From 29618c5ab09e3503bfaac26eae30a3e9053da825 Mon Sep 17 00:00:00 2001 From: Mohamed Mansour Date: Sat, 15 Aug 2026 12:55:27 -0700 Subject: [PATCH 1/2] Fix Azure release artifact caching Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .ado/pipelines/azure-pipelines-build.yml | 3 +++ DESIGN.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.ado/pipelines/azure-pipelines-build.yml b/.ado/pipelines/azure-pipelines-build.yml index f645bc8e..a142d3c5 100644 --- a/.ado/pipelines/azure-pipelines-build.yml +++ b/.ado/pipelines/azure-pipelines-build.yml @@ -414,6 +414,9 @@ stages: rustup toolchain install 1.93 --profile minimal corepack enable pnpm install --frozen-lockfile --store-dir "$PNPM_STORE_PATH" + # Versioned package archives are outputs, not reusable compilation artifacts. + rm -rf target/package + trap 'rm -rf target/package' EXIT CARGO_HOME="$CARGO_CACHE_HOME" cargo +1.93 xtask publish-stage --pack-only --profile release env: PNPM_STORE_PATH: $(PNPM_STORE_PATH) diff --git a/DESIGN.md b/DESIGN.md index 7dcb005f..fed82576 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -4298,7 +4298,7 @@ Native assets are split into `Microsoft.WebUI.Runtime.` packages for each s `dotnet/Directory.Build.props` applies NuGet metadata to packable .NET projects: `Authors=Microsoft`, `PackageOwners=Microsoft`, a package license URL with `PackageRequireLicenseAcceptance=true`, project and repository URLs, Source Link, release notes links, discoverability tags, the required `© Microsoft Corporation. All rights reserved.` copyright notice, and `.snupkg` symbol package generation. `cargo xtask publish-stage --pack-only` invokes `dotnet pack` on `dotnet/Microsoft.WebUI.sln` and stages both `.nupkg` and `.snupkg` files under `publish/nuget`. -Azure release automation uses the `.ado/pipelines/azure-pipelines-build.yml` and `.ado/pipelines/azure-pipelines-cd.yml` definitions. Pushes to `main` trigger the Microsoft-hosted `Web UI - CD Build` pipeline immediately; the pipeline may also be queued manually. `Web UI - CD` has no direct CI or pull-request trigger and starts only from a successful `BuildArtifacts` pipeline resource event on `main` or a manual queue. Its `PrepareRelease` stage selects an untagged stable workspace version. Production build and CD runs require the release build source to be `refs/heads/main`; other branches are accepted only in validation mode, which prevents feature-branch commits from becoming public release tags. `BuildArtifacts` runs three OS matrix jobs with two target legs each, providing six parallel native builds; each leg restores target-specific Cargo caches before invoking the single-target `cargo xtask publish-build`. The assembly job merges those six outputs, restores its Cargo and pnpm caches, and uses `cargo xtask publish-stage --pack-only` for WASM, npm, crate, NuGet, and standalone artifacts. The packer validates the exact 9 npm, 15 crate, 8 NuGet package, 2 NuGet symbol package, and 20 standalone asset contract before Azure publishes the unsigned artifact sets and release metadata. Completion of `BuildArtifacts` on `main` triggers the unscheduled 1ES Official `Web UI - CD` pipeline. Its `SignArtifacts` stage restores the build outputs with Azure artifact tasks and runs ESRP signing. For production runs, `TagRelease` creates or verifies the annotated Git tag, then `PublishRelease` runs independent parallel jobs for the GitHub Release, npm packages, and Rust crates so one publication destination does not block another. GitHub Releases include an issue-based changelog covering changes since the last full release instead of a static placeholder description. Validation runs stop after signing and retain unsigned npm tarballs, unsigned crate archives, signed `.nupkg` and `.snupkg` files, and standalone assets for inspection. `standalone_release_assets` contains the six direct-download native binaries, twelve WASM files, `README.md`, and `package.json`. The GitHub Release uploads all four folders for 54 explicit assets, while GitHub supplies the source ZIP and tarball as two additional downloads. Publishing to NuGet.org remains a manual operation using `signed_nuget_packages`. Before NuGet.org publishing, ownership must be limited to the approved Microsoft package owner/co-owner accounts, every Authenticode-signable file in the package must be signed, and each `.nupkg` must be signed with the Microsoft certificate through the approved signing process. The queue-time `validationMode` parameter defaults to `false`; selecting `true` in both pipelines permits an existing-version artifact rebuild while omitting tag creation and external publication. The selected validation mode is carried in release metadata, and CD rejects builds whose mode does not match its own configuration. +Azure release automation uses the `.ado/pipelines/azure-pipelines-build.yml` and `.ado/pipelines/azure-pipelines-cd.yml` definitions. Pushes to `main` trigger the Microsoft-hosted `Web UI - CD Build` pipeline immediately; the pipeline may also be queued manually. `Web UI - CD` has no direct CI or pull-request trigger and starts only from a successful `BuildArtifacts` pipeline resource event on `main` or a manual queue. Its `PrepareRelease` stage selects an untagged stable workspace version. Production build and CD runs require the release build source to be `refs/heads/main`; other branches are accepted only in validation mode, which prevents feature-branch commits from becoming public release tags. `BuildArtifacts` runs three OS matrix jobs with two target legs each, providing six parallel native builds; each leg restores target-specific Cargo caches before invoking the single-target `cargo xtask publish-build`. The assembly job merges those six outputs and restores its Cargo, target, and pnpm caches. It preserves reusable Cargo compilation artifacts while removing `target/package` before and after `cargo xtask publish-stage --pack-only`, because that directory contains versioned release archives rather than incremental build inputs. The packer generates WASM, npm, crate, NuGet, and standalone artifacts and validates the exact 9 npm, 15 crate, 8 NuGet package, 2 NuGet symbol package, and 20 standalone asset contract before Azure publishes the unsigned artifact sets and release metadata. Completion of `BuildArtifacts` on `main` triggers the unscheduled 1ES Official `Web UI - CD` pipeline. Its `SignArtifacts` stage restores the build outputs with Azure artifact tasks and runs ESRP signing. For production runs, `TagRelease` creates or verifies the annotated Git tag, then `PublishRelease` runs independent parallel jobs for the GitHub Release, npm packages, and Rust crates so one publication destination does not block another. GitHub Releases include an issue-based changelog covering changes since the last full release instead of a static placeholder description. Validation runs stop after signing and retain unsigned npm tarballs, unsigned crate archives, signed `.nupkg` and `.snupkg` files, and standalone assets for inspection. `standalone_release_assets` contains the six direct-download native binaries, twelve WASM files, `README.md`, and `package.json`. The GitHub Release uploads all four folders for 54 explicit assets, while GitHub supplies the source ZIP and tarball as two additional downloads. Publishing to NuGet.org remains a manual operation using `signed_nuget_packages`. Before NuGet.org publishing, ownership must be limited to the approved Microsoft package owner/co-owner accounts, every Authenticode-signable file in the package must be signed, and each `.nupkg` must be signed with the Microsoft certificate through the approved signing process. The queue-time `validationMode` parameter defaults to `false`; selecting `true` in both pipelines permits an existing-version artifact rebuild while omitting tag creation and external publication. The selected validation mode is carried in release metadata, and CD rejects builds whose mode does not match its own configuration. ### Documentation Guidelines - Using `vitepress` in `docs/` From 72f86f25a375ff0f17551d97d3a09bf774cd0bef Mon Sep 17 00:00:00 2001 From: Mohamed Mansour Date: Sat, 15 Aug 2026 13:04:11 -0700 Subject: [PATCH 2/2] Anchor Azure packaging task to checkout Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .ado/pipelines/azure-pipelines-build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.ado/pipelines/azure-pipelines-build.yml b/.ado/pipelines/azure-pipelines-build.yml index a142d3c5..bceb0a5c 100644 --- a/.ado/pipelines/azure-pipelines-build.yml +++ b/.ado/pipelines/azure-pipelines-build.yml @@ -407,6 +407,7 @@ stages: displayName: Generate release artifacts inputs: targetType: inline + workingDirectory: '$(Build.SourcesDirectory)' script: | set -euo pipefail sudo apt-get update -q