From 2abbb2042189bfc57b7deca483d9d2f1468e165b Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 14 Oct 2026 10:27:51 -0700
Subject: [PATCH 1/2] ci(hidi): select Linux pool for v2 container deployment

Set the approved shared-pool Linux image at deployment-job scope instead of the ineffective deployment hook. Preserve the Windows default and all release steps and protections.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 233e3c6f-e303-4c8c-9256-13f42a56db46
---
 .azure-pipelines/hidi-release.yml    | 6 ++++--
 src/Microsoft.OpenApi.Hidi/readme.md | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml
index a11c53fb4..c230ff89e 100644
--- a/.azure-pipelines/hidi-release.yml
+++ b/.azure-pipelines/hidi-release.yml
@@ -303,6 +303,10 @@ extends:
                           $(Pipeline.Workspace)\hidi\hidi-win-x64-$(HidiReleaseVersion).zip
                         addChangeLog: false
           - deployment: publish_container
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
             templateContext:
               type: releaseJob
               isProduction: true
@@ -314,8 +318,6 @@ extends:
             strategy:
               runOnce:
                 deploy:
-                  pool:
-                    vmImage: ubuntu-latest
                   steps:
                     - pwsh: |
                         $ErrorActionPreference = 'Stop'
diff --git a/src/Microsoft.OpenApi.Hidi/readme.md b/src/Microsoft.OpenApi.Hidi/readme.md
index e2795783d..28cb27c9d 100644
--- a/src/Microsoft.OpenApi.Hidi/readme.md
+++ b/src/Microsoft.OpenApi.Hidi/readme.md
@@ -114,6 +114,10 @@ private keys are excluded. The container release job consumes this artifact as
 a 1ES input without checking out the repository. NuGet and Windows release
 artifacts continue to use the separate `Hidi` artifact.
 
+The container deployment selects the approved `Azure-Pipelines-1ESPT-ExDShared`
+pool with `image: ubuntu-latest` and `os: linux` at deployment-job scope.
+The build and NuGet/Windows artifact release jobs retain the Windows default pool.
+
 The container release job retains the existing `docker-images-deploy`
 environment and its approvals/checks. The destination pipeline must be authorized
 for that protected environment before official publishing can execute. Signed

From 859df3d5f92f0dbfe83501f38cc4ada2564a9cdb Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Wed, 14 Oct 2026 10:52:49 -0700
Subject: [PATCH 2/2] ci(hidi): use microsoftgraph GitHub release connection

Use the user-selected microsoftgraph (22) service connection for the Hidi GitHubRelease input on support/v2. Preserve the Linux deployment pool correction and all other pipeline inputs and steps.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 233e3c6f-e303-4c8c-9256-13f42a56db46
---
 .azure-pipelines/hidi-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml
index c230ff89e..aec3b08bb 100644
--- a/.azure-pipelines/hidi-release.yml
+++ b/.azure-pipelines/hidi-release.yml
@@ -292,7 +292,7 @@ extends:
                     - task: GitHubRelease@1
                       displayName: Attach signed hidi release artifacts
                       inputs:
-                        gitHubConnection: Github-MaggieKimani1
+                        gitHubConnection: 'microsoftgraph (22)'
                         action: edit
                         tagSource: userSpecifiedTag
                         tag: 'hidi-v$(HidiReleaseVersion)'