ci: make release publish jobs idempotent on re-run

[jingjingjia-ms]

Why

Re-triggering the release pipeline for a tag that was already (partially) published previously failed hard, making it impossible to recover from a partial release without manual surgery:

• GitHubRelease@1 returns 422 when the tag/release already exists
• 1ES.PublishNuget@1 returns 409 on a duplicate NuGet version
• EsrpRelease@12 (npm) and vsce publish fail on an already-published version

This blocked recovery scenarios such as a run where every stage succeeded except the npm ESRP publish — a plain "Rerun failed jobs" still re-hit the 422/409 walls on the other publish steps.

What

Each publish job now checks whether its artifact version is already published and skips that publish step if so, otherwise publishes exactly as before:

Job	Idempotency check	Skip when already published
github_release	anonymous GitHub API lookup of the release by tag → releaseExists	both GitHubRelease@1 tasks gated ne(releaseExists,'true')
deploy_kiota / deploy_builder	query nuget.org flat container for the version parsed from the .nupkg filename → nugetAlreadyPublished	1ES.PublishNuget@1 gated on it
deploy_npm	add UseNode@1; npm view @microsoft/kiota@<version> (version from microsoft-kiota-<version>.tgz) → npmAlreadyPublished	EsrpRelease@12 gated on it
vs_marketplace	capture vsce publish output; non-zero exit whose output contains already exists	treated as an idempotent skip

PushDockerImage is already idempotent (tag overwrite) and is unchanged.

Notes

• The registry lookups are anonymous/read-only against the public NuGet, npm, and GitHub APIs (microsoft/kiota is a public repo), so no additional credentials/service connections are required.
• The VS Marketplace uses build-derived version numbers (decoupled from the release tag), so vs_marketplace relies on vsce's own duplicate detection rather than a tag-version compare: a re-run of the same build republishes an identical vsix version (skipped), while a new build produces a new version (published).

Validation

• Pipeline YAML parses cleanly (yaml.safe_load).
• Verified the checks against the live registries for v1.32.5: NuGet Microsoft.OpenApi.Kiota / .Builder both already at 1.32.5 → would skip; npm @microsoft/kiota is only at 1.32.4 (1.32.5 returns 404) → would publish. This matches the real partial-release state.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall coverage in the ci/idempotent-releas... branch is 72%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	ci/idempotent-releas... 3aa5dd7	+/-
/home/runner/wo...guageRefiner.cs	—	98%	—
/home/runner/wo...criptRefiner.cs	—	98%	—
/home/runner/wo...MethodWriter.cs	—	97%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	96%	—
/home/runner/wo...MethodWriter.cs	—	95%	—
/home/runner/wo...rs/GoRefiner.cs	—	93%	—
/home/runner/wo...KiotaBuilder.cs	—	90%	—
/home/runner/wo...ationService.cs	—	89%	—
/home/runner/wo...xGenerator.g.cs	—	75%	—

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}