Publish filtered signed packages through BAR

[jonathanpeppers]

Summary

• consume only the existing signed nuget-signed artifact after the repository signing stage
• inspect signed package identities and query the public dotnet10 feed before creating an Arcade V3 asset manifest
• publish a deterministic audit inventory and register only missing shipping packages in BAR
• publish production builds through Arcade's vendored Darc default-channel flow, without hardcoding a channel ID
• serialize publication through an exclusive lock on the Maestro service connection and keep production publishing disabled until the documented external setup is complete

Validation

• 18 focused publisher tests pass
• scoped Arcade SDK/task restore succeeds using dotnet-public and dotnet-eng
• publishing YAML and JSON parse successfully
• Opus 5 review found no remaining correctness issues

BAR registration validation

AndroidX run 20260817.2 exercises the BAR path from commit 71c67f0b45ed9d932031f096e80b9b03523fd32b.

The manual validation mode:

• rejects test-signed source builds and downloads nuget-signed from successful official AndroidX build 14977676
• performs exact dotnet10 feed checks, deterministic inventory generation, package filtering, and Arcade V3 manifest generation
• publishes the audit, filtered package, and manifest pipeline artifacts
• registers included real-signed assets in BAR
• compile-time omits Darc default-channel publication, so the validation build cannot publish packages to dotnet10

Stack

Depends on #1523 (jonathanpeppers-bootstrap-arcade-tooling).

[Copilot]

Pull request overview

Adds a BAR-based publishing pipeline for signed NuGet packages, ensuring only missing packages are registered/promoted to the public .NET 10 (dotnet10) feed, with a deterministic audit inventory for traceability.

Changes:

• Introduces a new publish_signed_packages stage that consumes the existing nuget-signed artifact, filters to missing packages, registers them in BAR, and promotes via the .NET 10 channel.
• Adds a SignedPackagePublisher .NET tool (plus focused NUnit tests) to inspect signed packages, probe the target feed, and emit both an audit inventory and an Arcade V3 asset manifest.
• Documents the one-time Azure DevOps setup and introduces scoped restore configuration for the isolated publishing surface.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
global.json	Pins Arcade MSBuild SDK version and adds tools.dotnet for Arcade toolset initialization.
docs/publishing-signed-packages.md	Documents the BAR-based signed package publishing flow and required ADO setup.
build/publishing/NuGet.config	Defines a scoped restore surface with dotnet-public + dotnet-eng.
build/publishing/promote-build.ps1	Adds a promotion script to validate and promote a BAR build to a specific channel.
build/publishing/SignedPackagePublisher/SignedPackagePublisher.csproj	New net10 console tool project with Arcade publishing dependencies.
build/publishing/SignedPackagePublisher/PublishingPlanner.cs	Implements deduplication + feed probing to decide which packages to include.
build/publishing/SignedPackagePublisher/PublishingOutput.cs	Writes deterministic inventory JSON, stages packages, and emits an Arcade V3 manifest.
build/publishing/SignedPackagePublisher/Program.cs	Parses CLI args and orchestrates inspection, planning, and output emission.
build/publishing/SignedPackagePublisher/PackageInspector.cs	Inspects .nupkg identity/version and computes SHA-256 for auditing.
build/publishing/SignedPackagePublisher/NuGetFeedProbe.cs	Probes feed existence with retry/backoff and failure classification.
build/publishing/SignedPackagePublisher/Models.cs	Defines shared models/enums (inventory entries, plan, error types).
build/publishing/SignedPackagePublisher.Tests/SignedPackagePublisher.Tests.csproj	Adds a dedicated test project for the publishing tool.
build/publishing/SignedPackagePublisher.Tests/PublishingPlannerTests.cs	Covers filtering, deduplication, and error cases in the planner.
build/publishing/SignedPackagePublisher.Tests/PublishingOutputTests.cs	Verifies byte-for-byte deterministic inventory and manifest attributes.
build/publishing/SignedPackagePublisher.Tests/PackageInspectorTests.cs	Verifies nuspec identity/version normalization and SHA-256 length.
build/publishing/SignedPackagePublisher.Tests/FeedFailureClassifierTests.cs	Verifies strict HTTP failure classification behavior.
build/publishing/SignedPackagePublisher.Tests/GlobalUsings.cs	Adds NUnit global using for tests.
build/ci/variables.yml	Adds BAR publishing variables (disabled by default).
build/ci/stage-publish-signed-artifacts.yml	New publish stage wiring: filter → inventory → register in BAR → promote.
azure-pipelines.yml	Wires the new publish stage template into the main pipeline.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[jonathanpeppers]

@dalexsoto review

[dalexsoto]

The BAR publishing stage safely filters missing signed packages, uses deterministic manifests and explicit restore configuration, and remains disabled until external setup is complete.

[jonathanpeppers]

/azp run

[azure-pipelines]

Azure Pipelines:
No pipelines were found matching this branch/path.