From c0ac5f337b09e50a949102d7dca5749cafe3a04b Mon Sep 17 00:00:00 2001 From: "Gavin Barron (from Dev Box)" Date: Tue, 13 Oct 2026 10:37:54 -0700 Subject: [PATCH] ci(hidi): prepare v2 publishing enablement Enable the existing tag-gated publishing switch on support/v2 and document the coordinated cutover hold without changing release guards or versions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 36349d51-b5dc-4742-99b9-9e535f56cb57 --- .azure-pipelines/hidi-release.yml | 4 ++-- CONTRIBUTING.md | 18 +++++++++++++----- README.md | 13 ++++++++++--- src/Microsoft.OpenApi.Hidi/readme.md | 20 ++++++++++++++++---- 4 files changed, 41 insertions(+), 14 deletions(-) diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml index c84fefd3a..a11c53fb4 100644 --- a/.azure-pipelines/hidi-release.yml +++ b/.azure-pipelines/hidi-release.yml @@ -19,8 +19,8 @@ variables: buildConfiguration: Release NuGetOrganizationName: 'openapinet' privateFeedBaseUrl: 'https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public' - # Keep OFF until the destination PR lands and source publishing is cut over. - hidiPublishingEnabled: 'false' + # Merge only after official signed-pack verification and coordinated cutover approval. + hidiPublishingEnabled: 'true' resources: repositories: diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9a777e700..8fa33027d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -29,9 +29,13 @@ is handled only by the official Azure pipeline. Hidi's version is in its own project and the `src/Microsoft.OpenApi.Hidi` entry in `.release-please-manifest.json`. Its `hidi-v2.*` tags must not trigger OData publishing. Version 2.12.2 is the -already-published migration baseline, not a new release. Production publishing -remains disabled until source cutover. History-import migration PRs must be -merged with a merge commit, never squash or rebase. +already-published migration baseline, not a new release. The release configuration +enables tag-gated Hidi publishing once merged; hold its merge until official +signed-package verification and coordinated cutover approval. Source `support/v2` +publisher cleanup is already accepted in +[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109); +source-main cleanup is not a prerequisite for this branch. History-import +migration PRs must be merged with a merge commit, never squash or rebase. ### Independent automated versions @@ -58,8 +62,12 @@ and container publishing remains gated in the official Azure pipeline. On `support/v2`, `.azure-pipelines/ci-build.yml` releases only the OData package and attaches only its artifact for `v2.*` tags. `.azure-pipelines/hidi-release.yml` handles only `hidi-v2.*` tags for Hidi's -NuGet package, Windows executable/ZIP, and container. Hidi publishing stays -disabled until the protected cutover; this routing does not enable it. +NuGet package, Windows executable/ZIP, and container. `hidiPublishingEnabled` +is the string `'true'`; the publish stage still requires a successful build and +a `refs/tags/hidi-v2.*` ref, with all protected-environment approvals intact. +Branch/PR builds do not publish. Future publication requires a new corrected +release ref/version after cutover approval. Never move or reuse existing release +tags, rerun `hidi-v2.13.0` to publish, or republish its old unsigned artifacts. Tag runs must exactly match the component's project version before staging artifacts. Release jobs require the exact tag-derived package and symbols; diff --git a/README.md b/README.md index c8fd6df7c..0d3d7651d 100644 --- a/README.md +++ b/README.md @@ -102,8 +102,12 @@ migration PR using a merge commit, not squash or rebase**, so the canonical imported commits can also be retained by the later main-branch migration. The standard Release Please config and manifest track Hidi and OData as separate components on `support/v2`, updating their project versions and changelogs -independently. Production publishing remains disabled until source cutover; -OpenAPI.NET remains the package publisher in the meantime. +independently. Hidi's release configuration enables tag-gated production +publishing once this change is merged. Hold the enablement merge until official +signed-package verification and coordinated cutover approval. Source `support/v2` +publisher cleanup is already accepted in +[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109); +source-main cleanup is not a prerequisite for this branch. See [independent automated versions](CONTRIBUTING.md#independent-automated-versions) for component paths and version-file ownership. @@ -114,7 +118,10 @@ artifact. The authenticated private-feed version check is ported from An existing version skips ESRP on a re-run; authentication, network, and malformed feed responses fail closed. Releases must use an exact `hidi-v2.` tag matching the project version and be newer than the `2.12.2` migration baseline. -This pipeline implementation does not enable publishing or authorize resources. +Existing release tags must not be moved or reused. Future publication requires +a new corrected release ref/version after cutover approval, not a rerun of the +existing `hidi-v2.13.0` tag or reuse of its old unsigned artifacts. +This configuration change does not publish a release or authorize resources. The SonarCloud workflow runs the private-feed and signed-payload helper tests with Pester 5.7.1 and converts measured JaCoCo line hits to Sonar generic coverage, diff --git a/src/Microsoft.OpenApi.Hidi/readme.md b/src/Microsoft.OpenApi.Hidi/readme.md index 56282a8bb..e2795783d 100644 --- a/src/Microsoft.OpenApi.Hidi/readme.md +++ b/src/Microsoft.OpenApi.Hidi/readme.md @@ -70,8 +70,15 @@ docker run --rm --mount "type=bind,source=$PWD\test\Microsoft.OpenApi.Hidi.Tests Local/CI builds use the public-only strong-name identity. Official release artifacts are signed in Azure Pipelines; private signing keys do not belong in -this repository. The migration baseline 2.12.2 is already published. Destination -NuGet, executable, and Docker publishing are disabled until source cutover. +this repository. The migration baseline 2.12.2 is already published. +`hidiPublishingEnabled` is the string `'true'` in the release configuration: +after merging, successful `hidi-v2.*` tag builds can enter the protected NuGet, +executable, and Docker publishing stage. Hold the enablement merge until official +signed-package verification and coordinated cutover approval. Source `support/v2` +publisher cleanup is already accepted in +[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109); +source-main cleanup is not a prerequisite for this branch. Branch/PR builds +remain build-only. This change does not publish artifacts or grant permissions. Official tool packing passes `HidiSignedAssemblyPath` to replace the Hidi DLL in the SDK's `ResolvedFileToPublish` items after `ComputeFilesToPublish`. `PackAsTool` publishes the intermediate assembly from `obj`, so replacing only @@ -91,7 +98,10 @@ The standard Release Please config tracks Hidi as its own component, with a separate manifest version, project version, changelog, and `hidi-v2.*` tags. The first destination package release must advance beyond the baseline and use an exact `hidi-v2.` tag matching the project. OData releases use separate -artifacts and tags. +artifacts and tags. Existing `hidi-v2.13.0` points at an earlier publish-disabled +revision without the signed-package fix. Never move or reuse that tag, rerun it +to publish, or republish its old unsigned artifacts. Future publication requires +a new corrected release ref/version after the cutover hold clears. Docker builds opt into `HidiPublicSignBuild=true` for the local OData project, using its own public-only key without changing normal OData signing behavior. @@ -106,7 +116,9 @@ artifacts continue to use the separate `Hidi` artifact. The container release job retains the existing `docker-images-deploy` environment and its approvals/checks. The destination pipeline must be authorized -for that protected environment before official publishing can be enabled. +for that protected environment before official publishing can execute. Signed +artifact verification does not prove live NuGet or Docker publishing permissions, +and neither the flag nor this change bypasses release approvals/checks. The official container job authenticates to the approved `GraphDeveloperExperiences_Public` central feed using the existing Azure DevOps