From c1e010bb329aee469532420606076430a50696d6 Mon Sep 17 00:00:00 2001 From: Microsoft Graph DevX Tooling Date: Wed, 11 Nov 2026 12:32:05 -0800 Subject: [PATCH] ci: upgrade ESRP Release task to v14 Use the Node 20 task handler instead of the blocked Node 16 handler, preserving existing authentication and publication inputs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .azure-pipelines/ci-build-production.yml | 2 +- CONTRIBUTING.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.azure-pipelines/ci-build-production.yml b/.azure-pipelines/ci-build-production.yml index 8a11e66dc..7b8d00202 100644 --- a/.azure-pipelines/ci-build-production.yml +++ b/.azure-pipelines/ci-build-production.yml @@ -126,7 +126,7 @@ extends: steps: - checkout: none - download: none - - task: EsrpRelease@9 + - task: EsrpRelease@14 displayName: Publish npm package via ESRP Release inputs: connectedservicename: Federated DevX ESRP Managed Identity Connection diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 867d44457..e348c8695 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -146,7 +146,7 @@ The **Build** stage tests the SDK on Windows with Node.js 22, 24, and 26, and bu To validate the migration before merging, manually queue **Graph JS SDK Build pipeline** against the PR branch. Manual runs remain build-only and never deploy to npm, including manual runs targeting a tag. An Azure DevOps administrator may need to authorize the `1ESPipelineTemplates/1ESPipelineTemplates` repository and the `Azure-Pipelines-1ESPT-ExDShared` pool for this pipeline. Confirm that the pool provides the Windows and Ubuntu images used here, including Chrome for the Windows browser tests, and that the template's SDL checks pass. Download `sdk-build` and inspect/install the tarball in a clean consumer project before releasing. -After a successful validation and merge to `main`, push a release tag in the `vX.X.X` format whose numeric version matches `package.json`, such as `v3.1.0`, on the intended release commit. The tag trigger uses Azure's `v*.*.*` wildcard filter, not a regular expression. A build-time equality check additionally requires the entire tag to equal `v` followed by the package version before packing. It does not independently validate semantic-version syntax. Unprefixed tag pushes do not trigger a release. The separate **Publish** stage runs only after the build and tests succeed, and only for CI runs triggered by a `v`-prefixed tag push. Its production deployment job consumes the same `sdk-build` tarball and submits it to `EsrpRelease@9` for npm package distribution. The 1ES release job cannot emit artifact outputs; neither packing nor building runs again during deployment. Creating or pushing a release tag is a release action; do not do so for build-only validation. +After a successful validation and merge to `main`, push a release tag in the `vX.X.X` format whose numeric version matches `package.json`, such as `v3.1.0`, on the intended release commit. The tag trigger uses Azure's `v*.*.*` wildcard filter, not a regular expression. A build-time equality check additionally requires the entire tag to equal `v` followed by the package version before packing. It does not independently validate semantic-version syntax. Unprefixed tag pushes do not trigger a release. The separate **Publish** stage runs only after the build and tests succeed, and only for CI runs triggered by a `v`-prefixed tag push. Its production deployment job consumes the same `sdk-build` tarball and submits it to `EsrpRelease@14` for npm package distribution. This task uses a Node.js 20 handler instead of the end-of-life Node.js 16 handler in v9. The 1ES release job cannot emit artifact outputs; neither packing nor building runs again during deployment. Creating or pushing a release tag is a release action; do not do so for build-only validation. Deployment reuses the TypeScript SDK's `msgraph-npm-org` environment, federated DevX ESRP service connection, certificate references, and configured release owners/approvers. Before pushing a release tag, authorize this pipeline to use those resources, verify the environment's approval/check policies, confirm ESRP is authorized to distribute `@microsoft/microsoft-graph-client`, and confirm the intended npm dist-tag policy. The shared configuration's name alone does not establish access to this package's `@microsoft` scope. Check that the release version is not already published.