Skip to content

ci: publish beta NuGet packages through ESRP - #1166

Open
Gavin Barron (gavinbarron) wants to merge 1 commit into
mainfrom
gavinbarron-graph-beta-esrp-publishing
Open

Gavin Barron (gavinbarron) wants to merge 1 commit into
mainfrom
gavinbarron-graph-beta-esrp-publishing

Conversation

@gavinbarron

@gavinbarron Gavin Barron (gavinbarron) commented Oct 14, 2026 •

Copy link
Copy Markdown
Member

Summary

Apply the ESRP NuGet publishing pattern from microsoftgraph/msgraph-sdk-dotnet#3189 to the beta SDK's sole package-publishing pipeline, pipelines/ci-build.yml.

  • Set NuGetOrganizationName to microsoftgraph and remove the unused NuGet tool installer.
  • Replace 1ES.PublishNuget@1 with package-only staging followed by EsrpRelease@14. Stage top-level Microsoft.Graph.Beta.*.nupkg and Microsoft.Graph.Beta.*.snupkg into a dedicated organization folder, excluding release scripts and unrelated files.
  • Reuse this repository's existing ESRP connection, client/tenant identity, vault, and certificate values; match the reference distribution configuration and wait for release completion.
  • Preserve build/signing steps, artifact handoff, deployment conditions, the nuget-org approval environment, version/commit scripts, and the separate Release Please GitHub release workflow.
  • Document the publishing flow in CONTRIBUTING.md.

Verified NuGet ownership

Published package ESRP organization NuGet.org evidence
Microsoft.Graph.Beta, including its symbol package microsoftgraph Package Owners, microsoftgraph owner profile

The package's NuGet.org Owners section was checked directly and lists both Microsoft and microsoftgraph. The microsoftgraph profile also lists this package. The verified microsoftgraph co-owner matches the reference migration; ownership was not inferred from GitHub organization, package prefix, or author metadata. This repository publishes one package identity, so it needs one ESRP submission. Microsoft.Graph.Core is a dependency, not an output published by this repository.

Verification

  • Parsed the actual changed YAML with the installed powershell-yaml module and asserted the release task order and all 18 ESRP inputs against the reference.
  • Compared the parsed pipeline with current origin/main after removing only the intended publishing changes; all remaining configuration is unchanged.
  • Exercised package staging using the edited YAML settings and six package/symbol fixtures across stable, preview, and build-suffixed versions. Files retained their hashes; unrelated files, scripts, and nested packages were excluded.
  • git diff --check passed. The branch is one migration commit ahead of the fetched default branch, with only the pipeline and related documentation changed.

These are offline configuration/staging checks, not a live ESRP run or an SDK compilation. EsrpRelease@14 availability, distribution authorization for the existing service connection, and ESRP/NuGet publishing authorization for microsoftgraph remain external deployment prerequisites and were not verified. No publishing pipeline was queued and no packages were published.

Microsoft Reviewers: Open in CodeFlow

Stage beta packages and symbols in a dedicated microsoftgraph submission folder while retaining the existing signing and deployment environment.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 0ad787ca-fbaf-4c2b-a7e7-94d8e0431fa0
@gavinbarron
Gavin Barron (gavinbarron) requested a review from a team as a code owner October 14, 2026 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant