Prevent scanning/signing of unrelated packages

.gitignore

@@ -65,6 +65,7 @@ BenchmarkDotNet.Artifacts/
 project.lock.json
 project.fragment.lock.json
 artifacts/
+output/
 
 # StyleCop
 StyleCopReport.xml

build.proj

@@ -301,8 +301,8 @@
 
   <Target Name="BuildNetCoreAllOS" DependsOnTargets="RestoreNetCore;BuildSqlServer;BuildAbstractions;BuildLogging">
     <MSBuild Projects="@(NetCoreDriver)" Properties="$(CI);$(ProjectProperties);Platform=AnyCPU;OSGroup=Unix;" RemoveProperties="TargetsWindows;TargetsUnix;" />
     <MSBuild Projects="@(NetCoreDriver)" Properties="$(CI);$(ProjectProperties);Platform=AnyCPU;OSGroup=Windows_NT;" RemoveProperties="TargetsWindows;TargetsUnix;" Condition="'$(IsEnabledWindows)' == 'true'" />
     <MSBuild Projects="@(NetCoreDriver)" Properties="$(CI);$(ProjectProperties);Platform=AnyCPU;OSGroup=AnyOS;" RemoveProperties="TargetsWindows;TargetsUnix;" />
   </Target>
 
   <Target Name="BuildNetCoreUnix" DependsOnTargets="RestoreNetCore">
@@ -344,7 +344,7 @@
       <TestCommand>$([System.Text.RegularExpressions.Regex]::Replace($(TestCommand), "\s+", " "))</TestCommand>
     </PropertyGroup>
     <Message Text=">>> Running unit tests for Windows via command: $(TestCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(TestCommand)"/>
   </Target>
 
   <!-- Run all unit tests applicable to Unix. -->
@@ -484,10 +484,12 @@
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "bin", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", ".nuget", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "obj", SearchOption.AllDirectories))' />
-    <!-- We keep packages/ but remove all of the generated files. -->
+    <!-- Remove generated .nupkg and .snupkg files from packages/ and output/. -->
     <ItemGroup>
       <PackagesToDelete Include="$(RepoRoot)/packages/*.nupkg" />
       <PackagesToDelete Include="$(RepoRoot)/packages/*.snupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.nupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.snupkg" />
     </ItemGroup>
     <Delete Files="@(PackagesToDelete)" />
   </Target>

eng/pipelines/common/templates/steps/generate-nuget-package-step.yml

@@ -12,7 +12,7 @@ parameters:
 
   - name: outputDirectory
     type: string
-    default: '$(Build.SourcesDirectory)/packages'
+    default: '$(Build.SourcesDirectory)/output'
 
   # The C# build configuration (e.g. Debug or Release) to use when building the NuGet package.
   - name: buildConfiguration

eng/pipelines/onebranch/jobs/build-akv-official-job.yml

@@ -101,15 +101,22 @@ jobs:
                 $jsonParams | ConvertFrom-Json | Format-List
             displayName: 'Output Job Parameters'
 
-          # Download SqlClient (MDS) and Logging packages from previous stages into
-          # packages/ so that they're available via the local NuGet feed when restoring.
-          # AKV Provider depends on both SqlClient and Extensions.Logging.
+          # Download SqlClient (MDS), Abstractions, and Logging packages from previous
+          # stages into packages/ so that they're available via the local NuGet feed
+          # when restoring.  AKV Provider depends on SqlClient, which transitively
+          # requires Extensions.Abstractions and Extensions.Logging.
           - task: DownloadPipelineArtifact@2
             displayName: Download SqlClient Package
             inputs:
                 artifactName: $(sqlClientArtifactsName)
                 targetPath: $(Build.SourcesDirectory)/packages
 
+          - task: DownloadPipelineArtifact@2
+            displayName: Download Abstractions Package
+            inputs:
+                artifactName: $(abstractionsArtifactsName)
+                targetPath: $(Build.SourcesDirectory)/packages
+
           - task: DownloadPipelineArtifact@2
             displayName: Download Logging Package
             inputs:

eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml

@@ -64,7 +64,7 @@ jobs:
 
     variables:
       - name: ob_outputDirectory
-        value: $(Build.SourcesDirectory)/packages
+        value: $(Build.SourcesDirectory)/output
 
       - name: artifactPath
         value: $(Pipeline.Workspace)/${{ parameters.artifactName }}

eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml

@@ -35,6 +35,7 @@ steps:
       msbuildArguments: >-
           -t:${{ parameters.packTarget }}
           -p:ReferenceType=Package
+          -p:PackagesDir=$(PACK_OUTPUT)/
           ${{ parameters.versionProperties }}
 
   - script: tree /a /f $(PACK_OUTPUT)

eng/pipelines/onebranch/variables/common-variables.yml

@@ -41,10 +41,11 @@ variables:
   - name: BUILD_OUTPUT
     value: $(REPO_ROOT)/artifacts
 
-  # THis is where our C# projects place their NuGet package outputs (see Directory.Build.props
-  # <PackagesDir>).
+  # This is where our C# projects place their NuGet package outputs.  This is intentionally
+  # separate from packages/ (where downloaded pipeline artifacts go) so that ESRP signing and
+  # OneBranch artifact publishing only operate on packages built by the current job.
   - name: PACK_OUTPUT
-    value: $(REPO_ROOT)/packages
+    value: $(REPO_ROOT)/output
 
   # C# assembly versions must be in the format: Major.Minor.Build.Revision, but
   # $(Build.BuildNumber) has the format XXX.YY.  Additionally, each version part