[7.0] Eng | Disable ESRP steps on non-official pipelines by paulmedynski · Pull Request #4113 · dotnet/SqlClient

paulmedynski · 2026-03-31T19:29:06Z

Cherry-pick of #4077 to release/7.0

Depends on #4111

Original PR Description

Description

Fixes PRC violations by disabling ESRP codesigning tasks on non-official pipelines.

Testing

Non-Official build: https://sqlclientdrivers.visualstudio.com/ADO.Net/_build/results?buildId=144627&view=results

Future Guidelines to follow:

Run dev/** branches on non-official pipelines only, and not on the official pipelines - unless modifying official build (specifically).
Do not update non-official pipelines to access production resources.

* Disable ESRP steps on non-official pipelines * Update copilot instructions * Skip Signature verification for non-official builds * Address comments * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * touch-ups --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Updates the OneBranch pipeline templates to ensure non-official runs do not execute ESRP malware scanning/code-signing steps (production resource access), while preserving signing/verification behavior for official builds.

Changes:

Introduces and threads an isOfficial boolean through OneBranch build stages/jobs to gate ESRP signing and signature verification.
Adds configurable NuGet package globbing (nupkgPattern / pattern) to scope ESRP package scanning/signing to the intended outputs.
Refactors/updates GitHub instruction docs for CI/PR vs OneBranch pipeline editing guidance.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
eng/pipelines/onebranch/steps/esrp-code-signing-step.yml	Adds `nupkgPattern` and refactors ESRP step formatting for DLL/pkg signing.
eng/pipelines/onebranch/steps/compound-esrp-nuget-signing-step.yml	Adds a `pattern` parameter to scope NuGet malware scan/signing globs.
eng/pipelines/onebranch/stages/build-stages.yml	Adds `isOfficial` parameter and threads it into build/sign/validate jobs.
eng/pipelines/onebranch/sqlclient-official.yml	Passes `isOfficial: true` into build stages.
eng/pipelines/onebranch/sqlclient-non-official.yml	Passes `isOfficial: false` into build stages.
eng/pipelines/onebranch/jobs/validate-signed-package-job.yml	Gates signature/authenticode checks on `isOfficial`.
eng/pipelines/onebranch/jobs/build-signed-sqlclient-package-job.yml	Gates ESRP DLL/pkg signing steps on `isOfficial` and scopes pkg signing pattern.
eng/pipelines/onebranch/jobs/build-signed-csproj-package-job.yml	Gates ESRP DLL/pkg signing steps on `isOfficial` and scopes pkg signing pattern.
.github/instructions/onebranch-pipeline-design.instructions.md	Replaces detailed design spec with condensed OneBranch editing guidelines.
.github/instructions/ado-pipelines.instructions.md	Replaces broad ADO guide with condensed CI/PR pipeline editing guidelines.

Copilot · 2026-03-31T19:33:38Z

eng/pipelines/onebranch/jobs/validate-signed-package-job.yml

+          - name: extractedNugetPath
+            value: $(extractedNugetRootPath).$(mdsPackagePreviewVersion)
+          - name: mdsPackageVersion
+            value: $(mdsPackagePreviewVersion)


extractedNugetPath and mdsPackageVersion are only set when isPreview is true. When isPreview is false, later steps reference $(extractedNugetPath) / $(mdsPackageVersion) and the job will fail due to undefined variables. Add an ${{ else }} branch that sets these variables for GA builds (e.g., using $(mdsPackageVersion) and the matching extracted path).

Suggested change

value: $(mdsPackagePreviewVersion)

value: $(mdsPackagePreviewVersion)

- ${{ else }}:

- name: extractedNugetPath

value: $(extractedNugetRootPath).$(mdsPackageVersion)

- name: mdsPackageVersion

value: $(mdsPackageVersion)

Copilot · 2026-03-31T19:33:38Z

.github/instructions/onebranch-pipeline-design.instructions.md

@@ -1,534 +1,139 @@
 ---
 applyTo: "eng/pipelines/**/*.yml"


The frontmatter applyTo: "eng/pipelines/**/*.yml" is broader than the document’s stated scope (OneBranch pipelines under eng/pipelines/onebranch/). This will apply these guidelines to non-OneBranch YAML files and can create conflicting instructions. Narrow applyTo to eng/pipelines/onebranch/**/*.yml (or adjust the document scope accordingly).

Suggested change

applyTo: "eng/pipelines/**/*.yml"

applyTo: "eng/pipelines/onebranch/**/*.yml"

Copilot · 2026-03-31T19:33:39Z

.github/instructions/ado-pipelines.instructions.md

 ---
 applyTo: "eng/pipelines/**/*.yml"
 ---
-# Azure DevOps Pipelines Guide
-
-## Overview
-
-This repository uses Azure DevOps Pipelines for CI/CD. The pipeline configurations are located in `eng/pipelines/`.
-
-**ADO Organization**: sqlclientdrivers
-**ADO Project**: ADO.NET
-
-## Pipeline Structure
-
-```
-eng/pipelines/
-├── abstractions/               # Abstractions package pipelines
-├── azure/                      # Azure package pipelines
-├── common/                     # Shared templates
-│   └── templates/
-│       ├── jobs/               # Reusable job templates
-│       ├── stages/             # Reusable stage templates
-│       └── steps/              # Reusable step templates
-├── jobs/                       # Top-level job definitions
-├── libraries/                  # Shared variable definitions
-├── stages/                     # Stage definitions
-├── steps/                      # Step definitions
-├── variables/                  # Variable templates
-├── akv-official-pipeline.yml                   # AKV provider official/signing build
-├── dotnet-sqlclient-ci-core.yml                # Core CI pipeline (reusable)
-├── dotnet-sqlclient-ci-package-reference-pipeline.yml  # CI with package references
-├── dotnet-sqlclient-ci-project-reference-pipeline.yml  # CI with project references
-├── dotnet-sqlclient-signing-pipeline.yml       # Package signing pipeline
-├── sqlclient-pr-package-ref-pipeline.yml       # PR validation (package ref)
-├── sqlclient-pr-project-ref-pipeline.yml       # PR validation (project ref)
-└── stress-tests-pipeline.yml                   # Stress testing
-```
-
-## Main Pipelines
-
-### CI Core Pipeline (`dotnet-sqlclient-ci-core.yml`)
-Reusable core CI pipeline consumed by both project-reference and package-reference CI pipelines. Configurable parameters:
-
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `targetFrameworks` | Windows test frameworks | `[net462, net8.0, net9.0, net10.0]` |
-| `targetFrameworksUnix` | Unix test frameworks | `[net8.0, net9.0, net10.0]` |
-| `referenceType` | Project or Package reference | Required |
-| `buildConfiguration` | Debug or Release | Required |
-| `useManagedSNI` | Test with managed SNI | `[false, true]` |
-| `testJobTimeout` | Test job timeout (minutes) | Required |
-| `runAlwaysEncryptedTests` | Include AE tests | `true` |
-| `enableStressTests` | Include stress test stage | `false` |
-
-### CI Reference Pipelines
- `dotnet-sqlclient-ci-project-reference-pipeline.yml` — Full CI using project references (builds from source)
- `dotnet-sqlclient-ci-package-reference-pipeline.yml` — Full CI using package references (tests against published NuGet packages)
-
-### PR Validation Pipelines
- `sqlclient-pr-project-ref-pipeline.yml` — PR validation with project references
- `sqlclient-pr-package-ref-pipeline.yml` — PR validation with package references
-
-These pipelines trigger on pull requests and run a subset of the full CI matrix to provide fast feedback.
-
-### Official/Signing Pipeline (`dotnet-sqlclient-signing-pipeline.yml`)
-Signs and publishes NuGet packages. Used for official releases. Requires secure service connections and key vault access for code signing.
-
-### AKV Official Pipeline (`akv-official-pipeline.yml`)
-Builds and signs the `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` add-on package separately from the main driver. Uses 1ES pipeline templates for compliance.
-
-### Stress Tests Pipeline (`stress-tests-pipeline.yml`)
-Optional pipeline for long-running stress and endurance testing. Enabled via `enableStressTests` parameter in CI core.
-
-## Build Stages
-
-1. **build_abstractions_package_stage**: Build and pack abstractions
-2. **build_sqlclient_package_stage**: Build main driver and AKV packages
-3. **build_azure_package_stage**: Build Azure extensions package
-4. **stress_tests_stage**: Optional stress testing
-5. **run_tests_stage**: Execute all test suites
+# Azure DevOps CI/CD Pipeline Guidelines
+
+## Purpose


This document says it applies to CI/PR pipelines and explicitly excludes eng/pipelines/onebranch/, but the frontmatter uses applyTo: "eng/pipelines/**/*.yml", which includes OneBranch YAML too. This can lead to conflicting instructions being applied to OneBranch pipelines. Consider changing applyTo to exclude onebranch/ (e.g., scope to eng/pipelines/*.yml and relevant subfolders) or update the document scope text to match.

samsharma2700 and others added 2 commits March 31, 2026 16:26

Scope NuGet package signing to specific packages (#4058)

545f59b

Copilot AI review requested due to automatic review settings March 31, 2026 19:29

github-project-automation bot added this to SqlClient Board Mar 31, 2026

github-project-automation bot moved this to To triage in SqlClient Board Mar 31, 2026

Copilot started reviewing on behalf of paulmedynski March 31, 2026 19:29 View session

paulmedynski changed the base branch from release/7.0 to cherry-pick/7.0/4058 March 31, 2026 19:32

Copilot AI reviewed Mar 31, 2026

View reviewed changes

paulmedynski added this to the 7.0.1 milestone Mar 31, 2026

paulmedynski moved this from To triage to In review in SqlClient Board Mar 31, 2026

paulmedynski marked this pull request as ready for review March 31, 2026 19:48

paulmedynski requested a review from a team as a code owner March 31, 2026 19:48

paulmedynski marked this pull request as draft April 2, 2026 15:47

Base automatically changed from cherry-pick/7.0/4058 to release/7.0 April 2, 2026 18:24

mdaigle approved these changes Apr 2, 2026

View reviewed changes

paulmedynski modified the milestones: 7.0.1, 7.0.2 Apr 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[7.0] Eng | Disable ESRP steps on non-official pipelines#4113

[7.0] Eng | Disable ESRP steps on non-official pipelines#4113
paulmedynski wants to merge 2 commits intorelease/7.0from
cherry-pick/7.0/4077

paulmedynski commented Mar 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Copilot AI Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	applyTo: "eng/pipelines/*/.yml"
	applyTo: "eng/pipelines/onebranch/*/.yml"

Conversation

paulmedynski commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Original PR Description

Description

Testing

Future Guidelines to follow:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

paulmedynski commented Mar 31, 2026 •

edited

Loading