Remove pipeline-scoped Publish-Build-Assets group

[Adam Ratzman (adamint)]

Description

Ports internal PR 63710 to main.

This removes the pipeline-scoped Publish-Build-Assets variable group. Asset_Registry_Publish already loads the group at job scope, so the credentials remain available where they are needed without being injected into every pipeline stage.

The internal npm mirror currently serves @azure/identity 4.13.2 without its quarantined @azure/core-process dependency. This also pins Azure Identity 4.13.1 explicitly at all four VSCE install sites so their transitive dependency graph remains stable across npm feed updates.

• Initial feed failures: 3052144, 3052233
• Successful internal build: 3052356

Build 3052356 completed every stage and job with no failed or canceled records. Its warning-only partiallySucceeded result matches the recent main control build. The final commit only clarifies comments and does not change the validated pipeline behavior.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19518

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19518"

[Copilot]

Pull request overview

Removes pipeline-wide BAR publishing credentials while preserving job-scoped access, and pins Azure Identity to avoid an unavailable mirrored dependency.

Changes:

• Removes Publish-Build-Assets from common pipeline variables.
• Documents job-scoped BAR credentials and branch gating.
• Pins @azure/identity 4.13.1 across all VSCE installations.

Show a summary per file

File	Description
eng/pipelines/common-variables.yml	Removes the pipeline-scoped variable group.
eng/pipelines/azure-pipelines.yml	Clarifies job-scoped credential loading.
eng/pipelines/templates/build_extension.yml	Pins Azure Identity for extension builds.
eng/pipelines/azure-pipelines-unofficial.yml	Pins Azure Identity in unofficial builds.
eng/pipelines/azure-pipelines-codeql.yml	Pins Azure Identity in CodeQL builds.
eng/pipelines/release-publish-nuget.yml	Pins Azure Identity for marketplace publishing.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Adam Ratzman (adamint)]

/backport to release/13.5

[github-actions]

Started backporting to release/13.5 (link to workflow run)