From 92ecdbeb2b235fe4f7d66cfc70fef3a1044250e2 Mon Sep 17 00:00:00 2001 From: "Patrick Nelson (VS)" Date: Wed, 22 Jul 2026 10:22:02 -0700 Subject: [PATCH 1/3] More fixes to the release pipeline and add DryRun --- build/yaml/pipelines/release.yaml | 5 ++ build/yaml/stages/release.yaml | 108 +++++++++++++++++++++++------- 2 files changed, 87 insertions(+), 26 deletions(-) diff --git a/build/yaml/pipelines/release.yaml b/build/yaml/pipelines/release.yaml index 68f8a86b..09c04f08 100644 --- a/build/yaml/pipelines/release.yaml +++ b/build/yaml/pipelines/release.yaml @@ -40,6 +40,11 @@ variables: # Set to 'True' (e.g. at queue time) to promote the published packages to the Release view. PromoteToRelease: 'False' + # Set to 'True' (e.g. at queue time) for a dry run: the full pipeline runs (artifact + # download, approval gate, and -- if enabled -- the promote logic), but the NuGet push + # (output: nuget) is skipped so nothing is actually published to the feed. + DryRun: 'False' + resources: repositories: - repository: 1ESPipelineTemplates diff --git a/build/yaml/stages/release.yaml b/build/yaml/stages/release.yaml index 1dc9c129..78ba8449 100644 --- a/build/yaml/stages/release.yaml +++ b/build/yaml/stages/release.yaml @@ -25,8 +25,14 @@ stages: displayName: Publish NuGets to internal InstrumentationEngine Feed dependsOn: [] jobs: - - deployment: Publish - displayName: Publish NuGets to internal InstrumentationEngine Feed + # --------------------------------------------------------------------------------- + # Approval gate. A release (deployment) job targeting the gated environment so the + # classic pre-deploy approval still applies before anything is published. It performs + # no work itself -- 1ES release jobs cannot declare outputs, so the actual NuGet push + # lives on the separate plain 'Publish' job below (output: nuget). + # --------------------------------------------------------------------------------- + - deployment: ApprovalGate + displayName: Approval gate (internal NuGet feed) environment: CLRIE-Release-Internal-NuGet-Feed pool: name: VSEngSS-Microbuild2022-1ES @@ -39,32 +45,82 @@ stages: deploy: steps: - download: none - - download: ClrInstrumentationEngine-Signed-Yaml - artifact: packages-windows-Release - patterns: '**/Microsoft.InstrumentationEngine*.nupkg' - displayName: Download Windows packages - - download: ClrInstrumentationEngine-Signed-Yaml - artifact: packages-linux-ubuntu-Release - patterns: '**/Microsoft.InstrumentationEngine*.nupkg' - displayName: Download Linux (ubuntu) packages - - download: ClrInstrumentationEngine-Signed-Yaml - artifact: packages-linux-alpine-Release - patterns: '**/Microsoft.InstrumentationEngine*.nupkg' - displayName: Download Linux (alpine) packages - - task: NuGetAuthenticate@1 - displayName: NuGet Authenticate + # --------------------------------------------------------------------------------- + # Publish. Plain job (runs only after the gate is approved). Artifacts are downloaded + # via templateContext.inputs (the 1ES-sanctioned replacement for '- download:') and + # published via the only construct 1ES allows for pushing NuGet packages: output: nuget. + # --------------------------------------------------------------------------------- + - job: Publish + displayName: Publish NuGets to internal InstrumentationEngine Feed + dependsOn: ApprovalGate + pool: + name: VSEngSS-Microbuild2022-1ES + os: windows + templateContext: + inputs: + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-windows-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-windows-Release + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-linux-ubuntu-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-ubuntu-Release + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-linux-alpine-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-alpine-Release + outputs: + - output: nuget + displayName: Push to DevDiv InstrumentationEngine feed + # Dry run: skip the actual push (nothing is published) while the rest of the job + # -- artifact download above and the promote logic downstream -- still runs. + condition: ne(variables['DryRun'], 'True') + packageParentPath: $(ArtifactsDirectory) + packagesToPush: $(ArtifactsDirectory)\$(WindowsInstrumentationEngineNuGetArtifactPathPattern);$(ArtifactsDirectory)\$(LinuxInstrumentationEngineNuGetArtifactPathPattern) + nuGetFeedType: internal + publishVstsFeed: 59c1dfae-dea5-4ea5-ac83-c9abcb4ac339 + allowPackageConflicts: true + publishPackageMetadata: true + verbosityPush: Detailed + steps: + - checkout: none - - task: NuGetCommand@2 - displayName: Push to DevDiv InstrumentationEngine feed - inputs: - command: push - nuGetFeedType: internal - publishVstsFeed: 59c1dfae-dea5-4ea5-ac83-c9abcb4ac339 - packagesToPush: $(ArtifactsDirectory)\$(WindowsInstrumentationEngineNuGetArtifactPathPattern);$(ArtifactsDirectory)\$(LinuxInstrumentationEngineNuGetArtifactPathPattern) - allowPackageConflicts: true - publishPackageMetadata: true - verbosityPush: Detailed + # --------------------------------------------------------------------------------- + # Promote (optional). Release (deployment) job, only runs when PromoteToRelease=True. + # Artifacts are downloaded via templateContext.inputs; the promote REST call runs in + # the on.success hook below. + # --------------------------------------------------------------------------------- + - deployment: Promote + displayName: Promote package to Release View + dependsOn: Publish + condition: eq(variables['PromoteToRelease'], 'True') + environment: CLRIE-Release-Promote-Internal-NuGet-Feed + pool: + name: VSEngSS-Microbuild2022-1ES + os: windows + templateContext: + type: releaseJob + isProduction: true + inputs: + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-windows-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-windows-Release + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-linux-ubuntu-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-ubuntu-Release + - input: pipelineArtifact + pipeline: ClrInstrumentationEngine-Signed-Yaml + artifactName: packages-linux-alpine-Release + targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-alpine-Release + strategy: + runOnce: + deploy: + steps: + - download: none on: # The 'on success' hook runs after the deploy phase (including the NuGet push above) # has succeeded, so the promote step always runs after the packages are published. From 6f0c4fcb4265e3fb38a9a7bbad5b8893714798cb Mon Sep 17 00:00:00 2001 From: "Patrick Nelson (VS)" Date: Wed, 22 Jul 2026 10:30:36 -0700 Subject: [PATCH 2/3] Fix pipeline variables --- build/yaml/pipelines/release.yaml | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/build/yaml/pipelines/release.yaml b/build/yaml/pipelines/release.yaml index 09c04f08..1599ad59 100644 --- a/build/yaml/pipelines/release.yaml +++ b/build/yaml/pipelines/release.yaml @@ -23,6 +23,16 @@ name: $(date:yyyyMMdd)$(rev:rr) trigger: none pr: none +parameters: +- name: dryRun + displayName: 'Dry run: run everything but skip the NuGet publish (nothing is published)' + type: boolean + default: false +- name: promoteToRelease + displayName: 'Promote the published packages to the Release view' + type: boolean + default: false + variables: TeamName: VS Production Diagnostics @@ -37,13 +47,17 @@ variables: # ---- Contacts ---- TeamContact: clrieowners@microsoft.com - # Set to 'True' (e.g. at queue time) to promote the published packages to the Release view. - PromoteToRelease: 'False' + # Queue-time toggles. YAML variables alone are NOT settable at queue time, so these map the + # runtime parameters (declared above, shown in the "Run pipeline" dialog) onto the variable + # names the stage conditions already use. A boolean parameter expands to 'True'/'False'. + # + # Promote the published packages to the Release view. + PromoteToRelease: ${{ parameters.promoteToRelease }} - # Set to 'True' (e.g. at queue time) for a dry run: the full pipeline runs (artifact - # download, approval gate, and -- if enabled -- the promote logic), but the NuGet push - # (output: nuget) is skipped so nothing is actually published to the feed. - DryRun: 'False' + # Dry run: the full pipeline runs (artifact download, approval gate, and -- if enabled -- + # the promote logic), but the NuGet push (output: nuget) is skipped so nothing is + # actually published to the feed. + DryRun: ${{ parameters.dryRun }} resources: repositories: From 544baa9970b173ffa138064a67e5cde026dbc710 Mon Sep 17 00:00:00 2001 From: "Patrick Nelson (VS)" Date: Wed, 22 Jul 2026 14:19:43 -0700 Subject: [PATCH 3/3] Skip promotion when DryRun is set --- build/yaml/stages/release.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/build/yaml/stages/release.yaml b/build/yaml/stages/release.yaml index 78ba8449..8e70d14e 100644 --- a/build/yaml/stages/release.yaml +++ b/build/yaml/stages/release.yaml @@ -95,7 +95,7 @@ stages: - deployment: Promote displayName: Promote package to Release View dependsOn: Publish - condition: eq(variables['PromoteToRelease'], 'True') + condition: and(eq(variables['PromoteToRelease'], 'True'), ne(variables['DryRun'], 'True')) environment: CLRIE-Release-Promote-Internal-NuGet-Feed pool: name: VSEngSS-Microbuild2022-1ES @@ -128,10 +128,10 @@ stages: steps: # Classic equivalent: "Promote package to Release View" (deprecated marketplace task, # gated on PromoteToRelease). Implemented here against the Azure Artifacts packaging - # REST API; only runs when PromoteToRelease is set to 'True'. + # REST API; only runs when PromoteToRelease is 'True' and this is not a dry run. - task: PowerShell@2 displayName: Promote package to Release View - condition: and(succeeded(), eq(variables['PromoteToRelease'], 'True')) + condition: and(succeeded(), eq(variables['PromoteToRelease'], 'True'), ne(variables['DryRun'], 'True')) env: SYSTEM_ACCESSTOKEN: $(System.AccessToken) inputs: