ci(hidi): prepare v2 publishing enablement

[Gavin Barron (gavinbarron)]

Enable stable hidi v2 publishing from OpenAPI.NET.OData

Enable the support/v2 branch's stable hidi publication stages, equivalent to the main change in #905. The v2 migration, source-publisher removal, and signed-package correction are accepted; real official artifacts have passed signature, provenance, and runtime verification. This normal, non-draft PR is ready for publishing enablement review.

Required branch reviews and protected deployment checks remain in effect.

Scope

• Set hidiPublishingEnabled: 'true' in .azure-pipelines/hidi-release.yml so successful hidi-v2.* tag builds can publish the NuGet tool, Windows assets, and stable Docker image.
• Update the existing README, CONTRIBUTING, and hidi readme for stable publishing and release sequencing.

Independent support/v2 change based on accepted signing correction #904, merge 92e4df6cf3c4deb53c3b4a1d1c45fe2320adaaa1. It is not stacked on main #905 (9a9dd1474d7fec065e389e5eb2fa85600eb7787c) or a reopening of #904. Head: c0ac5f337b09e50a949102d7dca5749cafe3a04b.

No preview flag, stage, or behavior is introduced. All other pipeline semantics remain unchanged: startsWith(..., 'refs/tags/hidi-v2.'), successful-build dependency, exact tag/version guards, migration floor 2.12.2, signers Yuriy Semchyshyn (@5), ESRP release akari (@14), selectors, feeds, identities, protected environments, and Docker context. OData's pipeline and versions are unchanged: Hidi 2.13.0, core/YAML 2.12.2, OData 2.2.1.

Official signed-artifact evidence (publishing disabled)

Official pipeline 759, v2 build 249739, succeeded at the accepted correction commit with publication skipped. Independent verification of its actual downloaded artifacts passed:

• Packaged Hidi DLL: Valid Microsoft Corporation Authenticode, exactly matching the production-verified ESRP staging SHA-256 7C6AF032FB6F11B9D991E2BEED44251FAD36E98C0144FAAC3A056DA380DDD2FF.
• NuGet signature verification, Windows executable signature/ZIP byte equality, two portable PDBs, strong-name identities, exact dependencies, and release helper: passed.
• Public-only Docker context: 214 files, two 160-byte public signing keys, no private signing material or credential config; passed.
• Isolated executable help and local-only tool installation/help with unchanged signed DLL bytes: passed.

Durable reports are retained under migration session c631d217-9378-4cee-8c7e-761043ff3ae5, official-249739/artifact-verification.json and corrected-runtime-verification.json. These establish signed-artifact readiness; actual deployment uses the existing protected environments and service connections.

Local validation

python <session-files>\validate-v2-publishing.py: exact allowed diff, parsed YAML equality except the flag, unchanged configuration/versions, 14 Azure condition cases and 6 release-guard cases passed. Matching Hidi v2 tags pass; v3/OData tags, branch/PR refs, failed/canceled builds, and disabled/empty flags reject. Stage ignore-case behavior and the stricter exact-tag/version/baseline guard are checked separately.

Import-Module Pester -RequiredVersion 5.7.1; Invoke-Pester .\test\Microsoft.OpenApi.Hidi.Tests\*.Tests.ps1: 45 passed, 0 failed, 0 skipped. CRLF-aware git diff --check: passed. Local condition models are not actual ADO deployment execution; no rebuild or manual pipeline rerun was needed for the flag/docs change.

Release sequencing

Source support/v2 cleanup microsoft/OpenAPI.NET#3109 is merged, so the old v2 publisher has already been removed. Source-main cleanup microsoft/OpenAPI.NET#3111 is not a prerequisite for this v2 enablement.

After the reviewed publishing cutover, publish a new release version/tag containing both the signing fix and this enablement change. Existing hidi-v2.13.0 points to earlier f2f6f0f2646d81fd7f873affe4afddedf3f2e939, without the signed-package correction or publishing enablement. Changing support/v2 does not retarget that tag or change an already compiled run. Do not move/reuse that tag or republish its old unsigned artifacts (including historical builds 248624/248625).

This description update changes no code, PR head, merge state, publishing configuration, tags, or releases.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud