Merge branch 'main' into sdkauto/azure-mgmt-relationships-6693387

Author: ChenxiJiang333

.github/skills/azsdk-common-pipeline-analysis/SKILL.md

@@ -4,7 +4,7 @@ license: MIT
 metadata:
   version: "1.0.0"
   distribution: shared
-description: 'Analyze Azure SDK CI/CD pipeline failures into a structured diagnosis, and define the required output format. Load this skill before calling azsdk_analyze_pipeline, which returns raw failure data that this skill interprets and formats. USE FOR: "pipeline failed", "build failure", "CI check failing", "tests failing in CI", "analyze pipeline", "debug SDK pipeline". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing, applying code fixes (instead use azsdk-common-pipeline-fixer). INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_get_pipeline_llm_artifacts, azure-sdk-mcp:azsdk_get_pr_checks, azure-sdk-mcp:azsdk_get_pipeline_status.'
+description: 'Analyze Azure SDK CI/CD pipeline failures into a structured diagnosis, and define the required output format. Load this skill before calling azsdk_analyze_pipeline, which returns raw failure data that this skill interprets and formats. USE FOR: "pipeline failed", "build failure", "CI check failing", "tests failing in CI", "analyze pipeline", "debug SDK pipeline". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing, applying code fixes (instead use azsdk-common-pipeline-fixer). INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_get_pipeline_llm_artifacts, azure-sdk-mcp:azsdk_get_failed_test_run_data, azure-sdk-mcp:azsdk_get_failed_test_case_data, azure-sdk-mcp:azsdk_get_pr_checks, azure-sdk-mcp:azsdk_get_pipeline_status.'
 compatibility: "azure-sdk-mcp server, Azure DevOps pipeline build ID or GitHub PR link"
 ---
 
@@ -22,20 +22,24 @@ This skill analyzes Azure SDK CI/CD pipeline failures and provides a structured
 
 ## MCP Tools
 
-| Tool                                             | Purpose                                        |
-| ------------------------------------------------ | ---------------------------------------------- |
-| `azure-sdk-mcp:azsdk_analyze_pipeline`           | Analyze pipeline failure (logs + test results) |
-| `azure-sdk-mcp:azsdk_get_pipeline_llm_artifacts` | Download test result artifacts from pipeline   |
-| `azure-sdk-mcp:azsdk_get_pr_checks`              | Get pipeline/check results linked to a PR      |
-| `azure-sdk-mcp:azsdk_get_pipeline_status`        | Get pipeline run status                        |
+| Tool                                             | Purpose                                             |
+| ------------------------------------------------ | --------------------------------------------------- |
+| `azure-sdk-mcp:azsdk_analyze_pipeline`           | Analyze pipeline failure (logs + test results)      |
+| `azure-sdk-mcp:azsdk_get_pipeline_llm_artifacts` | Download test result artifacts from pipeline        |
+| `azure-sdk-mcp:azsdk_get_failed_test_run_data`   | Full details for every failure in one artifact file |
+| `azure-sdk-mcp:azsdk_get_failed_test_case_data`  | Full details for a single failing test in a file    |
+| `azure-sdk-mcp:azsdk_get_pr_checks`              | Get pipeline/check results linked to a PR           |
+| `azure-sdk-mcp:azsdk_get_pipeline_status`        | Get pipeline run status                             |
 
 ## Steps
 
 1. **Identify** - Get the build ID, pipeline URL, or PR link (use the PR link when triggered from a PR comment).
-2. **Analyze** - Run `azsdk_analyze_pipeline`. It returns `failed_tasks` (log errors from failed steps) and `failed_test_titles` (failed tests grouped by file).
-3. **Categorize** each failure: test, build/compilation, validation/lint, or infrastructure.
-4. **Diagnose** - Give each failure's root cause and affected file(s)/line(s), and note if several share one root cause. See [failure patterns](references/failure-patterns.md).
-5. **Report** - Use the [output format](references/output-format.md): root cause, affected files, per-failure fix + verify command, and fixable vs infrastructure. Recommend `azsdk-common-pipeline-fixer` to apply fixes.
+2. **Analyze** - Run `azsdk_analyze_pipeline`. It returns `failed_pipeline_tasks` (log errors from failed steps) and `failed_pipeline_tests`, a lightweight index of failed tests grouped by artifact file. Each entry has `artifact_file_path`, `platform`, and `failed_test_titles` — titles only, no error text, to keep the response small.
+3. **Fetch failure details** - Fetch failure details lazily so you don't overload context: call `azsdk_get_failed_test_run_data` with the parameter `failedTestRunsPath` set to `artifact_file_path` once per file to get every failure in it. Or call `azsdk_get_failed_test_case_data` with
+   `failedTestRunsPath` set to `artifact_file_path` and `testCaseTitle` set to one exact title from `failed_test_titles`. Prefer the per-file call when triaging a whole file's failures.
+4. **Categorize** each failure: test, build/compilation, validation/lint, or infrastructure.
+5. **Diagnose** - Give each failure's root cause and affected file(s)/line(s), and note if several share one root cause. See [failure patterns](references/failure-patterns.md).
+6. **Report** - Use the [output format](references/output-format.md): root cause, affected files, per-failure fix + verify command, and fixable vs infrastructure. Recommend `azsdk-common-pipeline-fixer` to apply fixes.
 
 ## Examples
 
@@ -46,5 +50,5 @@ This skill analyzes Azure SDK CI/CD pipeline failures and provides a structured
 ## Troubleshooting
 
 - If `azsdk_analyze_pipeline` returns no data, verify the build ID is correct and the run has completed.
-- If `failed_test_titles` is empty, rely on `failed_tasks` log analysis (test-artifact upload may not be configured).
+- If `failed_pipeline_tests` is empty, rely on `failed_pipeline_tasks` log analysis (test-artifact upload may not be configured).
 - For a private/internal pipeline, the user may need to `az login`. See [failure patterns](references/failure-patterns.md).

eng/common/pipelines/templates/archetype-typespec-emitter.yml

@@ -303,7 +303,12 @@ extends:
         jobs:
         - job: Initialize
           steps:
+          # Regeneration does not read repository history, so fetch only the
+          # checked-out commit. git-branch-push.ps1's retry path diffs the branch
+          # tip against its parent, which stays inside the depth-1 boundary.
           - checkout: self
+            fetchDepth: 1
+            fetchTags: false
 
           - template: /eng/common/pipelines/templates/steps/login-to-github.yml
             parameters:
@@ -399,6 +404,8 @@ extends:
             emitterNpmrcPath: $(Agent.TempDirectory)/${{ parameters.EmitterPackagePath }}/.npmrc
           steps:
           - checkout: self
+            fetchDepth: 1
+            fetchTags: false
 
           - template: /eng/common/pipelines/templates/steps/login-to-github.yml
             parameters:

eng/common/pipelines/templates/jobs/generate-job-matrix.yml

@@ -53,9 +53,16 @@ parameters:
 - name: PRMatrixKey
   type: string
   default: 'ArtifactName'
+# Default number of PackageInfo entries assigned to each PR job.
+# Used when a pool-specific override is absent or its runtime variable is unset.
 - name: PRJobBatchSize
   type: number
   default: 10
+# Optional map of pool names to per-job batch-size overrides.
+# Values may be numbers or runtime variables populated by PreGenerationSteps.
+- name: PRJobBatchSizeByPool
+  type: object
+  default: {}
 - name: PRMatrixIndirectFilters
   type: object
   default: []
@@ -142,6 +149,28 @@ jobs:
         - pwsh: |
             '${{ convertToJson(parameters.MatrixConfigs) }}' | Set-Content matrix.json
 
+            $batchSize = ${{ parameters.PRJobBatchSize }}
+            $overrides = '${{ convertToJson(parameters.PRJobBatchSizeByPool) }}' | ConvertFrom-Json
+            $poolOverride = $overrides.PSObject.Properties |
+              Where-Object { $_.Name -eq '${{ pool.name }}' } |
+              Select-Object -First 1
+            # An unset runtime macro remains in $(Name) form; retain the default in that case.
+            if ($poolOverride) {
+              $overrideValue = [string]$poolOverride.Value
+              if (-not [string]::IsNullOrWhiteSpace($overrideValue) -and $overrideValue -notmatch '^\$\(.+\)$') {
+                try {
+                  $batchSize = [int]$overrideValue
+                }
+                catch {
+                  throw "PR job batch size override for ${{ pool.name }} must be an integer, got '$overrideValue'."
+                }
+                Write-Host "Using batch size override for ${{ pool.name }}: $batchSize"
+              }
+            }
+            if ($batchSize -le 0) {
+              throw "PR job batch size for ${{ pool.name }} must be greater than zero."
+            }
+
             ./eng/common/scripts/job-matrix/Create-PrJobMatrix.ps1 `
               -PackagePropertiesFolder $(Build.ArtifactStagingDirectory)/PackageInfo `
               -PRMatrixFile matrix.json `
@@ -151,7 +180,7 @@ jobs:
               -Filters '${{ join(''',''', parameters.MatrixFilters) }}', 'container=^$', 'SupportedClouds=^$|${{ parameters.CloudConfig.Cloud }}', 'Pool=${{ pool.filter }}' `
               -IndirectFilters '${{ join(''',''', parameters.PRMatrixIndirectFilters) }}' `
               -Replace '${{ join(''',''', parameters.MatrixReplace) }}' `
-              -PackagesPerPRJob ${{ parameters.PRJobBatchSize }} `
+              -PackagesPerPRJob $batchSize `
               -SparseIndirect $${{ parameters.PRMatrixSparseIndirect }}
           displayName: Create ${{ pool.name }} PR Matrix
           name: vm_job_matrix_pr_${{ pool.name }}

eng/pipelines/templates/stages/partner-release.yml

@@ -83,5 +83,3 @@ extends:
                   - template: /eng/pipelines/templates/steps/esrp-publish.yml
                     parameters:
                       targetFolder: $(Pipeline.Workspace)/esrp-release/
-                      owners: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
-                      approvers: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}

eng/pipelines/templates/steps/esrp-publish.yml

@@ -1,12 +1,6 @@
 parameters:
   - name: targetFolder
     type: string
-  - name: owners
-    type: string
-    default: $(Build.RequestedForEmail)
-  - name: approvers
-    type: string
-    default: $(Build.RequestedForEmail)
 steps:
   - task: EsrpRelease@11
     displayName: 'Publish to ESRP'
@@ -20,7 +14,7 @@ steps:
       Intent: 'PackageDistribution'
       ContentType: 'PyPI'
       FolderLocation: ${{parameters.targetFolder}}
-      Owners: ${{parameters.owners}}
-      Approvers: ${{parameters.approvers}}
+      Owners: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
+      Approvers: ${{ coalesce(variables['Build.RequestedForEmail'], 'azuresdk@microsoft.com') }}
       ServiceEndpointUrl: 'https://api.esrp.microsoft.com'
       MainPublisher: 'ESRPRELPACMANTEST'

scripts/breaking_changes_checker/detect_breaking_changes.py

@@ -775,6 +775,15 @@ def build_report_from_apistub(
     return report
 
 
+def _uninstall_package(package_name: str, pkg_dir: str) -> None:
+    """Remove an installed package so APIStub cannot reuse a same-version distribution."""
+    subprocess.run(
+        [sys.executable, "-m", "pip", "uninstall", "-y", package_name],
+        cwd=pkg_dir,
+        check=False,
+    )
+
+
 def _resolve_pypi_version(package_name: str, latest_pypi_version: bool) -> str:
     """Resolve the PyPI version to compare against.
 
@@ -838,12 +847,16 @@ def main(
         # match "current", producing an empty changelog.
         if not version:
             version = _resolve_pypi_version(package_name, latest_pypi_version)
-        # "current" is generated from the local source, "stable" from the
-        # resolved PyPI version.
-        current = build_report_from_apistub(package_name, pkg_dir, debug=debug, label="current", from_pypi=False)
+        # APIStub installs each target into this Python environment, and pip skips
+        # replacement when local and PyPI distributions have the same name/version.
+        # Clear both snapshots for repeatable runs, then install local last so it
+        # remains available to downstream SDK generation steps.
+        _uninstall_package(package_name, pkg_dir)
         stable = build_report_from_apistub(
             package_name, pkg_dir, version=version, debug=debug, label="stable", from_pypi=True
         )
+        _uninstall_package(package_name, pkg_dir)
+        current = build_report_from_apistub(package_name, pkg_dir, debug=debug, label="current", from_pypi=False)
         checker = compare_report_dicts(stable, current, package_name, changelog)
         print(checker.report_changes())
         if not changelog and checker.breaking_changes:

scripts/breaking_changes_checker/tests/test_code_report_changelog.py

@@ -414,6 +414,19 @@ def test_compare_code_reports_for_azure_mgmt_apimanagement_apistub():
     )
 
 
+def test_uninstall_package_uses_active_python_environment():
+    from breaking_changes_checker import detect_breaking_changes
+
+    with mock.patch.object(detect_breaking_changes.subprocess, "run") as run:
+        detect_breaking_changes._uninstall_package("azure-mgmt-network", "/tmp/azure-mgmt-network")
+
+    run.assert_called_once_with(
+        [sys.executable, "-m", "pip", "uninstall", "-y", "azure-mgmt-network"],
+        cwd="/tmp/azure-mgmt-network",
+        check=False,
+    )
+
+
 def test_use_apistub_changelog_resolves_stable_from_pypi_and_current_from_local():
     """``--use-apistub`` without ``-s`` must diff local source against the previous PyPI release.
 
@@ -432,12 +445,17 @@ def test_use_apistub_changelog_resolves_stable_from_pypi_and_current_from_local(
     checker = mock.MagicMock()
     checker.report_changes.return_value = ""
     checker.breaking_changes = []
+    events = mock.Mock()
 
     with mock.patch("pypi_tools.pypi.PyPIClient", return_value=pypi_client) as pypi_client_cls, mock.patch.object(
+        detect_breaking_changes, "_uninstall_package"
+    ) as uninstall_package, mock.patch.object(
         detect_breaking_changes, "build_report_from_apistub", return_value={}
     ) as build_report, mock.patch.object(
         detect_breaking_changes, "compare_report_dicts", return_value=checker
     ) as compare:
+        events.attach_mock(uninstall_package, "uninstall")
+        events.attach_mock(build_report, "build_report")
         detect_breaking_changes.main(
             package_name="azure-mgmt-network",
             target_module="azure.mgmt.network",
@@ -453,6 +471,25 @@ def test_use_apistub_changelog_resolves_stable_from_pypi_and_current_from_local(
         )
 
     assert build_report.call_count == 2, "Expected separate apistub reports for current and stable"
+    assert events.mock_calls == [
+        mock.call.uninstall("azure-mgmt-network", "/tmp/azure-mgmt-network"),
+        mock.call.build_report(
+            "azure-mgmt-network",
+            "/tmp/azure-mgmt-network",
+            version="30.2.0",
+            debug=False,
+            label="stable",
+            from_pypi=True,
+        ),
+        mock.call.uninstall("azure-mgmt-network", "/tmp/azure-mgmt-network"),
+        mock.call.build_report(
+            "azure-mgmt-network",
+            "/tmp/azure-mgmt-network",
+            debug=False,
+            label="current",
+            from_pypi=False,
+        ),
+    ]
 
     # The resolver must force the public PyPI backend: in CI PIP_INDEX_URL points
     # at the curated Azure Artifacts feed, which is not a full mirror of PyPI.

sdk/keyvault/azure-keyvault-certificates/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Release History
 
+## 4.12.0b3 (Unreleased)
+
+### Features Added
+
+### Breaking Changes
+
+### Bugs Fixed
+
+### Other Changes
+
 ## 4.12.0b2 (2026-08-12)
 
 ### Bugs Fixed

sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates/_version.py

@@ -3,4 +3,4 @@
 # Licensed under the MIT License.
 # ------------------------------------
 
-VERSION = "4.12.0b2"
+VERSION = "4.12.0b3"

sdk/keyvault/azure-keyvault-secrets/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Release History
 
+## 4.11.2 (Unreleased)
+
+### Features Added
+
+### Breaking Changes
+
+### Bugs Fixed
+
+### Other Changes
+
 ## 4.11.1 (2026-08-12)
 
 ### Bugs Fixed