Courtesy Push Pipeline Improvement - Part#2 | Merge Publish and Courtesy Push Jobs (#21467)

* Merge Publish Steps

* Update Conditions

* Remove Copy pkg

* Update#1 Review comments

* Optimize multiple output scanning

* Baseline pnpm fastlist executables for Guardian BinSkim BA2008

* Add fastlist file hash to the baseline

* AB#2329703 Added Work-Item

* Udpate#1 Review Comments

Author: dassayantan24

.azure-pipelines/.vsts.release.yml

@@ -36,10 +36,6 @@ parameters:
   displayName: skipPublish (Not for production use)
   type: boolean
   default: false
-- name: publishToDistributedTaskTest
-  displayName: Publish to test feed (DistributedTasks-test), for infrastucture testing
-  type: boolean
-  default: false  
 - name: dryRun
   displayName: Dry Run (no push, no PR, no feed publish)
   type: boolean
@@ -144,63 +140,44 @@ extends:
             os: Windows_NT
             useSemverBuildConfig: ${{ parameters.useSemverBuildConfig }}
 
-      # Publish
-      - job: publish
-        displayName: Publish Nuget Artifacts
-        timeoutInMinutes: 360
-        dependsOn:
-        - build_all_windows
-        condition: and(succeeded(), ne(variables['build.reason'], 'PullRequest'), eq(variables['tasksSkipPublish'], 'false'))
-        pool:
-          name: 1ES-ABTT-Shared-Pool
-          image: abtt-windows-2022
-          os: windows
-        templateContext:
-          outputs:
-          - output: buildArtifacts
-            displayName: 'Publish per task NuGet package artifact'
-            PathtoPublish: _package/nuget-packages
-            ArtifactName: IndividualNuGetPackages
-        steps:
-        - template: /ci/publish-steps.yml@self
-        
       # Courtesy Push
       - job: courtesy_push
         displayName: Courtesy Push
-        timeoutInMinutes: 180
+        timeoutInMinutes: 540
         pool:
           name: 1ES-ABTT-Shared-Pool
           image: abtt-windows-2022
           os: windows
         dependsOn:
-        - publish
+        - build_all_windows
         condition: |
           and(
             succeeded(),
             eq(variables['COURTESY_PUSH'], 'true'),
-            or(
-              eq(variables['build.reason'], 'Schedule'),
-              and(
-                eq(variables['build.reason'], 'Manual'),
-                eq(variables['FORCE_COURTESY_PUSH'], 'true')
-              )
-            )
+            eq(variables['build.reason'], 'Manual'),
+            eq(variables['FORCE_COURTESY_PUSH'], 'true')
           )
         templateContext:
+          outputParentDirectory: $(Build.SourcesDirectory)/_package
           outputs:
+          - output: buildArtifacts
+            displayName: 'Publish per task NuGet package artifact'
+            PathtoPublish: $(Build.SourcesDirectory)/_package/nuget-packages
+            ArtifactName: IndividualNuGetPackages
+            condition: succeeded()
           - output: nuget
-            packagesToPush:  '$(Build.SourcesDirectory)/IndividualNugetPackagesDownloaded/IndividualNugetPackages/*/*.nupkg'
+            packagesToPush: '$(Build.SourcesDirectory)/_package/nuget-packages/*/*.nupkg'
             packageParentPath: '$(Build.SourcesDirectory)'
-            ${{ if or(eq(parameters.dryRun, true),eq(parameters.publishToDistributedTaskTest, true)) }}:
+            condition: and(succeeded(), eq(variables['tasksSkipPublish'], 'false'))
+            ${{ if eq(parameters.dryRun, true) }}:
               publishVstsFeed: 'c86767d8-af79-4303-a7e6-21da0ba435e2/9d34d871-8032-4e10-a34a-c7a01e125865'
             ${{ else }}:
               publishVstsFeed: 'c86767d8-af79-4303-a7e6-21da0ba435e2/e10d0795-57cd-4d7f-904e-5f39703cb096'
             nuGetFeedType: internal
             displayName: Push Nuget package
             allowPackageConflicts: $(COURTESY_PUSH)
         steps:
-        - checkout: self
-        - template: /ci/courtesy-push.yml@self
+        - template: /ci/courtesy-push-steps.yml@self
 
       # GitHub Release
       - job: github_release
@@ -218,7 +195,8 @@ extends:
         condition: |
           and(
             succeeded(),
-            in(variables['build.reason'], 'Schedule', 'Manual')
+            eq(variables['build.reason'], 'Manual'),
+            eq(variables['tasksSkipPublish'], 'false')
           )
         templateContext:
           outputs: []

.gdn/.gdnbaselines

@@ -2308,6 +2308,28 @@
       ],
       "justification": "Unit tests data",
       "createdDate": "2024-06-05 17:14:35Z"
+    },
+    "c5ba7d2f0fe15f40bc259ccd65fe5cab41cdd12a05d1c5fc87a1cfecaef239bb": {
+      "signature": "c5ba7d2f0fe15f40bc259ccd65fe5cab41cdd12a05d1c5fc87a1cfecaef239bb",
+      "alternativeSignatures": [
+        "c74f8a2003f1e4d2f51cf6f4a06f20c9479c6a8dd46fadbe33799a38b7e7dab3"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "BinSkim BA2008: Third-party pnpm fastlist executables (fastlist-0.3.0-x86.exe) lacks Control Flow Guard - not under our control",
+      "createdDate": "2025-11-24 00:00:00Z"
+    },
+    "f51b66848d5cc1ac54c0b6250853060ea4cf93461f113f4cdd0ab4bade214c89": {
+      "signature": "f51b66848d5cc1ac54c0b6250853060ea4cf93461f113f4cdd0ab4bade214c89",
+      "alternativeSignatures": [
+        "8ba7397e8a319de274c5245a25fbc405a6da27c7dfa5eac46dd47d7141216260"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "BinSkim BA2008: Third-party pnpm fastlist executables (fastlist-0.3.0-x64.exe) lacks Control Flow Guard - not under our control",
+      "createdDate": "2025-11-24 00:00:00Z"
     }
   }
 }

ci/publish-steps.yml ci/courtesy-push-steps.ymlci/publish-steps.yml renamed to ci/courtesy-push-steps.yml

@@ -52,3 +52,29 @@ steps:
 - powershell: |
     Write-Host "##vso[build.updatebuildnumber]$(aggregate_version)"
   displayName: Update build number
+
+- powershell: |
+    cd $(Build.SourcesDirectory)/ci/courtesy-push
+    npm ci
+  displayName: npm ci (courtesy-push)
+
+- powershell: $(Build.SourcesDirectory)/ci/set-sprint-variables.ps1
+  displayName: Set currentSprint variables
+
+- powershell: |
+    $currentDate = Get-Date -Format "yyyyMMdd-HHmm"
+    Write-Host "##vso[task.setVariable variable=currentDate]$currentDate"
+  displayName: Set currentDate variable
+
+- template: /ci/generate-branch-name.yml@self
+- template: /ci/get-AzDo-pat.yml@self
+
+- script: node $(Build.SourcesDirectory)/ci/courtesy-push/courtesy-push.js $(Build.SourcesDirectory)/_package/nuget-packages/unified_deps.xml
+  name: createCourtesyPushPR
+  displayName: Update unified deps and create branch
+  env:
+    TOKEN: $(AzDo_PAT)
+    BRANCH_NAME: $(branchName)
+    DRYRUN: $(isDryRun)
+    USERNAME: $(username)
+

ci/courtesy-push.yml

@@ -4,7 +4,7 @@ var util = require('./ci-util');
 
 // Parse command line arguments (positional)
 // Usage: node stage-milestone.js <tasksBuildArtifact>
-var tasksBuildArtifact = process.argv[2] || 'package';
+var tasksBuildArtifact = process.argv[2] || 'allTasks';
 
 // initialize _package
 util.initializePackagePath();