i.GetMetadata("Key"));
-            FeedOverrides = feedOverrides.ToImmutableDictionary(i => i.ItemSpec, i => i.GetMetadata("Replacement"));
+            // feedKeys/feedOverrides may be null when the corresponding MSBuild ItemGroup is empty
+            // (e.g. when publishing with Entra/WIF auth and no feed key is supplied).
+            FeedKeys = (feedKeys ?? Array.Empty<ITaskItem>()).ToImmutableDictionary(i => i.ItemSpec, i => i.GetMetadata("Key"));
+            FeedOverrides = (feedOverrides ?? Array.Empty<ITaskItem>()).ToImmutableDictionary(i => i.ItemSpec, i => i.GetMetadata("Replacement"));
             AzureDevOpsFeedsKey = FeedKeys.TryGetValue("https://pkgs.dev.azure.com/dnceng", out string key) ? key : null;
             Log = log;
         }