Courtesy Push Pipeline Improvement - Part#2 | Merge Publish and Courtesy Push Jobs

[dassayantan24]

Context

The goal is to reduce the execution time of the Courtesy Push pipeline by eliminating auto-injected tasks and merging Job 2 - Publish Nuget Artifacts and Job 3 - Courtesy Push.

Work-Item - https://dev.azure.com/mseng/AzureDevOps/_workitems/edit/2329703

Design Doc - Courtesy Push Pipeline Improvement - latest.docx

---

Task Name

• None

---

Description

Pipeline Architecture Update:

• Merged Job 2 (Publish NuGet Artifacts) and Job 3 (Courtesy Push) into a single job.

• After merging the two jobs, the auto-injected 1ES task BinSkim scans the entire workspace and detects two potentially vulnerable files:

  • node_modules/pnpm/dist/vendor/fastlist-0.3.0-x64.exe
  • node_modules/pnpm/dist/vendor/fastlist-0.3.0-x86.exe.

  This causes the pipeline to fail. Since these are generated files created by the npm ci command and should be ignored, I added their file hashes to .gdn/.gdnbaselines
  Failed Pipeline - https://dev.azure.com/mseng/AzureDevOps/_build/results?buildId=30746710&view=results

Simplification Changes:

• Removed the variable publishToDistributedTaskTest as it is unnecessary; the dry run already performs the same functionality.
• Updated the default folder name value for the variable tasksBuildArtifact in ci/stage-milestone.js.

---

Risk Assessment (Low / Medium / High)

Medium

---

Change Behind Feature Flag (Yes / No)

Can this change be behine feature flag, if not why?
No

---

Tech Design / Approach

• Design has been written and reviewed. Yes
• Any architectural decisions, trade-offs, and alternatives are captured. Yes

---

Documentation Changes Required (Yes/No)

Indicate whether related documentation needs to be updated.

• User guides, API specs, system diagrams, or runbooks are updated. No

---

Unit Tests Added or Updated (Yes / No)

Indicate whether unit tests were added or modified to reflect these changes.
No

---

Additional Testing Performed

List all other tests performed (manual or automated, including integration, regression, scenario tests, etc.).
Manually Tested, https://dev.azure.com/mseng/AzureDevOps/_build/results?buildId=30750068&view=results

---

Logging Added/Updated (Yes/No)

• Appropriate log statements are added with meaningful messages.
• Logging does not expose sensitive data.
• Log levels are used correctly (e.g., info, warn, error).

---

Telemetry Added/Updated (Yes/No)

• Custom telemetry (e.g., counters, timers, error tracking) is added as needed.
• Events are tagged with proper metadata for filtering and analysis.
• Telemetry is validated in staging or test environments.

---

Rollback Scenario and Process (Yes/No)

• Rollback plan is documented.

---

Dependency Impact Assessed and Regression Tested (Yes/No)

• All impacted internal modules, APIs, services, and third-party libraries are analyzed.
• Results are reviewed and confirmed to not break existing functionality.

---

Checklist

• Related issue linked (if applicable)
• Task version was bumped — see versioning guide
• Verified the task behaves as expected

[dassayantan24]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).