ci(hidi): prepare stable publishing enablement

[Gavin Barron (gavinbarron)]

Enable stable hidi publishing from OpenAPI.NET.OData

Enable the main branch's stable hidi publication stages. The migration and signed-package corrections are accepted, and real official artifacts have passed signature, provenance, and runtime verification. The publishing implementation is ready; this is no longer a draft preparation or signing-investigation PR.

The equivalent support/v2 change is #908. Required branch reviews and protected deployment checks remain in effect.

Scope

• Set hidiPublishingEnabled: 'true' in .azure-pipelines/hidi-release.yml so successful hidi-v3.* tag builds can publish the NuGet tool, Windows assets, and stable Docker image.
• Keep hidiPreviewPublishingEnabled: 'false'; nightly/preview publication remains disabled.
• Update the existing README, CONTRIBUTING, and hidi readme for stable publishing and release sequencing.

Tag routing, exact version validation, migration floor, signing/ESRP tasks, artifact selectors, feeds, identities, and protected environments are unchanged. OData's pipeline and versions are unchanged: Hidi 3.11.0, OData 3.2.1, core/YAML 3.10.2. Original base: 8b080b455afa06551edc8ad477b347bd78c5f4e3; code head: 9a9dd1474d7fec065e389e5eb2fa85600eb7787c.

Verified readiness

Signing fixes landed normally, v2 first: #904 at 92e4df6cf3c4deb53c3b4a1d1c45fe2320adaaa1, then #903 at ae0d7a64a7ae76a810cb6c5e90f9e3c85cb08cbf.

Official pipeline 759, main build 249744, succeeded at the main correction commit with publishing and preview skipped. Independent verification of its actual downloaded artifacts passed:

• Packaged Hidi DLL: Valid Microsoft Corporation Authenticode, exactly matching the production-verified ESRP staging SHA-256 62265BD36846821BA26916AC8E6F5B7E46E16E1980856C7A8D54F139A48F2C11.
• NuGet signature verification, Windows executable signature/ZIP byte equality, two portable PDBs, strong-name identities, exact dependencies, and release helper: passed.
• Public-only Docker context: 214 files, two 160-byte public signing keys, no private signing material or credential config; passed.
• Isolated executable help and local-only tool installation/help with unchanged signed DLL bytes: passed.

Equivalent official v2 build 249739 also passed, including staging SHA-256 7C6AF032FB6F11B9D991E2BEED44251FAD36E98C0144FAAC3A056DA380DDD2FF. Durable reports are retained under migration session c631d217-9378-4cee-8c7e-761043ff3ae5, official-249744 and official-249739. These runs establish signed-artifact readiness; actual deployment uses the existing protected environments and service connections.

Condition validation

startsWith(variables['Build.SourceBranch'], 'refs/tags/hidi-v3.') is correct and unchanged. The reported skip resulted from the previous publishing flag being 'false', not a prefix mismatch. Azure documentation confirms ordinal ignore-case prefix matching and short-circuiting and().

Local YAML structural/exact-diff, unchanged-version, and CRLF-aware whitespace checks passed; all 12 condition cases passed; all 24 isolated helper Pester tests passed. The model accepts matching successful/enabled Hidi v3 tags and rejects OData tags, v2 tags, branch/PR refs, disabled flags and failed/canceled builds; preview stays off. Local condition checks are not production deployment execution.

Release sequencing

Source-publisher retirement dependency satisfied. microsoft/OpenAPI.NET#3111 merged normally at 2026-10-13T19:29:14Z as be0f4bd6c34ce76387614fe610f5082a4803668d, before this enablement change. The accepted tree 90cec69 matches cleanup validated against current source-main base 1ff69b41: 1,917 tests passed, core/YAML packaging and library publishing preserved. External SDL retry build 249788, attempt 2, succeeded and required approval was green; the source-only squash merge used normal policy, not an admin override. Source-v2 cleanup is already merged. The required retirement-before-enablement order is complete.

Ready for normal-policy acceptance with verified user auto-merge intent. gavinbarron (non-bot) enabled SQUASH auto-merge on this PR at 2026-10-13T18:18:13Z; that user request is preserved. The source-before-enablement dependency is satisfied, and required reviews, checks and protected deployment controls continue to apply. This PR remains unmerged; actual publication has not occurred.

After the approved cutover, publish a new release version/tag containing both the signing fix and this enablement change. Existing hidi-v3.11.0 points to earlier publish-disabled code without the signing correction; changing main does not alter that tag or its compiled run. Do not republish its old unsigned artifacts (including historical builds 248624/248625) or move/reuse the tag.

This description update changes no code, PR head, merge state, publishing configuration, tags, or releases.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud