ci(hidi): route container deployment jobs to Linux

[Gavin Barron (gavinbarron)]

Summary

Set an explicit deployment-job-level 1ES pool for publish_container and publish_preview_container in .azure-pipelines/hidi-release.yml:

pool:
  name: Azure-Pipelines-1ESPT-ExDShared
  image: ubuntu-latest
  os: linux

Remove the two ineffective strategy.runOnce.deploy.pool.vmImage blocks. The inherited default remains Windows for build, signing, and NuGet publishing.

Also update the Hidi GitHubRelease@1 task's sole gitHubConnection input to exactly 'microsoftgraph (22)', as requested. The OData library release pipeline and ADO pipeline-definition repository checkout endpoint are not changed.

Why

The first production Hidi v2 run selected Windows despite the hook-level Ubuntu selection and failed at SetUnixFileMode before credential writing, ACR login, or Docker build. Main has the same configuration. The parent's read-only ADO preview confirmed that the old hook-level selection is not retained as an effective Linux pool in compiled 1ES YAML.

The canonical 1ES Custom Release Job contract supports a pool directly on a deployment job. The E+D shared pool documentation documents this existing pool and image: ubuntu-latest / os: linux; no new pool or resource grant is introduced.

The connection follow-up uses the user-requested GitHub release connection for Hidi artifact attachment without changing task input names or release behavior.

Scope and validation

• One YAML file only; cumulatively 9 lines added and 5 removed. The connection follow-up alone replaces one line.
• PyYAML parses the result; the original full parsed-document comparison permits only the two job-level pool additions and two hook-level pool removals. The connection follow-up recursively checks every gitHubConnection input (one occurrence), restores only its prior value, and proves the full parsed document is otherwise unchanged. Exact textual reconstruction passes for both changes.
• git diff --check passes.
• Stable publishing remains true; preview publishing remains false. Versions, dependencies, cache identity, tag gates/floors, ESRP tasks, protected environments, artifact paths, feed authentication, secret permissions/cleanup, and container identity/platforms are unchanged.

Actual ADO compiled-YAML preview

Historical proof, not validation of the current head: the parent session completed an actual read-only ADO preview for prior head 7bd6b74ca99f9fa2bca4055520276e9398bb9bcc. Its verify-container-pool-preview.py parsed the real server-returned finalYaml and passed:

• Both publish_container and the disabled publish_preview_container resolve to Azure-Pipelines-1ESPT-ExDShared, os: linux, hostArchitecture: amd64, and demand ImageOverride -equals ubuntu-latest; the injected 1ES installers select linux/resolved.
• Build job hidi and NuGet deployment publish_hidi retain os: windows, demand ImageOverride -equals windows-latest, and Windows installer selection.
• Preview-only request: no run was created. This proves compiled 1ES pool routing for that prior head, not production agent execution or successful publication.

Local historical evidence retained in the parent session (not committed):

C:\Users\gavinbarron\.copilot\session-state\c631d217-9378-4cee-8c7e-761043ff3ae5\files\official-release-250228\fixed-main-7bd6b74c-preview.verification.json
C:\Users\gavinbarron\.copilot\session-state\c631d217-9378-4cee-8c7e-761043ff3ae5\files\official-release-250228\fixed-main-7bd6b74c-preview.yml

Refreshed exact-head preview PASS: the parent session completed a separate actual read-only ADO preview (previewRun: true) for current head 94a39a57c3f0bde5721cbdea88b2a2dc98eebff4, including the connection follow-up. Verification of the real server-returned finalYaml confirms:

• The sole compiled GitHubRelease@1 connection input is exactly microsoftgraph (22).
• Both stable and disabled-preview container deployments select the existing Linux/Ubuntu pool with hostArchitecture: amd64, demand ImageOverride -equals ubuntu-latest, and Linux installer selection. Build and NuGet jobs remain Windows/windows-latest.
• The v3 tag guard and protected nuget-org / docker-images-deploy environments are retained; main preview publishing remains disabled.
• No run was created. These are compiled configuration checks, not a claim of production agent execution or successful GitHub/container/NuGet publication.

Read-only service-connection metadata also confirms that existing GitHub connection microsoftgraph (22) is ready (ID 507e403c-ec02-44cf-b7aa-fc0bf0121470); no permission grants were made.

Local refreshed evidence retained in the parent session (not committed):

C:\Users\gavinbarron\.copilot\session-state\c631d217-9378-4cee-8c7e-761043ff3ae5\files\official-release-250228\fixed-main-94a39a57-preview.verification.json
C:\Users\gavinbarron\.copilot\session-state\c631d217-9378-4cee-8c7e-761043ff3ae5\files\official-release-250228\fixed-main-94a39a57-preview.yml

No build/release/rerun, publication, tag change, resource grant, or merge is requested or performed by this change. Existing tagged revisions and compiled runs are not corrected by merging new YAML. A future approved Hidi 3.11.1 release ref must include this accepted fix before tagging; the existing release PR is outside this change's scope.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Ramses Sanchez-Hernandez (ramsessanchez)]

Approving. One suggestion however, might be a good idea to use our custom Linux pool rather than the shared azure ones, depending on the frequency of use.