diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml index 5329000fb..625a22dfc 100644 --- a/.azure-pipelines/hidi-release.yml +++ b/.azure-pipelines/hidi-release.yml @@ -19,8 +19,8 @@ variables: buildConfiguration: Release NuGetOrganizationName: 'openapinet' privateFeedBaseUrl: 'https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public' - # Keep OFF until destination merges and source publishing is cut over. - hidiPublishingEnabled: 'false' + # Merge only after official signed-pack verification and source publisher cutover. + hidiPublishingEnabled: 'true' hidiPreviewPublishingEnabled: 'false' resources: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f87b51b71..d22c016dd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,13 +66,23 @@ Routing follows package directories, not commit scopes. Hidi tests outside the source package are excluded from OData releases and do not independently trigger a Hidi release. Root distribution/helper files remain outside the Hidi component; they follow the root package's standard routing, not custom Hidi routing. -Existing root OData exclusions remain configured. The official Hidi -package/container publishing gates remain disabled during migration. +Existing root OData exclusions remain configured. On `main`, the official Hidi +pipeline sets `hidiPublishingEnabled: 'true'` for stable tag publishing and +retains `hidiPreviewPublishingEnabled: 'false'`; preview publishing remains off. +This enablement must remain unmerged until the +[release cutover prerequisites](src/Microsoft.OpenApi.Hidi/readme.md#release-cutover-prerequisites) +are satisfied. The ADO OData pipeline accepts `v3.*` tags and deploys only the exact OData package matching that tag and `Directory.Build.props`. The dedicated Hidi pipeline accepts `hidi-v3.*` tags; its package, symbols, executable, ZIP and container version must match the Hidi tag/project version. Malformed, other-component or mismatched tags fail validation rather than publishing a -different component. With publishing disabled, branch/PR builds remain validation-only; the existing -Hidi publishing flags, migration floor and protected environments are unchanged. \ No newline at end of file +different component. Branch/PR builds remain validation-only: the unchanged +stable stage condition requires a successful build, the stable flag and a +`refs/tags/hidi-v3.` prefix. The preview stage also requires the preview flag, +which remains false. Tag validation, the migration floor and protected +environments are unchanged. Changing main's YAML does not change an existing +tagged revision or an already compiled pipeline run; publication requires an +approved corrected release ref/version after cutover, not a rerun or retag of +the old `hidi-v3.11.0` revision. \ No newline at end of file diff --git a/README.md b/README.md index e3b392206..5169836ef 100644 --- a/README.md +++ b/README.md @@ -94,8 +94,12 @@ The NuGet package remains `Microsoft.OpenApi.Hidi` and the command remains `hidi Hidi 3.x is maintained on `main`; Hidi 2.x is maintained on `support/v2`. Both tracks use independent versions and require the .NET 8 runtime. Building this repository, including the Hidi tests, requires the .NET 10 SDK. -Destination Hidi release publishing is disabled during the migration; the -source repository remains intact until the destination PRs are completed. +The main Hidi pipeline sets `hidiPublishingEnabled: 'true'` for stable +`hidi-v3.*` tag releases; `hidiPreviewPublishingEnabled: 'false'` keeps main +previews off. This enablement must not merge until the signed-pack corrections +are accepted, a fresh official publish-disabled build verifies the packaged +Hidi DLL's signature and hash, and the source main publisher is retired for +cutover. See [the release prerequisites](src/Microsoft.OpenApi.Hidi/readme.md#release-cutover-prerequisites). --- diff --git a/src/Microsoft.OpenApi.Hidi/readme.md b/src/Microsoft.OpenApi.Hidi/readme.md index 0d9b83a92..131736433 100644 --- a/src/Microsoft.OpenApi.Hidi/readme.md +++ b/src/Microsoft.OpenApi.Hidi/readme.md @@ -68,10 +68,12 @@ does not change the existing OData test platform. The gated main Hidi publisher preserves the ESRP NuGet contract from [microsoft/OpenAPI.NET#3107](https://github.com/microsoft/OpenAPI.NET/pull/3107) -(source commit `e1a75437b76ebfc7c9eb446e9fd0b59a21afb14b`). Official builds include +(source commit `e1a75437b76ebfc7c9eb446e9fd0b59a21afb14b`). Official builds are intended to include the signed Hidi `.nupkg`, a matching `.snupkg` and the private-feed version-check script in the `Hidi` artifact. The `nuget-org` release job consumes that artifact -without a repository checkout or the Docker context. +without a repository checkout or the Docker context. Outer NuGet signing and +a signed executable do not prove that the DLL inside the package is signed; +the cutover prerequisites below require separate verification. Before ESRP publication, the job requires the exact `hidi-v3.*` release package and symbols with a version newer than 3.10.2. It checks @@ -83,8 +85,9 @@ release's signed package, executable and ZIP attachments to be updated. ESRP receives only the exact Hidi package and matching symbols under the `openapinet` organization, retaining the source's federated DevX connection, -publisher identity, owners and approvers. This handoff does not enable publishing -or grant pipeline permissions. Owners must separately verify private-feed token +publisher identity, owners and approvers. The main pipeline sets the stable +publishing flag to `'true'`, but this does not grant pipeline permissions. +Owners must separately verify private-feed token access, the ESRP connection and protected `nuget-org` environment authorization before cutover; local packaging does not prove production signing or publishing. @@ -151,18 +154,46 @@ this handoff does not grant permissions or bypass service-connection approvals. The Dockerfile secret mount is optional, so local and GitHub Actions builds without a secret continue to use their default NuGet sources. -The migration baseline 3.10.2 is already published. Destination Hidi NuGet, -GitHub release, stable Docker and preview Docker publishing are disabled until -source cutover. The first destination stable release must advance the Hidi -version; OData releases use separate artifacts and tags. +The migration baseline 3.10.2 is already published and must not be republished. +On `main`, `hidiPublishingEnabled: 'true'` enables the stable NuGet, GitHub release +attachments and Docker stage only for successful `hidi-v3.*` tag builds. +`hidiPreviewPublishingEnabled: 'false'` keeps preview Docker publishing off, +so main branch and PR builds do not publish. The existing exact tag/project +validation, version floor newer than 3.10.2 and environment approvals remain +required. OData releases use separate artifacts and tags. The gated official pipeline retains the consumer image `mcr.microsoft.com/openapi/hidi`, backed by `msgraphprodregistry.azurecr.io/public/openapi/hidi`. Stable images use `latest` and the independent Hidi version. Main previews use `nightly` and `VERSION.YYYYMMDDRUNNUM`, for `linux/amd64` and `linux/arm64/v8`. -No image is pushed during this migration. Privileged cross-platform emulation +This preparation does not authorize an image push. Privileged cross-platform emulation setup belongs only in the authorized CI pipeline, not a shared local environment. + +### Release cutover prerequisites + +Hold the stable enablement merge until the signed-pack corrections +[#904](https://github.com/microsoft/OpenAPI.NET.OData/pull/904) (`support/v2`) and +[#903](https://github.com/microsoft/OpenAPI.NET.OData/pull/903) (`main`) complete +normal acceptance in v2-first order. Then verify a fresh official build with +both publishing flags disabled: extract the Hidi DLL from the exact `.nupkg`, +verify its genuine Microsoft Authenticode signature and SHA-256 equality with +the signed DLL staged by that build, and verify the outer package and Windows +executable signatures. A successful signing task or local packaging alone is +not this proof. The old official artifacts contain an unsigned inner DLL and +must not be republished. + +The source main publisher must also be retired and cutover approved; source +cleanup is tracked in +[microsoft/OpenAPI.NET#3111](https://github.com/microsoft/OpenAPI.NET/pull/3111). +This draft preparation does not perform that retirement or grant resource access. + +Merging a YAML flag change on `main` does not change the YAML or binaries at an +existing tag, or an already compiled pipeline run. The existing `hidi-v3.11.0` +tag points to the old publish-disabled revision without the signed-pack fix. +Do not move or reuse that tag, rerun it to publish, or republish its old artifact. +Future publication requires a corrected release ref/version approved for cutover +after the prerequisites above are met. ## How to use Hidi