Validate authentication scenarios and publishing in both reference modes

.github/instructions/testing.instructions.md

@@ -8,6 +8,7 @@ applyTo: "**/tests/**,**/*Test*.cs"
 ```
 src/Microsoft.Data.SqlClient/tests/
 ├── FunctionalTests/          # Tests without SQL Server dependency
+├── AuthenticationTests/      # Fresh-process configuration/runtime and trim/AOT fixtures
 ├── ManualTests/              # Integration tests requiring SQL Server
 ├── PerformanceTests/         # Benchmark-style perf validation
 ├── StressTests/              # Long-running stress coverage
@@ -20,6 +21,18 @@ src/Microsoft.Data.SqlClient/tests/
 
 ## Test Categories
 
+### Authentication executable scenarios
+
+Keep non-xUnit authentication configuration, DLL-replacement and publish consumers in
+`src/Microsoft.Data.SqlClient/tests/AuthenticationTests/`, not inside Abstractions unit tests.
+Use `build.proj -t:TestAuthentication` with explicit `ReferenceType=Project` or `Package`;
+Package mode prepares real local sibling packages. Use an isolated `NUGET_PACKAGES` and
+unique `PackageVersionSqlClient` to avoid stale family images. The focused configuration
+and runtime-version targets remain available. `AuthenticationPublish=true` adds Linux
+net10.0 linux-x64 trimmed/NativeAOT publishes and executions with warnings as errors.
+Windows executes net462 scenarios; Linux cross-builds are not Windows runtime validation.
+`BuildAuthenticationTests` is part of `BuildTests`; ordinary unit tests stay separate.
+
 ### Unit Tests (`UnitTests/`)
 - Test individual components in isolation
 - No external dependencies (database, network)

BUILDGUIDE.md

@@ -86,6 +86,34 @@ dotnet build build.proj -t:TestAuthenticationRuntimeVersions -p:Configuration=Re
 The same target accepts `ReferenceType=Package` and the package-preparation options above.
 The runner restores the original DLL even if a scenario fails.
 
+`TestAuthentication` runs the complete configuration/discovery/precedence matrix,
+invalid provider/initializer/unsupported-provider and cached-failure tracing checks,
+disabled switches, and both runtime mismatch scenarios. Add `AuthenticationPublish=true`
+on Linux to publish **and execute** linux-x64 trimmed and NativeAOT consumers with
+compiler/linker warnings as errors. GCC and the NativeAOT prerequisites are required.
+
+```bash
+dotnet build build.proj -t:TestAuthentication -p:Configuration=Release -p:TestFramework=net10.0 -p:ReferenceType=Project -p:AuthenticationPublish=true -p:PackageVersionSqlClient=8.0.0-stack.6
+dotnet build build.proj -t:TestAuthentication -p:Configuration=Release -p:TestFramework=net10.0 -p:ReferenceType=Package -p:AuthenticationPublish=true -p:PackageVersionSqlClient=8.0.0-stack.6
+```
+
+The Package target prepares Logging, Abstractions, SqlServer, SqlClient and Azure
+through the normal pack targets. The fixtures use conditional package references,
+verify local family packages exist and inspect restored assets; Package mode never
+falls back to project references. Use a unique family version and isolated
+`NUGET_PACKAGES` for each changed package image. Build number, suffix, file/package
+versions, configuration and reference mode flow to all fixtures; the runner freezes
+the computed family version before building, so JIT runtime version validation agrees
+with the package graph.
+
+`BuildAuthenticationTests` builds scenario fixtures without executing them and is
+included in `BuildTests`. All three fixtures are in the solution. The focused targets
+remain available; ordinary xUnit tests are unchanged. See the
+[authentication harness README](src/Microsoft.Data.SqlClient/tests/AuthenticationTests/README.md).
+The authentication CI stage independently builds and runs Project **and** Package jobs
+on Linux (net10.0, trim/AOT) and Windows (net462), with isolated caches and no assumed
+artifact downloads.
+
 ### Building Projects
 
 From the root of your repository, run `dotnet build` against `build.proj` with a build target, following this pattern:
@@ -214,6 +242,9 @@ dotnet build -t:<test_target> [optional_parameters]
 | `Test`                     | Runs the driver and extension test targets. Without `TestFramework`, all declared frameworks are attempted, including .NET Framework. _This takes considerable time and requires configured servers_. |
 | `TestAbstractions`         | Runs all tests for Microsoft.Data.SqlClient.Extensions.Abstractions                                                                                 |
 | `TestAuthenticationConfiguration` | Runs the dedicated current/legacy app.config compatibility scenarios without SQL Server. |
+| `TestAuthenticationRuntimeVersions` | Adds runtime DLL replacement checks with switches enabled and disabled. |
+| `TestAuthentication` | Runs all authentication executable scenarios; optionally publishes and executes trimmed/NativeAOT consumers with `AuthenticationPublish=true`. |
+| `BuildAuthenticationTests` | Builds the scenario fixtures without executing them; included in `BuildTests`. |
 | `TestAkvProvider`          | Runs the unit test project for Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider.                                                      |
 | `TestAzure`                | Runs all tests for Microsoft.Data.SqlClient.Extensions.Azure                                                                                        |
 | `TestSqlClient`            | Runs the unit, functional, and manual test projects for Microsoft.Data.SqlClient.                                                                    |

build.proj

@@ -616,14 +616,28 @@
     <AuthenticationTestFramework Condition="'$(TestFramework)' != ''">$(TestFramework)</AuthenticationTestFramework>
     <AuthenticationTestFramework Condition="'$(AuthenticationTestFramework)' == ''">net10.0</AuthenticationTestFramework>
     <AuthenticationPackageVersionArgument Condition="'$(PackageVersionSqlClient)' != ''">-PackageVersionSqlClient "$(PackageVersionSqlClient)"</AuthenticationPackageVersionArgument>
-    <TestAuthenticationConfigurationDependsOn Condition="'$(ReferenceType)' == 'Package' AND '$(SkipDependencyPack)' != 'true'">PackSqlClient</TestAuthenticationConfigurationDependsOn>
+    <AuthenticationFileVersionArgument Condition="'$(FileVersionSqlClient)' != ''">-FileVersionSqlClient "$(FileVersionSqlClient)"</AuthenticationFileVersionArgument>
+    <AuthenticationSqlServerVersionArgument Condition="'$(PackageVersionSqlServer)' != ''">-PackageVersionSqlServer "$(PackageVersionSqlServer)"</AuthenticationSqlServerVersionArgument>
+    <AuthenticationBuildNumberArgument Condition="'$(BuildNumber)' != ''">-BuildNumber "$(BuildNumber)"</AuthenticationBuildNumberArgument>
+    <AuthenticationBuildSuffixArgument Condition="'$(BuildSuffix)' != ''">-BuildSuffix "$(BuildSuffix)"</AuthenticationBuildSuffixArgument>
+    <AuthenticationPublishArgument Condition="'$(AuthenticationPublish)' == 'true'">-Publish</AuthenticationPublishArgument>
+    <AuthenticationCommand>&quot;$(DotnetPath)dotnet&quot; tool run pwsh -- -NonInteractive -NoProfile -File &quot;$(AuthenticationTestsScript)&quot; -Framework $(AuthenticationTestFramework) -ReferenceType $(ReferenceType) -Configuration $(Configuration) $(AuthenticationPackageVersionArgument) $(AuthenticationFileVersionArgument) $(AuthenticationSqlServerVersionArgument) $(AuthenticationBuildNumberArgument) $(AuthenticationBuildSuffixArgument)</AuthenticationCommand>
+    <TestAuthenticationConfigurationDependsOn Condition="'$(ReferenceType)' == 'Package' AND '$(SkipDependencyPack)' != 'true'">PackSqlClient;PackAzure</TestAuthenticationConfigurationDependsOn>
   </PropertyGroup>
   <Target Name="TestAuthenticationConfiguration" DependsOnTargets="$(TestAuthenticationConfigurationDependsOn)">
-    <Exec Command="&quot;$(DotnetPath)dotnet&quot; tool run pwsh -- -NonInteractive -NoProfile -File &quot;$(AuthenticationTestsScript)&quot; -Framework $(AuthenticationTestFramework) -ReferenceType $(ReferenceType) -Configuration $(Configuration) $(AuthenticationPackageVersionArgument)"
+    <Exec Command="$(AuthenticationCommand)"
           WorkingDirectory="$(RepoRoot)" />
   </Target>
   <Target Name="TestAuthenticationRuntimeVersions" DependsOnTargets="$(TestAuthenticationConfigurationDependsOn)">
-    <Exec Command="&quot;$(DotnetPath)dotnet&quot; tool run pwsh -- -NonInteractive -NoProfile -File &quot;$(AuthenticationTestsScript)&quot; -Framework $(AuthenticationTestFramework) -ReferenceType $(ReferenceType) -Configuration $(Configuration) $(AuthenticationPackageVersionArgument) -RuntimeVersions"
+    <Exec Command="$(AuthenticationCommand) -RuntimeVersions"
+          WorkingDirectory="$(RepoRoot)" />
+  </Target>
+  <Target Name="TestAuthentication" DependsOnTargets="$(TestAuthenticationConfigurationDependsOn)">
+    <Exec Command="$(AuthenticationCommand) -AllScenarios -RuntimeVersions $(AuthenticationPublishArgument)"
+          WorkingDirectory="$(RepoRoot)" />
+  </Target>
+  <Target Name="BuildAuthenticationTests" DependsOnTargets="$(TestAuthenticationConfigurationDependsOn)">
+    <Exec Command="$(AuthenticationCommand) -BuildOnly"
           WorkingDirectory="$(RepoRoot)" />
   </Target>
 
@@ -881,7 +895,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -910,7 +924,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->
@@ -1396,7 +1410,7 @@
   </PropertyGroup>
 
   <!-- BuildTests: Builds the driver test projects for their declared target frameworks. -->
-  <Target Name="BuildTests" DependsOnTargets="BuildAbstractionsTests;BuildAkvProviderTests;BuildSqlClientTestsUnit;BuildSqlClientTestsFunctional;BuildSqlClientTestsManual;BuildSqlClientTestsPerformance;BuildSqlClientTestsStress;BuildAzureTests" />
+  <Target Name="BuildTests" DependsOnTargets="BuildAbstractionsTests;BuildAkvProviderTests;BuildSqlClientTestsUnit;BuildSqlClientTestsFunctional;BuildSqlClientTestsManual;BuildSqlClientTestsPerformance;BuildSqlClientTestsStress;BuildAzureTests;BuildAuthenticationTests" />
 
   <!-- BuildAkvProviderTests: Builds the AKV Provider test project (OS-agnostic). -->
   <Target Name="BuildAkvProviderTests">

eng/pipelines/dotnet-sqlclient-ci-core.yml

@@ -162,6 +162,13 @@ variables:
     value: SqlServer.Artifacts
 
 stages:
+  - template: /eng/pipelines/pr/stages/authentication-validation-stage.yml@self
+    parameters:
+      poolName: ${{ parameters.defaultPoolName }}
+      linuxPoolImage: ADO-UB24
+      windowsPoolImage: ADO-Win25
+      buildConfiguration: ${{ parameters.buildConfiguration }}
+
   # Compute all package versions up front. Build and test stages consume the
   # compute_versions_ci outputs directly, so no version parameters are passed here.
   - template: /eng/pipelines/stages/compute-versions-ci-stage.yml@self

eng/pipelines/pr/stages/authentication-validation-stage.yml

@@ -0,0 +1,81 @@
+#################################################################################
+# Licensed to the .NET Foundation under one or more agreements.                 #
+# The .NET Foundation licenses this file to you under the MIT license.          #
+# See the LICENSE file in the project root for more information.                #
+#################################################################################
+
+parameters:
+  - name: poolName
+    type: string
+  - name: linuxPoolImage
+    type: string
+  - name: windowsPoolImage
+    type: string
+  - name: referenceTypes
+    type: object
+    default: [Project, Package]
+  - name: buildConfiguration
+    type: string
+    values: [Debug, Release]
+
+stages:
+  - stage: test_authentication
+    displayName: Authentication configuration and publishing
+    # Each job builds its own inputs through standard targets; no artifact download is assumed.
+    dependsOn: []
+    jobs:
+      - ${{ each referenceType in parameters.referenceTypes }}:
+        - job: authentication_linux_${{ referenceType }}
+          displayName: Authentication Linux ${{ referenceType }}
+          timeoutInMinutes: 90
+          pool:
+            name: ${{ parameters.poolName }}
+            demands:
+              - imageOverride -equals ${{ parameters.linuxPoolImage }}
+          variables:
+            NUGET_PACKAGES: $(Pipeline.Workspace)/authentication-linux-${{ referenceType }}/nuget
+          steps:
+            - template: /eng/pipelines/common/steps/install-dotnet.yml@self
+              parameters:
+                runtimes: [10.x]
+            - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
+            - task: DotNetCoreCLI@2
+              displayName: Scenarios, runtime mismatch, trimmed and NativeAOT execution
+              inputs:
+                command: custom
+                custom: build
+                workingDirectory: $(Build.SourcesDirectory)
+                arguments: >-
+                  build.proj -t:TestAuthentication
+                  -p:ReferenceType=${{ referenceType }}
+                  -p:Configuration=${{ parameters.buildConfiguration }}
+                  -p:TestFramework=net10.0
+                  -p:PackageVersionSqlClient=8.0.0-auth.$(Build.BuildId)
+                  -p:AuthenticationPublish=true
+
+        - job: authentication_windows_${{ referenceType }}
+          displayName: Authentication Windows ${{ referenceType }}
+          timeoutInMinutes: 90
+          pool:
+            name: ${{ parameters.poolName }}
+            demands:
+              - imageOverride -equals ${{ parameters.windowsPoolImage }}
+          variables:
+            NUGET_PACKAGES: $(Pipeline.Workspace)/authentication-windows-${{ referenceType }}/nuget
+          steps:
+            - template: /eng/pipelines/common/steps/install-dotnet.yml@self
+              parameters:
+                runtimes: [10.x]
+            - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
+            - task: DotNetCoreCLI@2
+              displayName: .NET Framework scenarios and runtime mismatch execution
+              inputs:
+                command: custom
+                custom: build
+                workingDirectory: $(Build.SourcesDirectory)
+                arguments: >-
+                  build.proj -t:TestAuthentication
+                  -p:ReferenceType=${{ referenceType }}
+                  -p:Configuration=${{ parameters.buildConfiguration }}
+                  -p:TestFramework=net462
+                  -p:PackageVersionSqlClient=8.0.0-auth.$(Build.BuildId)