Skip to content

Conversation

@cheenamalhotra
Copy link
Member

@cheenamalhotra cheenamalhotra commented Jan 24, 2026

Description

Updates ADO pipelines to use hardcoded OneBranch Official templates instead of parameterized template selection to meet 1ES governance and PRC compliance requirements.

Modified files

  • dotnet-sqlclient-signing-pipeline.yml
  • akv-official-pipeline.yml

Why

The parameterized approach (OneBranch.${{ parameters.oneBranchType }}.CrossPlat.yml) cannot be statically verified by Production Readiness Check and violates the requirement that production pipelines must always use Official templates.


NOTE: If Non-Official pipelines are needed, they should be created as separate pipelines.

@cheenamalhotra cheenamalhotra requested a review from a team as a code owner January 24, 2026 02:35
Copilot AI review requested due to automatic review settings January 24, 2026 02:35
@cheenamalhotra cheenamalhotra added the Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. label Jan 24, 2026
@cheenamalhotra cheenamalhotra added this to the 7.0.0-preview4 milestone Jan 24, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the governed OneBranch pipeline usage to always extend the Official CrossPlat template (removing runtime-selectable template choice) to satisfy 1ES/PRC compliance requirements.

Changes:

  • Removed the oneBranchType queue-time parameter from the affected pipelines.
  • Hardcoded extends.template to v2/OneBranch.Official.CrossPlat.yml@templates.
  • Simplified SDL configuration by removing conditional logic that only applied to non-official template selection.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
eng/pipelines/dotnet-sqlclient-signing-pipeline.yml Removes oneBranchType parameter, hardcodes Official template, and deletes non-official-only APIScan override logic.
eng/pipelines/akv-official-pipeline.yml Removes oneBranchType parameter, hardcodes Official template, and makes TSA always enabled (consistent with Official-only usage).

@codecov
Copy link

codecov bot commented Jan 24, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.56%. Comparing base (a4ccd62) to head (ab2c497).

❗ There is a different number of reports uploaded between BASE (a4ccd62) and HEAD (ab2c497). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (a4ccd62) HEAD (ab2c497)
addons 1 0
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #3913       +/-   ##
===========================================
- Coverage   90.82%   67.56%   -23.27%     
===========================================
  Files           6      263      +257     
  Lines         316    66170    +65854     
===========================================
+ Hits          287    44705    +44418     
- Misses         29    21465    +21436     
Flag Coverage Δ
addons ?
netcore 67.56% <ø> (?)
netfx 66.55% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants