[v7.1.0-preview1] ESRP Nuget Signing Path Fix#4249
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes OneBranch ESRP NuGet signing to sign the packages that are actually published as build artifacts by removing the obsolete PACK_OUTPUT copy step and pointing ESRP NuGet signing at $(BUILD_OUTPUT) instead.
Changes:
- Removed the
CopyFilesstep that copied.nupkg/.snupkgfiles to the no-longer-defined$(PACK_OUTPUT). - Updated ESRP NuGet signing to search under
$(BUILD_OUTPUT)with a recursive minimatch pattern. - Updated step header comment to no longer reference copying packages to
$(PACK_OUTPUT).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| eng/pipelines/onebranch/steps/pack-buildproj-step.yml | Removes the PACK_OUTPUT copy step so pack output remains in $(BUILD_OUTPUT) for later artifact publishing/signing. |
| eng/pipelines/onebranch/jobs/build-buildproj-job.yml | Adjusts ESRP NuGet signing to scan $(BUILD_OUTPUT) and match packages recursively. |
priyankatiwari08
approved these changes
Apr 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
An artifact of the churn in pipelines lately. Packages were being copied to PACK_OUTPUT, and that's where ESRP signing was pulling from. Indeed, it found two nuget package files and it signed them. But the problem is 1) PACK_OUTPUT isn't published as the build artifacts, BUILD_OUTPUT is, and the nuget package files in that folder aren't being signed, and 2) PACK_OUTPUT isn't even defined anymore, so it's literally copying them to $(PACK_OUTPUT).
This fixes the issue by removing the step to copy to PACK_OUTPUT, and changes ESRP nuget signing to point at BUILD_OUTPUT. 🤖 has verified this should fix everything.