Add Manual OneBranch Release Stage & Publish Support (Internal/Public) #3761

cheenamalhotra · 2025-11-13T00:29:32Z

Description

Adds a manual, parameter‑gated release stage to the signing pipeline enabling:

Internal or public NuGet publish (publishDestination)
Dry run preview (dryRun)
Optional symbol publishing (MDS only)
Human approval checklist (destination, preview, dry run, symbols, version, product)

Next Steps:

Run Dryrun and Approval workflow to validate changes ensuring configuration is up-to-date.
Make an attempt to publish MDS packages to internal feed.
Validate workflows for all 3 packages: MDS, MSS, AKV

Investigate:

Can symbols be published using the same "compound-publish-symbols-step" for AKV and MSS packages?

Copilot

Pull Request Overview

This PR adds a manual release stage to the OneBranch signing pipeline, enabling controlled NuGet package publishing with approval gates. The implementation supports both internal and public publishing destinations, includes dry-run capability for testing, and integrates symbol publishing for the MDS product.

Key Changes:

Adds manual release parameters (destination, dry run, product) to the signing pipeline
Implements approval workflow with human validation before package publication
Creates templated release infrastructure supporting multiple products (MDS, MSS, AKV)

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
eng/pipelines/dotnet-sqlclient-signing-pipeline.yml	Adds release parameters and invokes new release-stage template
eng/pipelines/common/templates/stages/release-stage.yml	Defines manual release stage with approval and publish jobs
eng/pipelines/common/templates/jobs/approval-job.yml	Implements manual validation job with release checklist
eng/pipelines/common/templates/jobs/publish-packages-job.yml	Orchestrates package download and conditional publishing to internal/public feeds
eng/pipelines/common/templates/steps/publish-internal-feed-step.yml	Handles internal feed publishing with dry-run support
eng/pipelines/common/templates/steps/publish-public-nuget-step.yml	Handles NuGet.org publishing with dry-run support
eng/pipelines/common/templates/steps/list-packages-step.yml	Lists packages for verification before publishing
eng/pipelines/common/templates/steps/publish-symbols-step.yml	Updates symbol publishing to use boolean type and add AKV product support

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

Copilot

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 10 comments.

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/jobs/approval-job.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

tools/scripts/publishPackagesToAzDOFeed.ps1

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/stages/release-stage.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 11 comments.

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/stages/release-stage.yml

tools/scripts/publishPackagesToAzDOFeed.ps1

eng/pipelines/common/templates/steps/publish-symbols-step.yml

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

tools/scripts/publishPackagesToFeed.ps1

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 9 comments.

Copilot · 2025-12-11T18:18:56Z

tools/scripts/publishPackagesToAzDOFeed.ps1

+# See the LICENSE file in the project root for more information.
+
+# Script: publishPackagesToAzDOFeed.ps1
+# Date:   10-12-2025


The date format is inconsistent with the existing codebase convention. The file downloadLatestNuget.ps1 uses the format "07-Dec-2018" (DD-MMM-YYYY), but this file uses "10-12-2025" (MM-DD-YYYY). Use the established format for consistency.

Suggested change

# Date: 10-12-2025

# Date: 12-Dec-2025

Copilot · 2025-12-11T18:18:57Z

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

+  - task: PowerShell@2
+    displayName: Publish to Internal Feed
+    pwsh: true
+    filePath: /tools/scripts/publishPackagesToFeed.ps1


The script path uses an absolute path "/tools/scripts/publishPackagesToFeed.ps1" which will fail. The path should be relative to the repository root, such as "$(Build.SourcesDirectory)/tools/scripts/publishPackagesToAzDOFeed.ps1" or use a relative path.

Suggested change

filePath: /tools/scripts/publishPackagesToFeed.ps1

filePath: $(Build.SourcesDirectory)/tools/scripts/publishPackagesToFeed.ps1

Copilot · 2025-12-11T18:18:57Z

eng/pipelines/common/templates/jobs/publish-packages-job.yml

+            parameters:
+              publishSymbols: ${{ parameters.publishSymbols }}
+              symbolsArtifactName: ${{ parameters.product }}_symbols_$(System.TeamProject)_$(Build.Repository.Name)_$(Build.SourceBranchName)_${{ parameters.nugetPackageVersion }}_$(System.TimelineId)
+              product: ${{ parameters.product }}


Missing a required parameter in the publish-symbols-step template. According to the template definition, "referenceType" is a required parameter but it's not being passed in this invocation. Add the referenceType parameter to match the expected interface.

Suggested change

product: ${{ parameters.product }}

product: ${{ parameters.product }}

referenceType: 'branch'

Copilot · 2025-12-11T18:18:58Z

eng/pipelines/common/templates/jobs/publish-packages-job.yml

+              internalFeedSource: ${{ parameters.internalFeedSource }}
+              packagesGlob: ${{ variables.targetDownloadPath }}/*.nupkg
+      # Publish Symbols if publishSymbols is true and is not a dry run
+      - ${{ if and(parameters.publishSymbols, not(parameters.dryRun)) }}:


The condition on line 103 uses not(parameters.dryRun) which will be evaluated at compile time. However, dryRun is a pipeline parameter that could be set at queue time. The condition should use runtime variable evaluation: not(eq(${{ parameters.dryRun }}, true)).

Suggested change

- ${{ if and(parameters.publishSymbols, not(parameters.dryRun)) }}:

- ${{ if and(eq(parameters.publishSymbols, true), not(eq(parameters.dryRun, true))) }}:

Copilot · 2025-12-11T18:18:58Z

eng/pipelines/common/templates/steps/publish-symbols-step.yml

+    condition: and(succeeded(), eq(parameters.publishSymbols, true))
+
+  - ${{ if and(eq(parameters.publishSymbols, true), eq(parameters.product, 'MDS')) }}:
+      - task: PublishSymbols@2
+        displayName: "Upload MDS symbols to ${{parameters.SymAccount }} org"
+        inputs:
+          SymbolsFolder: '$(Build.SourcesDirectory)\artifacts\${{parameters.referenceType }}\bin'
+          SearchPattern: |
+            Windows_NT/${{ parameters.buildConfiguration }}.AnyCPU/**/Microsoft.Data.SqlClient.pdb
+            Unix/${{ parameters.buildConfiguration }}.AnyCPU/**/Microsoft.Data.SqlClient.pdb
+          IndexSources: false
+          SymbolServerType: TeamServices
+          SymbolsMaximumWaitTime: 60
+          SymbolExpirationInDays: 1825 # 5 years
+          SymbolsProduct: Microsoft.Data.SqlClient
+          SymbolsVersion: ${{parameters.symbolsVersion }}
+          SymbolsArtifactName: ${{parameters.symbolsArtifactName }}
+          Pat: $(System.AccessToken)
+        condition: and(succeeded(), eq(parameters.publishSymbols, true))
+      - task: AzureCLI@2
+        displayName: "Publish MDS symbols"
+        condition: and(succeeded(), eq(parameters.publishSymbols, true))


The condition syntax is inconsistent. Line 79 uses string comparison with quotes eq(parameters.publishSymbols, true), but line 97 and 100 use the same format. For boolean parameters, the condition should use eq(${{ parameters.publishSymbols }}, true) without the $ prefix when already in a compile-time expression context, or simply use the boolean directly.

Copilot · 2025-12-11T18:18:58Z

eng/pipelines/common/templates/steps/publish-symbols-step.yml

+        condition: and(succeeded(), eq(parameters.publishSymbols, true))
+      - task: AzureCLI@2
+        displayName: "Publish MDS symbols"
+        condition: and(succeeded(), eq(parameters.publishSymbols, true))


The compile-time conditional on line 81 checks both publishSymbols and product, but the nested tasks on lines 97 and 100 have runtime conditions that check publishSymbols again. This is redundant since the tasks are already inside a compile-time conditional that ensures publishSymbols is true. Remove the redundant runtime conditions on lines 97 and 100.

Suggested change

condition: and(succeeded(), eq(parameters.publishSymbols, true))

- task: AzureCLI@2

displayName: "Publish MDS symbols"

condition: and(succeeded(), eq(parameters.publishSymbols, true))

- task: AzureCLI@2

displayName: "Publish MDS symbols"

Copilot · 2025-12-11T18:18:59Z

eng/pipelines/common/templates/stages/release-stage.yml

+    type: string
+
+stages:
+  - stage: Release ${{ parameters.product }}


The stage name contains a space which may cause issues with Azure DevOps pipeline stage identification. Stage names should use underscores or be quoted. Change to "Release_${{ parameters.product }}" or wrap in quotes.

Suggested change

- stage: Release ${{ parameters.product }}

- stage: Release_${{ parameters.product }}

Copilot · 2025-12-11T18:18:59Z

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

+    pwsh: true
+    filePath: /tools/scripts/publishPackagesToFeed.ps1
+    arguments: >
+      -dryRun ${{ parameters.dryRun }}
+      -internalFeedSource '${{ parameters.internalFeedSource }}'
+      -packagesGlob '${{ parameters.packagesGlob }}'


The task property "pwsh" should be under "inputs", not as a sibling to "displayName". The correct structure for PowerShell@2 task is to set "pwsh: true" within the inputs section or use "scriptType" parameter.

Suggested change

pwsh: true

filePath: /tools/scripts/publishPackagesToFeed.ps1

arguments: >

-dryRun ${{ parameters.dryRun }}

-internalFeedSource '${{ parameters.internalFeedSource }}'

-packagesGlob '${{ parameters.packagesGlob }}'

inputs:

pwsh: true

filePath: /tools/scripts/publishPackagesToFeed.ps1

arguments: >

-dryRun ${{ parameters.dryRun }}

-internalFeedSource '${{ parameters.internalFeedSource }}'

-packagesGlob '${{ parameters.packagesGlob }}'

Copilot · 2025-12-11T18:18:59Z

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

+  - task: PowerShell@2
+    displayName: Publish to Internal Feed
+    pwsh: true
+    filePath: /tools/scripts/publishPackagesToFeed.ps1


The filename referenced in the filePath does not match the actual filename. The filePath points to "publishPackagesToFeed.ps1" but the actual file created in this PR is "publishPackagesToAzDOFeed.ps1".

Suggested change

filePath: /tools/scripts/publishPackagesToFeed.ps1

filePath: /tools/scripts/publishPackagesToAzDOFeed.ps1

Add publish support in OneBranch Official pipeline

e89f1e7

cheenamalhotra requested a review from a team as a code owner November 13, 2025 00:29

Copilot AI review requested due to automatic review settings November 13, 2025 00:29

Copilot started reviewing on behalf of cheenamalhotra November 13, 2025 00:30 View session

Copilot finished reviewing on behalf of cheenamalhotra November 13, 2025 00:32

Copilot AI reviewed Nov 13, 2025

View reviewed changes

cheenamalhotra added 2 commits November 12, 2025 20:26

Improvements

dd21456

Cleanups

02cbe58

Copilot AI review requested due to automatic review settings November 13, 2025 05:01

Copilot started reviewing on behalf of cheenamalhotra November 13, 2025 05:01 View session

Minor touch-ups

a693ea4

Copilot finished reviewing on behalf of cheenamalhotra November 13, 2025 05:04

Copilot AI reviewed Nov 13, 2025

View reviewed changes

paulmedynski requested changes Nov 13, 2025

View reviewed changes

paulmedynski self-assigned this Nov 13, 2025

cheenamalhotra added 2 commits December 10, 2025 22:33

Convert inline script to ps script file

ccc9259

More changes

adae0fa

Copilot AI review requested due to automatic review settings December 11, 2025 07:24

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 07:25 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

cheenamalhotra added 2 commits December 10, 2025 23:31

Minor changes

4bb2180

Update official signing pipeline

226f6e7

Copilot AI review requested due to automatic review settings December 11, 2025 07:39

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 07:39 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

cheenamalhotra and others added 2 commits December 10, 2025 23:55

Code formattings

9875749

Merge branch 'main' into dev/cheena/gov-release-templates

b53d379

Copilot AI review requested due to automatic review settings December 11, 2025 08:00

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 08:01 View session

cheenamalhotra requested a review from paulmedynski December 11, 2025 08:02

cheenamalhotra requested a review from benrr101 December 11, 2025 08:02

cheenamalhotra added this to the 7.0.0-preview4 milestone Dec 11, 2025

Copilot AI reviewed Dec 11, 2025

View reviewed changes

Update release-stage.yml

22c55d6

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings December 11, 2025 08:34

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 08:35 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

eng/pipelines/common/templates/steps/publish-symbols-step.yml Show resolved Hide resolved

eng/pipelines/common/templates/steps/publish-symbols-step.yml Outdated Show resolved Hide resolved

paulmedynski requested changes Dec 11, 2025

View reviewed changes

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml Outdated Show resolved Hide resolved

tools/scripts/publishPackagesToFeed.ps1 Outdated Show resolved Hide resolved

cheenamalhotra and others added 2 commits December 11, 2025 09:01

Update powershell task

ad30487

Update eng/pipelines/common/templates/steps/publish-symbols-step.yml

e22f320

Co-authored-by: Copilot <[email protected]>

cheenamalhotra requested review from Copilot and paulmedynski December 11, 2025 18:13

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 18:14 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

	filePath: /tools/scripts/publishPackagesToFeed.ps1
	filePath: $(Build.SourcesDirectory)/tools/scripts/publishPackagesToFeed.ps1

	product: ${{ parameters.product }}
	product: ${{ parameters.product }}
	referenceType: 'branch'

	- ${{ if and(parameters.publishSymbols, not(parameters.dryRun)) }}:
	- ${{ if and(eq(parameters.publishSymbols, true), not(eq(parameters.dryRun, true))) }}:

	- stage: Release ${{ parameters.product }}
	- stage: Release_${{ parameters.product }}

Add Manual OneBranch Release Stage & Publish Support (Internal/Public) #3761

Are you sure you want to change the base?

Add Manual OneBranch Release Stage & Publish Support (Internal/Public) #3761

Uh oh!

Conversation

cheenamalhotra commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Next Steps:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cheenamalhotra commented Nov 13, 2025 •

edited

Loading