@samitouri / QOSAMI-WSL-1 / commits / 57abb2c0

Pipelines: fix nuget stage CodeSign failure on in-repo .ps1 scripts (#40685)

The release build's nuget stage (Publish nuget packages) was failing in the Guardian CodeSign post-analysis with 10 CodeSign.MissingSigningCert errors on unsigned dev/diagnostic/test helper .ps1 scripts in the source tree. The OneBranch per-stage SDL CodeSign validation is job-scoped: the pipeline-level ob_sdl_codeSignValidation_excludes variable does not flow into the auto-injected per-stage analysis, so it never had any effect. The stages that pass do so because of the binaries-only globalSdl.codesign.targetGlob (release) or job-level excludes (build-job.yml, package-stage.yml). The nuget job had neither, so its CodeSign validation scanned the checked-out repo and broke on the .ps1 files. Set ob_sdl_codeSignValidation_excludes on the nuget job (mirrors build-job.yml) so the .ps1 scripts are skipped while the published .nupkg files stay validated. Also remove the ineffective pipeline-level ob_sdl_codeSignValidation_excludes variable from the release/nightly/PR OneBranch pipelines (added in #40541): it never suppressed the per-stage CodeSign analysis. The release pipeline is already covered by the binaries-only targetGlob plus per-job excludes, and the nightly/PR pipelines use the NonOfficial template with no breaking codesign. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Ben Hillis committed Jun 1, 2026 at 17:46 UTC 57abb2c0a43025718c826b63cb957de23dc0846f

4 files changed +4 -3

.pipelines/nuget-stage.yml

@@ -28,6 +28,10 @@ stages:

28 ob_outputDirectory: '$(Build.SourcesDirectory)\out'

29 ob_artifactBaseName: 'drop_wsl'

30 ob_artifactSuffix: '_nuget'

31 + # The per-stage SDL CodeSign post-analysis scans the checked-out repo, which contains unsigned

32 + # helper .ps1 scripts. The pipeline-level exclude does not flow into per-stage SDL, so it must be

33 + # set on this job as well (mirrors build-job.yml). The published .nupkg files remain validated.

34 + ob_sdl_codeSignValidation_excludes: -|**\*.ps1

36 steps:

.pipelines/wsl-build-nightly-onebranch.yml

-1

@@ -11,7 +11,6 @@ schedules:

11 variables:

12 WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"

13 WindowsHostVersion: '1ESWindows2022'

14 - ob_sdl_codeSignValidation_excludes: -|**\*.ps1

15 resources:

16 repositories:

.pipelines/wsl-build-pr-onebranch.yml

-1

@@ -7,7 +7,6 @@ trigger:

7 variables:

8 WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"

9 WindowsHostVersion: '1ESWindows2022'

10 - ob_sdl_codeSignValidation_excludes: -|**\*.ps1

11 resources:

12 repositories:

.pipelines/wsl-build-release-onebranch.yml

-1

@@ -21,7 +21,6 @@ trigger:

21 variables:

22 WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"

23 WindowsHostVersion: '1ESWindows2022'

24 - ob_sdl_codeSignValidation_excludes: -|**\*.ps1

25 resources:

26 repositories: