Add Manual OneBranch Release Stage & Publish Support (Internal/Public) by cheenamalhotra · Pull Request #3761 · dotnet/SqlClient

cheenamalhotra · 2025-11-13T00:29:32Z

Description

Adds a manual, parameter‑gated release stage to the signing pipeline enabling:

Internal or public NuGet publish (publishDestination)
Dry run preview (dryRun)
Optional symbol publishing (MDS only)
Human approval checklist (destination, preview, dry run, symbols, version, product)

Next Steps:

Run Dryrun and Approval workflow to validate changes ensuring configuration is up-to-date.
Make an attempt to publish MDS packages to internal feed.
Validate workflows for all 3 packages: MDS, MSS, AKV

Investigate:

Can symbols be published using the same "compound-publish-symbols-step" for AKV and MSS packages?

Copilot

Pull Request Overview

This PR adds a manual release stage to the OneBranch signing pipeline, enabling controlled NuGet package publishing with approval gates. The implementation supports both internal and public publishing destinations, includes dry-run capability for testing, and integrates symbol publishing for the MDS product.

Key Changes:

Adds manual release parameters (destination, dry run, product) to the signing pipeline
Implements approval workflow with human validation before package publication
Creates templated release infrastructure supporting multiple products (MDS, MSS, AKV)

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
eng/pipelines/dotnet-sqlclient-signing-pipeline.yml	Adds release parameters and invokes new release-stage template
eng/pipelines/common/templates/stages/release-stage.yml	Defines manual release stage with approval and publish jobs
eng/pipelines/common/templates/jobs/approval-job.yml	Implements manual validation job with release checklist
eng/pipelines/common/templates/jobs/publish-packages-job.yml	Orchestrates package download and conditional publishing to internal/public feeds
eng/pipelines/common/templates/steps/publish-internal-feed-step.yml	Handles internal feed publishing with dry-run support
eng/pipelines/common/templates/steps/publish-public-nuget-step.yml	Handles NuGet.org publishing with dry-run support
eng/pipelines/common/templates/steps/list-packages-step.yml	Lists packages for verification before publishing
eng/pipelines/common/templates/steps/publish-symbols-step.yml	Updates symbol publishing to use boolean type and add AKV product support

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

Copilot

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 10 comments.

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/jobs/approval-job.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 8 comments.

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

tools/scripts/publishPackagesToAzDOFeed.ps1

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/stages/release-stage.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 11 comments.

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-public-nuget-step.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 9 comments.

tools/scripts/publishPackagesToAzDOFeed.ps1

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

eng/pipelines/common/templates/steps/publish-symbols-step.yml

eng/pipelines/common/templates/stages/release-stage.yml

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Copilot · 2026-01-05T20:58:56Z

eng/pipelines/common/templates/steps/publish-symbols-step.yml

-      echo "3	Cancelled; The request was cancelled"
+  - powershell: 'Write-Host "##vso[task.setvariable variable=ArtifactServices.Symbol.AccountName;]${{parameters.SymAccount}}"'
+    displayName: "Update Symbol.AccountName with ${{parameters.SymAccount}}"
+    condition: and(succeeded(), eq(parameters.publishSymbols, true))


The parameter type for publishSymbols has been changed from 'string' to 'boolean', which is the correct type for a boolean flag. However, the condition on line 79 should be updated to use the boolean comparison syntax. Change 'eq(parameters.publishSymbols, true)' instead of comparing to the string 'true'.

Copilot · 2026-01-05T20:58:56Z

eng/pipelines/common/templates/jobs/publish-packages-job.yml

+            parameters:
+              dryRun: ${{ parameters.dryRun }}
+              publicNuGetSource: ${{ parameters.publicNuGetSource }}
+              packagesGlob: ${{ variables.targetDownloadPath }}/*.nupkg


Same issue as line 83 - the variable targetDownloadPath should be referenced using runtime syntax $(targetDownloadPath) instead of template syntax ${{ variables.targetDownloadPath }}.

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

eng/pipelines/common/templates/jobs/publish-packages-job.yml

…p.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Copilot · 2026-02-11T18:38:24Z

tools/scripts/publishPackagesToAzDOFeed.ps1

+    # Parse the glob pattern to extract directory and filename pattern
+    $glob = $packagesGlob
+    $lastSlashIndex = $glob.LastIndexOf('/')
+
+    if ($lastSlashIndex -ge 0) {
+        $dir = $glob.Substring(0, $lastSlashIndex)
+        $namePattern = $glob.Substring($lastSlashIndex + 1)
+    } else {
+        $dir = "."
+        $namePattern = $glob
+    }
+
+    # Handle ** wildcard for recursive search
+    $recurse = $dir -like '*/**'
+    if ($recurse) {
+        $dir = $dir -replace '/?\*\*/?', ''
+    }
+
+    Write-Host "Resolved directory: $dir" -ForegroundColor Yellow
+    Write-Host "Filename pattern: $namePattern" -ForegroundColor Yellow
+
+    if (Test-Path $dir -PathType Container) {
+        Write-Host "Matched files:" -ForegroundColor Green
+
+        # Find matching .nupkg files
+        $packages = Get-ChildItem -Path $dir -Filter "*.nupkg" -Recurse:$recurse -File -ErrorAction SilentlyContinue
+


$namePattern is derived from packagesGlob, but the actual file enumeration always uses -Filter "*.nupkg", so the provided glob/pattern is effectively ignored. Either use $namePattern (and possibly handle .snupkg if intended) or remove the unused parsing to avoid misleading configuration.

Copilot · 2026-02-11T18:38:24Z

eng/pipelines/common/templates/jobs/publish-packages-job.yml

+    variables:
+      - name: targetDownloadPath
+        value: "$(Pipeline.Workspace)/release/packages"
+    dependsOn: AwaitApproval
+    condition: succeeded()
+    pool:
+      vmImage: "ubuntu-latest"
+    steps:
+      - task: DownloadPipelineArtifact@2
+        displayName: "Download Signed Packages"
+        inputs:
+          buildType: current
+          artifactName: ${{ parameters.packageFolderName }}
+          targetPath: ${{ variables.targetDownloadPath }}
+      - script: |
+          echo "NuGet Package Version: ${{ parameters.nugetPackageVersion }}"
+          echo "Downloaded signed packages to: ${{ variables.targetDownloadPath }}"
+        displayName: "Echo NuGet Package Version"


targetDownloadPath is defined as a job variable, but it’s referenced via template expression ${{ variables.targetDownloadPath }}. Template expressions are evaluated before runtime variables exist, so these paths will be empty/incorrect. Use runtime variable syntax ($(targetDownloadPath)) consistently for targetPath, echo output, and packagesGlob.

Copilot · 2026-02-11T18:38:25Z

eng/pipelines/common/templates/steps/publish-symbols-step.yml

+  - powershell: 'Write-Host "##vso[task.setvariable variable=ArtifactServices.Symbol.AccountName;]${{parameters.SymAccount}}"'
+    displayName: "Update Symbol.AccountName with ${{parameters.SymAccount}}"
+    condition: and(succeeded(), eq(parameters.publishSymbols, true))
+


The step conditions use eq(parameters.publishSymbols, true) without ${{ }} expansion. parameters.* isn’t available in runtime conditions, so these steps will be skipped even when the template parameter is true. Either remove the runtime condition (since the surrounding ${{ if ... }} already gates inclusion) or expand the boolean at compile time inside the condition.

Copilot · 2026-02-11T18:38:25Z

tools/scripts/publishPackagesToAzDOFeed.ps1

+            if (-not $dryRun) {
+                Write-Host "`nPushing packages to feed..." -ForegroundColor Cyan
+                foreach ($package in $packages) {
+                    Write-Host "`nPushing packages to feed..." -ForegroundColor Cyan
+                $anyPushFailed = $false
+                foreach ($package in $packages) {
+                    Write-Host "Pushing package: $($package.FullName)" -ForegroundColor Yellow
+                    dotnet nuget push $package.FullName --source $SRC --api-key az
+
+                    if ($LASTEXITCODE -ne 0) {
+                        Write-Host "Failed to push package: $($package.FullName)" -ForegroundColor Red
+                        $anyPushFailed = $true
+                    } else {
+                        Write-Host "Successfully pushed: $($package.Name)" -ForegroundColor Green
+                    }
+                }


The push block has duplicated/nested foreach ($package in $packages) loops and $anyPushFailed is declared inside the wrong scope; as written it looks like braces are unbalanced and the script will either fail to parse or never execute the intended push loop. Refactor to a single loop, initialize $anyPushFailed once before iterating, and remove the redundant inner loop/log line.

Copilot · 2026-02-11T18:38:25Z

eng/pipelines/dotnet-sqlclient-signing-pipeline.yml

+      # TODO: Build other products as well based on parameters['product']
+      # This pipeline currently only builds MDS product.
+      - ${{ if eq(parameters['product'], 'MDS') }}:
+          - stage: buildMDS
+            displayName: "Build MDS"
+            jobs:
+              - template: eng/pipelines/common/templates/jobs/build-signed-package-job.yml@self
+                parameters:
+                  symbolsFolder: $(symbolsFolder)
+                  softwareFolder: $(softwareFolder)
+                  publishSymbols: ${{ parameters['publishSymbols'] }}
+                  isPreview: ${{ parameters['isPreview'] }}
+          - stage: mds_package_validation
+            displayName: "MDS Package Validation"
+            dependsOn: buildMDS


This pipeline exposes product values MSS/AKV, but the build/validation stages are only instantiated when product == 'MDS' while the Release stage template is always included. If a user queues a manual run with product set to MSS/AKV and runRelease=true, the release job will attempt to download a non-existent artifact and fail. Consider restricting product values until builds exist, or conditionally include the release stage per product as well.

codecov · 2026-02-11T20:45:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (3ffbba7) to head (d337d8f).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #3761       +/-   ##
==========================================
- Coverage   74.53%       0   -74.54%     
==========================================
  Files         266       0      -266     
  Lines       42915       0    -42915     
==========================================
- Hits        31987       0    -31987     
+ Misses      10928       0    -10928

Flag	Coverage Δ
addons	`?`
netcore	`?`
netfx	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

mdaigle · 2026-02-12T17:30:34Z

eng/pipelines/common/templates/jobs/publish-packages-job.yml

+  # Approval aliases for manual validation before publishing packages
+  - name: approvalAliases
+    type: string
+    default: '[ADO.Net]\\SqlClient Admins'


I feel like this should be locked down. In what situation would we want to allow non-admins to approve?

mdaigle · 2026-02-12T17:37:49Z

tools/scripts/publishPackagesToAzDOFeed.ps1

+            if (-not $dryRun) {
+                Write-Host "`nPushing packages to feed..." -ForegroundColor Cyan
+                foreach ($package in $packages) {
+                    Write-Host "`nPushing packages to feed..." -ForegroundColor Cyan


Some of this is a little weird. It prints Pushing packages to feed... for each package, then loops through again and pushes each the package.

We can remove this first loop.

mdaigle · 2026-02-12T17:39:04Z

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml

+steps:
+  - task: PowerShell@2
+    inputs:
+      displayName: Publish to Internal Feed


Why can't we use the Nuget task pointed at an internal feed?

mdaigle · 2026-02-12T17:48:47Z

tools/scripts/downloadLatestNuget.ps1

I didn't realize this file even existed. Not for this pr, but we should definitely switch to dotnet pack when we can.

Add publish support in OneBranch Official pipeline

e89f1e7

cheenamalhotra requested a review from a team as a code owner November 13, 2025 00:29

Copilot AI review requested due to automatic review settings November 13, 2025 00:29

Copilot started reviewing on behalf of cheenamalhotra November 13, 2025 00:30 View session

Copilot finished reviewing on behalf of cheenamalhotra November 13, 2025 00:32

Copilot AI reviewed Nov 13, 2025

View reviewed changes

cheenamalhotra added 2 commits November 12, 2025 20:26

Improvements

dd21456

Cleanups

02cbe58

Copilot AI review requested due to automatic review settings November 13, 2025 05:01

Copilot started reviewing on behalf of cheenamalhotra November 13, 2025 05:01 View session

Minor touch-ups

a693ea4

Copilot finished reviewing on behalf of cheenamalhotra November 13, 2025 05:04

Copilot AI reviewed Nov 13, 2025

View reviewed changes

paulmedynski requested changes Nov 13, 2025

View reviewed changes

paulmedynski self-assigned this Nov 13, 2025

cheenamalhotra added 2 commits December 10, 2025 22:33

Convert inline script to ps script file

ccc9259

More changes

adae0fa

Copilot AI review requested due to automatic review settings December 11, 2025 07:24

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 07:25 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

cheenamalhotra added 2 commits December 10, 2025 23:31

Minor changes

4bb2180

Update official signing pipeline

226f6e7

Copilot AI review requested due to automatic review settings December 11, 2025 07:39

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 07:39 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

cheenamalhotra and others added 2 commits December 10, 2025 23:55

Code formattings

9875749

Merge branch 'main' into dev/cheena/gov-release-templates

b53d379

Copilot AI review requested due to automatic review settings December 11, 2025 08:00

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 08:01 View session

cheenamalhotra requested a review from paulmedynski December 11, 2025 08:02

cheenamalhotra and others added 2 commits December 11, 2025 09:01

Update powershell task

ad30487

Update eng/pipelines/common/templates/steps/publish-symbols-step.yml

e22f320

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

cheenamalhotra requested review from Copilot and paulmedynski December 11, 2025 18:13

Copilot started reviewing on behalf of cheenamalhotra December 11, 2025 18:14 View session

Copilot AI reviewed Dec 11, 2025

View reviewed changes

paulmedynski previously approved these changes Dec 23, 2025

View reviewed changes

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml Outdated Show resolved Hide resolved

cheenamalhotra commented Jan 5, 2026

View reviewed changes

eng/pipelines/common/templates/steps/publish-internal-feed-step.yml Outdated Show resolved Hide resolved

Apply suggestion from @cheenamalhotra

0bc8ec7

cheenamalhotra dismissed paulmedynski’s stale review via 0bc8ec7 January 5, 2026 20:54

Copilot AI review requested due to automatic review settings January 5, 2026 20:54

Copilot started reviewing on behalf of cheenamalhotra January 5, 2026 20:54 View session

cheenamalhotra requested a review from paulmedynski January 5, 2026 20:55

Copilot AI reviewed Jan 5, 2026

View reviewed changes

cheenamalhotra added the Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. label Jan 13, 2026

cheenamalhotra modified the milestones: 7.0.0-preview4, 7.0.0-preview5 Jan 20, 2026

cheenamalhotra requested a review from a team February 11, 2026 18:30

Update eng/pipelines/common/templates/steps/publish-internal-feed-ste…

884f56e

…p.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 11, 2026 18:32

Copilot started reviewing on behalf of cheenamalhotra February 11, 2026 18:33 View session

Copilot AI reviewed Feb 11, 2026

View reviewed changes

Merge branch 'main' into dev/cheena/gov-release-templates

d337d8f

paulmedynski approved these changes Feb 11, 2026

View reviewed changes

mdaigle requested changes Feb 12, 2026

View reviewed changes

paulmedynski modified the milestones: 7.0.0-preview5, 7.0.0-preview4 Feb 12, 2026

mdaigle modified the milestones: 7.0.0-preview4, 7.1.0-preview1 Feb 17, 2026

Conversation

cheenamalhotra commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Next Steps:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cheenamalhotra commented Nov 13, 2025 •

edited

Loading

mdaigle Feb 12, 2026 •

edited

Loading