ci(hidi): prepare v2 publishing enablement

.azure-pipelines/hidi-release.yml

@@ -19,8 +19,8 @@ variables:
   buildConfiguration: Release
   NuGetOrganizationName: 'openapinet'
   privateFeedBaseUrl: 'https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public'
-  # Keep OFF until the destination PR lands and source publishing is cut over.
-  hidiPublishingEnabled: 'false'
+  # Merge only after official signed-pack verification and coordinated cutover approval.
+  hidiPublishingEnabled: 'true'
 
 resources:
   repositories:

CONTRIBUTING.md

@@ -29,9 +29,13 @@ is handled only by the official Azure pipeline.
 Hidi's version is in its own project and the
 `src/Microsoft.OpenApi.Hidi` entry in `.release-please-manifest.json`.
 Its `hidi-v2.*` tags must not trigger OData publishing. Version 2.12.2 is the
-already-published migration baseline, not a new release. Production publishing
-remains disabled until source cutover. History-import migration PRs must be
-merged with a merge commit, never squash or rebase.
+already-published migration baseline, not a new release. The release configuration
+enables tag-gated Hidi publishing once merged; hold its merge until official
+signed-package verification and coordinated cutover approval. Source `support/v2`
+publisher cleanup is already accepted in
+[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109);
+source-main cleanup is not a prerequisite for this branch. History-import
+migration PRs must be merged with a merge commit, never squash or rebase.
 
 ### Independent automated versions
 
@@ -58,8 +62,12 @@ and container publishing remains gated in the official Azure pipeline.
 On `support/v2`, `.azure-pipelines/ci-build.yml` releases only the OData package
 and attaches only its artifact for `v2.*` tags.
 `.azure-pipelines/hidi-release.yml` handles only `hidi-v2.*` tags for Hidi's
-NuGet package, Windows executable/ZIP, and container. Hidi publishing stays
-disabled until the protected cutover; this routing does not enable it.
+NuGet package, Windows executable/ZIP, and container. `hidiPublishingEnabled`
+is the string `'true'`; the publish stage still requires a successful build and
+a `refs/tags/hidi-v2.*` ref, with all protected-environment approvals intact.
+Branch/PR builds do not publish. Future publication requires a new corrected
+release ref/version after cutover approval. Never move or reuse existing release
+tags, rerun `hidi-v2.13.0` to publish, or republish its old unsigned artifacts.
 
 Tag runs must exactly match the component's project version before staging
 artifacts. Release jobs require the exact tag-derived package and symbols;

README.md

@@ -102,8 +102,12 @@ migration PR using a merge commit, not squash or rebase**, so the canonical
 imported commits can also be retained by the later main-branch migration.
 The standard Release Please config and manifest track Hidi and OData as separate
 components on `support/v2`, updating their project versions and changelogs
-independently. Production publishing remains disabled until source cutover;
-OpenAPI.NET remains the package publisher in the meantime.
+independently. Hidi's release configuration enables tag-gated production
+publishing once this change is merged. Hold the enablement merge until official
+signed-package verification and coordinated cutover approval. Source `support/v2`
+publisher cleanup is already accepted in
+[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109);
+source-main cleanup is not a prerequisite for this branch.
 See [independent automated versions](CONTRIBUTING.md#independent-automated-versions)
 for component paths and version-file ownership.
 
@@ -114,7 +118,10 @@ artifact. The authenticated private-feed version check is ported from
 An existing version skips ESRP on a re-run; authentication, network, and malformed
 feed responses fail closed. Releases must use an exact `hidi-v2.<version>` tag
 matching the project version and be newer than the `2.12.2` migration baseline.
-This pipeline implementation does not enable publishing or authorize resources.
+Existing release tags must not be moved or reused. Future publication requires
+a new corrected release ref/version after cutover approval, not a rerun of the
+existing `hidi-v2.13.0` tag or reuse of its old unsigned artifacts.
+This configuration change does not publish a release or authorize resources.
 
 The SonarCloud workflow runs the private-feed and signed-payload helper tests
 with Pester 5.7.1 and converts measured JaCoCo line hits to Sonar generic coverage,

src/Microsoft.OpenApi.Hidi/readme.md

@@ -70,8 +70,15 @@ docker run --rm --mount "type=bind,source=$PWD\test\Microsoft.OpenApi.Hidi.Tests
 
 Local/CI builds use the public-only strong-name identity. Official release
 artifacts are signed in Azure Pipelines; private signing keys do not belong in
-this repository. The migration baseline 2.12.2 is already published. Destination
-NuGet, executable, and Docker publishing are disabled until source cutover.
+this repository. The migration baseline 2.12.2 is already published.
+`hidiPublishingEnabled` is the string `'true'` in the release configuration:
+after merging, successful `hidi-v2.*` tag builds can enter the protected NuGet,
+executable, and Docker publishing stage. Hold the enablement merge until official
+signed-package verification and coordinated cutover approval. Source `support/v2`
+publisher cleanup is already accepted in
+[microsoft/OpenAPI.NET#3109](https://github.com/microsoft/OpenAPI.NET/pull/3109);
+source-main cleanup is not a prerequisite for this branch. Branch/PR builds
+remain build-only. This change does not publish artifacts or grant permissions.
 Official tool packing passes `HidiSignedAssemblyPath` to replace the Hidi DLL
 in the SDK's `ResolvedFileToPublish` items after `ComputeFilesToPublish`.
 `PackAsTool` publishes the intermediate assembly from `obj`, so replacing only
@@ -91,7 +98,10 @@ The standard Release Please config tracks Hidi as its own component, with a
 separate manifest version, project version, changelog, and `hidi-v2.*` tags.
 The first destination package release must advance beyond the baseline and use
 an exact `hidi-v2.<version>` tag matching the project. OData releases use separate
-artifacts and tags.
+artifacts and tags. Existing `hidi-v2.13.0` points at an earlier publish-disabled
+revision without the signed-package fix. Never move or reuse that tag, rerun it
+to publish, or republish its old unsigned artifacts. Future publication requires
+a new corrected release ref/version after the cutover hold clears.
 
 Docker builds opt into `HidiPublicSignBuild=true` for the local OData project,
 using its own public-only key without changing normal OData signing behavior.
@@ -106,7 +116,9 @@ artifacts continue to use the separate `Hidi` artifact.
 
 The container release job retains the existing `docker-images-deploy`
 environment and its approvals/checks. The destination pipeline must be authorized
-for that protected environment before official publishing can be enabled.
+for that protected environment before official publishing can execute. Signed
+artifact verification does not prove live NuGet or Docker publishing permissions,
+and neither the flag nor this change bypasses release approvals/checks.
 
 The official container job authenticates to the approved
 `GraphDeveloperExperiences_Public` central feed using the existing Azure DevOps