Use ' - ' separator in release-version build tag#17236
Merged
Merged
Conversation
The deriveReleaseVersion step in release-publish-nuget.yml emitted `##vso[build.addbuildtag]release-version:` to surface the resolved version on the release run. The Azure Pipelines agent processes this logging command by calling AzDO REST `PUT /_apis/build/builds/{buildId}/tags/{tag}`; the `:` in `release-version:13.3.4` ends up in the URL path and the 1ES PT request-validation handler rejects it with:
A potentially dangerous Request.Path value was detected from the client (:).
This fails the entire step and skips the rest of the job. Confirmed in https://dev.azure.com/dnceng/internal/_build/results?buildId=2978372 (log id 53).
The tag was purely informational. The functional output (`releaseVersionEffective` task variable) is still set and is what downstream stages consume. The parser that reads `release-version:` tags from the *source* build is untouched -- that tag is added by `azure-pipelines.yml` in a different agent context where the request validator is more permissive.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17236Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17236" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a release pipeline failure in release-publish-nuget by removing an informational build.addbuildtag emission that includes a : character, which can be rejected by AzDO/1ES request-path validation when converted into a REST URL path segment.
Changes:
- Removed
##vso[build.addbuildtag]release-version:$effectivefrom thederiveReleaseVersionstep to preventRequest.Pathvalidation failures. - Kept the functional output (
releaseVersionEffectivetask output variable) intact for downstream consumption.
Show a summary per file
| File | Description |
|---|---|
| eng/pipelines/release-publish-nuget.yml | Removes the build.addbuildtag call that can fail due to : in the tag value, while preserving the output variable used by later steps/stages. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 0
AzDO's 1ES PT request-validation handler rejects ':' in tag names because the agent calls `PUT /_apis/build/builds/{buildId}/tags/{tag}` and ':' ends up in the URL path. This breaks both the source build (azure-pipelines.yml) and the release-publish pipeline (release-publish-nuget.yml). Failed runs:
- source build: https://dev.azure.com/dnceng/internal/_build/results?buildId=2978468
- release-publish: https://dev.azure.com/dnceng/internal/_build/results?buildId=2978372
Switch the tag format from `release-version:13.3.4` to `release-version - 13.3.4`, mirroring the existing `BAR ID - <id>` tag style which is known to pass the validator. Update the release-publish parser (regex, messages) and docs/release-process.md accordingly.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
joperezr
changed the title
davidfowl
approved these changes
May 19, 2026
Contributor
|
✅ No documentation update needed. docs_optional → No signals triggered ( All 3 changed files are in
This is a CI/pipeline-only change fixing AzDO build tag format from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
AzDO's 1ES PT request-validation handler rejects
:in build tag names because the agent's##vso[build.addbuildtag]implementation callsPUT /_apis/build/builds/{buildId}/tags/{tag}, and the:ends up in the URL path:This breaks both pipelines that emit the tag:
azure-pipelines.yml): https://dev.azure.com/dnceng/internal/_build/results?buildId=2978468release-publish-nuget.yml): https://dev.azure.com/dnceng/internal/_build/results?buildId=2978372Fix
Switch the tag format from
release-version:13.3.4torelease-version - 13.3.4, mirroring the existingBAR ID - <id>tag style that AzDO already emits without issue:Changes:
eng/pipelines/azure-pipelines.yml— emitrelease-version - $versioninstead ofrelease-version:$version.eng/pipelines/release-publish-nuget.yml— update the regex parser, error/warning messages, and surrounding comments to match the new format. The redundant cosmetic addbuildtag on the release run stays removed (no functional impact).docs/release-process.md— update the two references to the tag format.Safety
main(or any release branch that picks up this change) will emit the new format, and the release-publish pipeline run from that same commit will read it correctly.-ReleaseVersion <X.Y.Z>explicitly — the documented override path is unchanged.