From b339ccb2c2d303316959080ea10069b50666cf3c Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Mon, 28 Sep 2026 21:56:50 +0000 Subject: [PATCH 1/3] Use GitHub App for publishing PRs Author automated version-bump pull requests with the Azure Pipelines GitHub App instead of the rushbot user. This avoids the CLA-signoff remediation runs that can complete without the published-versions artifact. Assistant-model: GPT-5.6 Sol Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cf6cf85-3fa3-4aff-a739-2d3c3ea4f9b8 --- common/config/azure-pipelines/npm-publish.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml index 62c30996..45f7ab66 100644 --- a/common/config/azure-pipelines/npm-publish.yaml +++ b/common/config/azure-pipelines/npm-publish.yaml @@ -31,6 +31,14 @@ variables: resources: repositories: + # Use the Azure Pipelines GitHub App identity for the version-bump commit and PR. Unlike the + # "rushbot" user credentials from "checkout: self", this bot identity is exempt from the + # Microsoft CLA check and does not require a separate CLA-signoff pipeline run. + - repository: tsdocGitHubApp + type: github + name: microsoft/tsdoc + endpoint: GitHubProjects + ref: refs/heads/main - repository: RushstackMainRepo type: github name: Microsoft/rushstack @@ -72,7 +80,7 @@ extends: targetPath: $(Build.ArtifactStagingDirectory)/json-schemas artifactName: json-schemas steps: - - checkout: self + - checkout: tsdocGitHubApp persistCredentials: true path: tsdoc From 0cbf0a11b10e91d64ea147ffc270240227674cd3 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Mon, 28 Sep 2026 22:02:51 +0000 Subject: [PATCH 2/3] Publish versions from the ESRP pipeline Forward the published-versions artifact from the matching bump pipeline run so downstream consumers can use the authoritative TSDoc release pipeline, matching the RushStack ESRP pipelines. Assistant-model: GPT-5.6 Sol Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cf6cf85-3fa3-4aff-a739-2d3c3ea4f9b8 --- .../config/azure-pipelines/npm-release.yaml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/common/config/azure-pipelines/npm-release.yaml b/common/config/azure-pipelines/npm-release.yaml index ba946bcb..0d8e7cbd 100644 --- a/common/config/azure-pipelines/npm-release.yaml +++ b/common/config/azure-pipelines/npm-release.yaml @@ -93,6 +93,12 @@ extends: pool: name: publish-rushstack os: linux + templateContext: + outputParentDirectory: $(Build.ArtifactStagingDirectory) + outputs: + - output: pipelineArtifact + targetPath: $(Build.ArtifactStagingDirectory)/published-versions + artifactName: published-versions steps: - checkout: self persistCredentials: true @@ -100,6 +106,11 @@ extends: - template: /common/config/azure-pipelines/templates/install-node.yaml@self + - bash: | + mkdir -p "$(Build.ArtifactStagingDirectory)/published-versions" + displayName: 'Initialize artifact staging directory' + condition: always() + - ${{ if gt(parameters.BumpPipelineRunIdOverride, 0) }}: - bash: | echo "Using bump pipeline run override ${{ parameters.BumpPipelineRunIdOverride }}" @@ -118,6 +129,18 @@ extends: Name: FindBumpRun WorkingDirectory: $(RepoPath) + - task: DownloadPipelineArtifact@2 + condition: eq(variables['FindBumpRun.IsVersionBumpMerge'], 'true') + inputs: + artifactName: published-versions + targetPath: $(Build.ArtifactStagingDirectory)/published-versions + project: ${{ parameters.BumpPipelineProject }} + definition: $(FindBumpRun.BumpPipelineDefinitionId) + pipelineId: $(FindBumpRun.BumpPipelineRunId) + buildType: specific + buildVersionToDownload: specific + displayName: 'Stage published versions artifact' + - stage: Publish displayName: 'Publish NPM Packages via ESRP' dependsOn: From e03e414ceccd6eaf7126a3fc567203a1e780179e Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Mon, 28 Sep 2026 22:24:23 +0000 Subject: [PATCH 3/3] Avoid artifact setup after cancellation Initialize the artifact directory before the remaining preparation steps and rely on the default succeeded condition, so the step does not run after cancellation. Assistant-model: GPT-5.6 Sol Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2cf6cf85-3fa3-4aff-a739-2d3c3ea4f9b8 --- common/config/azure-pipelines/npm-release.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/common/config/azure-pipelines/npm-release.yaml b/common/config/azure-pipelines/npm-release.yaml index 0d8e7cbd..066c5afe 100644 --- a/common/config/azure-pipelines/npm-release.yaml +++ b/common/config/azure-pipelines/npm-release.yaml @@ -104,12 +104,11 @@ extends: persistCredentials: true path: tsdoc - - template: /common/config/azure-pipelines/templates/install-node.yaml@self - - bash: | mkdir -p "$(Build.ArtifactStagingDirectory)/published-versions" displayName: 'Initialize artifact staging directory' - condition: always() + + - template: /common/config/azure-pipelines/templates/install-node.yaml@self - ${{ if gt(parameters.BumpPipelineRunIdOverride, 0) }}: - bash: |