Migrate from Azure Pipelines to GitHub Actions

[BenjaminMichaelis]

Summary

Replaces all 5 Azure Pipelines YAML files with GitHub Actions workflows.

Non-CI fixes included

• JupyterKernel: creates the ToTask-derived task before awaiting SendAsync to avoid missing hot-observable completion.
• test-retry-runner.ps1: adds timestamped retry logging so CI retry attempts are easier to correlate in logs.

New files

• .github/workflows/ci.yml — push/PR CI on Windows (windows-2022) and Linux (ubuntu-22.04)
• .github/workflows/publish.yml — tag-triggered publish (NuGet, NPM, VS Code Marketplace); workflow_dispatch simulate mode
• .github/actions/build-and-test/action.yml — composite action (build + test, reused by both CI and publish)
• .github/dependabot.yml — weekly github-actions dependency updates

What's dropped (no replacement needed)

• MicroBuild code signing (Microsoft-internal)
• 1ES SDL compliance tooling (BinSkim, PoliCheck, APIScan)
• TSA bug filing, SBOM, OneLocBuild, symbol server publishing
• NPM publish to Azure Artifacts → replaced by npmjs.org

Publish authentication

• VS Code Marketplace: OIDC / managed identity (azure/login@v3 + DefaultAzureCredential)
• NuGet: NUGET_API_KEY secret
• NPM: NPM_TOKEN secret

Required repo setup (before enabling publish)

1. Create production GitHub Environment → add Required Reviewers
2. Add secrets: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, NUGET_API_KEY, NPM_TOKEN
3. OIDC federated credential on Azure app registration: repo:BenjaminMichaelis/interactive:environment:production

AZP files not yet deleted

Shadow-CI phase: run GHA alongside AZP until validated, then delete:

• azure-pipelines.yml
• azure-pipelines-official.yml
• azure-publish-stable-polyglot-notebooks.yml
• azure-publish-insiders-polyglot-notebooks.yml
• apiscan-compliance.yml / es-metadata.yml

Review history

4 rounds of GPT-5.5 × Opus 4.6 cross-review; all critical findings applied.

[Copilot]

Pull request overview

Migrates the repository from Azure Pipelines to GitHub Actions: introduces CI and Publish workflows plus a shared composite build/test action, sets up weekly Dependabot updates for GitHub Actions, and adjusts the existing publish PowerShell helpers to be tolerant of test-signed builds and idempotent NuGet pushes. Microsoft-internal/1ES tooling (signing, SDL, TSA, OneLocBuild, etc.) is intentionally dropped. The legacy AZP YAMLs are kept temporarily for shadow-CI validation.

Changes:

• Add .github/workflows/ci.yml, .github/workflows/publish.yml, composite build-and-test/action.yml, and dependabot.yml.
• Switch VS Code Marketplace publish auth to OIDC/azure/login; switch NPM to npmjs.org; NuGet via NUGET_API_KEY.
• Soften vsce verify-signature to a warning and add --skip-duplicate to dotnet nuget push in PublishPolyglotNotebooksHelper.psm1.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
.github/workflows/ci.yml	New push/PR CI on Windows + Linux delegating to the composite action.
.github/workflows/publish.yml	Tag/dispatch-triggered publish pipeline for NuGet, NPM, and VS Code Marketplace with OIDC auth.
.github/actions/build-and-test/action.yml	Shared composite build/test action used by CI and Publish, with platform-specific steps and caching.
.github/dependabot.yml	Weekly grouped Dependabot updates for GitHub Actions.
eng/publish/PublishPolyglotNotebooksHelper.psm1	Adds missing-file guard, downgrades signature verification to a warning, and uses --skip-duplicate for NuGet push.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 9 comments.

Files not reviewed (1)

• src/polyglot-notebooks-ui-components/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

.github/actions/build-and-test/action.yml:170

• The diagnostics test step uses --no-build and runs only when the preceding regular test run failed. If the failure was a build/compile error (vs. a test hang), the build outputs needed by --no-build will not be present and this step will fail with a confusing "could not find assembly" error rather than helping diagnose the hang. Consider guarding this with a check that the test assembly exists, or dropping --no-build so it falls back to building on demand.

    - name: Report test results (Linux)
      if: ${{ inputs.platform == 'linux' && !cancelled() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
      uses: dorny/test-reporter@v3
      with:
        name: Linux Tests
        path: artifacts/TestResults/${{ inputs.build-config }}/**/*.trx
        reporter: dotnet-trx
        fail-on-error: false

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 8 comments.

Files not reviewed (1)

• src/polyglot-notebooks-ui-components/package-lock.json: Language not supported

Comments suppressed due to low confidence (2)

.github/workflows/publish.yml:312

• The polling loop always sleeps 10 seconds before its first probe, which means publish-vscode is delayed by ≥10s even when nuget.org has already indexed the package. More importantly, after a failed Invoke-RestMethod (e.g., transient 5xx), the catch branch logs the error but does not break — that's fine on its own, but the do { ... } while ([DateTimeOffset]::UtcNow -lt $timeout) only re-evaluates the time check after the body completes, so if many consecutive failures occur the loop will continue until timeout without ever succeeding. Consider probing once before sleeping (so the happy path returns immediately) and treating prolonged HTTP failures as a hard error rather than spinning silently.

      - name: Wait for nuget.org propagation
        if: needs.prepare.outputs.simulate != 'true'
        shell: pwsh
        run: |
          $version = '${{ needs.build.outputs.version }}'
          $packageId = 'Microsoft.dotnet-interactive'
          $url = "https://api.nuget.org/v3-flatcontainer/$($packageId.ToLower())/index.json"
          $timeout = [DateTimeOffset]::UtcNow.AddMinutes(15)
          do {
            Start-Sleep -Seconds 10
            try {
              $index = (Invoke-RestMethod -Uri $url).versions
              if ($index -contains $version) {
                Write-Host "Version $version is indexed on nuget.org"
                break
              }
              Write-Host "Waiting for version $version to appear on nuget.org..."
            } catch {
              Write-Host "Failed to query nuget.org: $_"
            }
          } while ([DateTimeOffset]::UtcNow -lt $timeout)
          if ([DateTimeOffset]::UtcNow -ge $timeout) {
            Write-Error "Timed out waiting for version $version to appear on nuget.org"
            exit 1
          }

.github/workflows/publish.yml:307

• In try { $index = (Invoke-RestMethod -Uri $url).versions; ... } catch { ... }, when the request returns a 404 (which the v3 flat-container endpoint returns for a not-yet-indexed package id), Invoke-RestMethod throws and the catch swallows the error as "Failed to query nuget.org". That's fine for the very first push of a new package id but means transient network errors and "version not yet indexed" are indistinguishable in the logs. Consider differentiating 404s (expected during indexing) from other failures so operators can diagnose stuck publishes.

            try {
              $index = (Invoke-RestMethod -Uri $url).versions
              if ($index -contains $version) {
                Write-Host "Version $version is indexed on nuget.org"
                break
              }
              Write-Host "Waiting for version $version to appear on nuget.org..."
            } catch {
              Write-Host "Failed to query nuget.org: $_"
            }

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

• src/polyglot-notebooks-ui-components/package-lock.json: Language not supported

[Copilot]

Pull request overview

Copilot reviewed 11 out of 16 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

• src/polyglot-notebooks/package-lock.json: Language not supported