Skip to content

Commit e686e8c

Browse files
gavinbarrongavinbarron
committed
fix(release): publish only the component selected by its tag
Restrict main OData releases to v3 tags and dedicated Hidi releases to hidi-v3 tags. Validate tag/project versions before staging, use supported OData-only pack inputs with no rebuild, and select exact tag-version packages and assets. Preserve branch validation, Hidi publishing flags, signing and protected environments. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5aef9099-c268-492f-a58a-b591c916f1bc
1 parent 6c34176 commit e686e8c

3 files changed

Lines changed: 79 additions & 27 deletions

File tree

‎.azure-pipelines/ci-build.yml‎

Lines changed: 47 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ trigger:
1111
- support/v2
1212
tags:
1313
include:
14-
- 'v*'
14+
- 'v3.*'
1515
pr:
1616
branches:
1717
include:
@@ -56,6 +56,18 @@ extends:
5656
targetPath: '$(Build.ArtifactStagingDirectory)'
5757
steps:
5858

59+
- pwsh: |
60+
$ErrorActionPreference = 'Stop'
61+
$version = ([xml](Get-Content Directory.Build.props)).Project.PropertyGroup.Version
62+
if ($env:BUILD_SOURCEBRANCH -like 'refs/tags/*') {
63+
if ($env:BUILD_SOURCEBRANCH -cnotmatch '^refs/tags/v(3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)$') {
64+
throw "Expected an OData v3.x release tag, got $env:BUILD_SOURCEBRANCH."
65+
}
66+
if ($Matches[1] -cne $version) { throw "OData tag must exactly match Directory.Build.props version $version." }
67+
}
68+
Write-Host "##vso[task.setvariable variable=ODataVersion]$version"
69+
displayName: 'Validate OData component tag and project version'
70+
5971
- task: UseDotNet@2
6072
displayName: 'Use .NET 6' # needed for ESRP signing
6173
inputs:
@@ -173,8 +185,13 @@ extends:
173185
displayName: 'pack'
174186
inputs:
175187
command: pack
176-
projects: src/Microsoft.OpenApi.OData.Reader/Microsoft.OpenAPI.OData.Reader.csproj
177-
arguments: '-o $(Build.ArtifactStagingDirectory) --configuration $(BuildConfiguration) --no-build --include-symbols --include-source /p:SymbolPackageFormat=snupkg'
188+
packagesToPack: src/Microsoft.OpenApi.OData.Reader/Microsoft.OpenAPI.OData.Reader.csproj
189+
configuration: '$(BuildConfiguration)'
190+
packDirectory: '$(Build.ArtifactStagingDirectory)'
191+
nobuild: true
192+
includesymbols: true
193+
includesource: true
194+
buildProperties: 'SymbolPackageFormat=snupkg'
178195

179196
- task: EsrpCodeSigning@6
180197
displayName: 'ESRP CodeSigning Nuget Packages'
@@ -186,7 +203,7 @@ extends:
186203
AuthAKVName: 'akv-prod-eastus'
187204
AuthCertName: 'ReferenceLibraryPrivateCert'
188205
AuthSignCertName: 'ReferencePackagePublisherCertificate'
189-
Pattern: '*.nupkg'
206+
Pattern: 'Microsoft.OpenApi.OData.$(ODataVersion).nupkg'
190207
signConfigType: inlineSignParams
191208
inlineOperation: |
192209
[
@@ -211,7 +228,7 @@ extends:
211228
PendingAnalysisWaitTimeoutMinutes: '5'
212229

213230
- stage: deploy
214-
condition: and(contains(variables['build.sourceBranch'], 'refs/tags/v'), succeeded())
231+
condition: and(succeeded(), startsWith(variables['Build.SourceBranch'], 'refs/tags/v3.'))
215232
dependsOn: build
216233
jobs:
217234
- deployment: deploy
@@ -229,10 +246,20 @@ extends:
229246
pool:
230247
vmImage: ubuntu-latest
231248
steps:
249+
- pwsh: |
250+
$ErrorActionPreference = 'Stop'
251+
if ($env:BUILD_SOURCEBRANCH -cnotmatch '^refs/tags/v(3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)$') {
252+
throw "Expected an OData v3.x release tag, got $env:BUILD_SOURCEBRANCH."
253+
}
254+
$version = $Matches[1]
255+
$packages = @(Get-ChildItem -LiteralPath '$(Pipeline.Workspace)' -Recurse -File -Filter "Microsoft.OpenApi.OData.$version.nupkg")
256+
if ($packages.Count -ne 1) { throw "Expected exactly one OData package matching tag version $version." }
257+
Write-Host "##vso[task.setvariable variable=ODataPackagePath]$($packages[0].FullName)"
258+
displayName: 'Verify exact OData release package'
232259
- task: 1ES.PublishNuget@1
233260
displayName: 'NuGet push'
234261
inputs:
235-
packagesToPush: '$(Pipeline.Workspace)/Microsoft.OpenApi.OData.*.nupkg'
262+
packagesToPush: '$(ODataPackagePath)'
236263
nuGetFeedType: external
237264
publishFeedCredentials: 'OpenAPI Nuget Connection'
238265
packageParentPath: '$(Pipeline.Workspace)'
@@ -254,21 +281,25 @@ extends:
254281
vmImage: ubuntu-latest
255282
steps:
256283
- pwsh: |
257-
$artifactName = Get-ChildItem -Path $(Pipeline.Workspace) -Filter Microsoft.OpenApi.OData.*.nupkg -recurse | select -First 1
258-
$artifactVersion= $artifactName.Name -replace "Microsoft.OpenApi.OData.", "" -replace ".nupkg", ""
259-
#Set Variable $artifactName and $artifactVersion
260-
Write-Host "##vso[task.setvariable variable=artifactVersion; isSecret=false;]$artifactVersion"
261-
echo "$artifactVersion"
262-
displayName: 'Fetch Artifact Name'
284+
$ErrorActionPreference = 'Stop'
285+
if ($env:BUILD_SOURCEBRANCH -cnotmatch '^refs/tags/v(3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)$') {
286+
throw "Expected an OData v3.x release tag, got $env:BUILD_SOURCEBRANCH."
287+
}
288+
$version = $Matches[1]
289+
$packages = @(Get-ChildItem -LiteralPath '$(Pipeline.Workspace)' -Recurse -File -Filter "Microsoft.OpenApi.OData.$version.nupkg")
290+
if ($packages.Count -ne 1) { throw "Expected exactly one OData package matching tag version $version." }
291+
Write-Host "##vso[task.setvariable variable=ODataReleaseVersion]$version"
292+
Write-Host "##vso[task.setvariable variable=ODataPackagePath]$($packages[0].FullName)"
293+
displayName: 'Verify OData tag and exact GitHub release asset'
263294
- task: GitHubRelease@1
264295
displayName: 'GitHub release'
265-
condition: succeededOrFailed()
296+
condition: succeeded()
266297
inputs:
267298
gitHubConnection: 'Github-MaggieKimani1'
268299
action: edit
269300
tagSource: userSpecifiedTag
270-
tag: 'v$(artifactVersion)'
271-
title: 'v$(artifactVersion)'
301+
tag: 'v$(ODataReleaseVersion)'
302+
title: 'v$(ODataReleaseVersion)'
272303
releaseNotesSource: inline
273-
assets: '$(Pipeline.Workspace)\**\Microsoft.OpenApi.OData.*.nupkg'
304+
assets: '$(ODataPackagePath)'
274305
addChangeLog: false

‎.azure-pipelines/hidi-release.yml‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,15 @@ extends:
5050
artifactName: HidiDockerContext
5151
targetPath: '$(Build.ArtifactStagingDirectory)\hidi-docker-context'
5252
steps:
53+
- pwsh: |
54+
$ErrorActionPreference = 'Stop'
55+
$version = ([xml](Get-Content src\Microsoft.OpenApi.Hidi\Microsoft.OpenApi.Hidi.csproj)).Project.PropertyGroup.Version
56+
if ($version -cnotmatch '^3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$') { throw "Expected a hidi 3.x version, got $version." }
57+
if ($env:BUILD_SOURCEBRANCH -like 'refs/tags/*' -and $env:BUILD_SOURCEBRANCH -cne "refs/tags/hidi-v$version") {
58+
throw "Hidi tag must exactly match the hidi project version."
59+
}
60+
Write-Host "##vso[task.setvariable variable=HidiVersion]$version"
61+
displayName: Validate Hidi component tag and project version
5362
- task: UseDotNet@2
5463
displayName: Use .NET 6 for ESRP
5564
inputs:
@@ -123,12 +132,7 @@ extends:
123132
}
124133
displayName: Stage public-only hidi Docker context
125134
- pwsh: |
126-
$version = ([xml](Get-Content src\Microsoft.OpenApi.Hidi\Microsoft.OpenApi.Hidi.csproj)).Project.PropertyGroup.Version
127-
if ($version -notmatch '^3\.\d+\.\d+(-[0-9A-Za-z.-]+)?$') { throw "Expected a hidi 3.x version, got $version." }
128-
if ('$(Build.SourceBranch)' -like 'refs/tags/*' -and '$(Build.SourceBranch)' -ne "refs/tags/hidi-v$version") {
129-
throw "Hidi tag must exactly match the hidi project version."
130-
}
131-
Write-Host "##vso[task.setvariable variable=HidiVersion]$version"
135+
$ErrorActionPreference = 'Stop'
132136
dotnet build src\Microsoft.OpenApi.Hidi\Microsoft.OpenApi.Hidi.csproj -c $(buildConfiguration) -p:GeneratePackageOnBuild=false
133137
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
134138
dotnet run --project test\Microsoft.OpenApi.Hidi.Tests\Microsoft.OpenApi.Hidi.Tests.csproj -c $(buildConfiguration) -- --minimum-expected-tests 1
@@ -246,12 +250,19 @@ extends:
246250
deploy:
247251
steps:
248252
- pwsh: |
249-
$tag = '$(Build.SourceBranch)' -replace '^refs/tags/hidi-v', ''
253+
$ErrorActionPreference = 'Stop'
254+
if ($env:BUILD_SOURCEBRANCH -cnotmatch '^refs/tags/hidi-v(3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)$') {
255+
throw "Expected a hidi-v3.x release tag, got $env:BUILD_SOURCEBRANCH."
256+
}
257+
$tag = $Matches[1]
250258
if ([version]($tag -split '-')[0] -le [version]'3.10.2') { throw "Never republish the source migration baseline or an older hidi version." }
251259
$package = "$(Pipeline.Workspace)\hidi\Microsoft.OpenApi.Hidi.$tag.nupkg"
252-
if (-not (Test-Path $package)) { throw "Missing exact hidi package: $package" }
260+
if (-not (Test-Path -LiteralPath $package -PathType Leaf)) { throw "Missing exact hidi package: $package" }
253261
$symbols = "$(Pipeline.Workspace)\hidi\Microsoft.OpenApi.Hidi.$tag.snupkg"
254-
if (-not (Test-Path $symbols)) { throw "Missing exact hidi symbols: $symbols" }
262+
if (-not (Test-Path -LiteralPath $symbols -PathType Leaf)) { throw "Missing exact hidi symbols: $symbols" }
263+
foreach ($asset in @("$(Pipeline.Workspace)\hidi\Microsoft.OpenApi.Hidi.exe", "$(Pipeline.Workspace)\hidi\hidi-win-x64-$tag.zip")) {
264+
if (-not (Test-Path -LiteralPath $asset -PathType Leaf)) { throw "Missing exact hidi release asset: $asset" }
265+
}
255266
Write-Host "##vso[task.setvariable variable=HidiReleaseVersion]$tag"
256267
displayName: Verify new hidi release version and exact package
257268
- task: PowerShell@2
@@ -323,8 +334,10 @@ extends:
323334
vmImage: ubuntu-latest
324335
steps:
325336
- pwsh: |
337+
$ErrorActionPreference = 'Stop'
326338
$version = ([xml](Get-Content src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj)).Project.PropertyGroup.Version
327-
if ('$(Build.SourceBranch)' -ne "refs/tags/hidi-v$version") { throw "Hidi tag does not match project version." }
339+
if ($version -cnotmatch '^3\.\d+\.\d+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$') { throw "Expected a hidi 3.x version, got $version." }
340+
if ($env:BUILD_SOURCEBRANCH -cne "refs/tags/hidi-v$version") { throw "Hidi tag does not match project version." }
328341
if ([version]($version -split '-')[0] -le [version]'3.10.2') { throw "Do not republish the migration baseline or an older hidi version." }
329342
Write-Host "##vso[task.setvariable variable=HidiReleaseVersion]$version"
330343
displayName: Read independent hidi version

‎CONTRIBUTING.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,4 +67,12 @@ source package are excluded from OData releases and do not independently trigger
6767
a Hidi release. Root distribution/helper files remain outside the Hidi component;
6868
they follow the root package's standard routing, not custom Hidi routing.
6969
Existing root OData exclusions remain configured. The official Hidi
70-
package/container publishing gates remain disabled during migration.
70+
package/container publishing gates remain disabled during migration.
71+
72+
The ADO OData pipeline accepts `v3.*` tags and deploys only the exact OData
73+
package matching that tag and `Directory.Build.props`. The dedicated Hidi
74+
pipeline accepts `hidi-v3.*` tags; its package, symbols, executable, ZIP and
75+
container version must match the Hidi tag/project version. Malformed,
76+
other-component or mismatched tags fail validation rather than publishing a
77+
different component. With publishing disabled, branch/PR builds remain validation-only; the existing
78+
Hidi publishing flags, migration floor and protected environments are unchanged.

0 commit comments

Comments
 (0)