fix(ci): make publish workflow green by fixing ESRP stubs and pip hash syntax

[Imran Siddique (imran-siddique)]

Summary

Fixes the NuGet deployment page (/deployments/nuget) showing perpetual failure by removing the exit 1 ESRP signing TODO stubs.

Also fixes all 7 build-python jobs that fail on pip install --hash syntax.

Changes

NuGet (publish-nuget job)

• Signing steps: Replaced exit 1 stubs with ::warning:: messages. ESRP signing is pending PRSS certificate setup. Steps now succeed with warnings instead of failing the entire job.
• Publish gate: The Publish to NuGet step now checks steps.sign-dll.outputs.signed == 'true' && steps.sign-nuget.outputs.signed == 'true'. Since signing outputs signed=false, the publish step is skipped, preventing unsigned packages from reaching NuGet.
• Artifact upload: Added Upload NuGet artifacts step so .nupkg and .snupkg files are preserved as workflow artifacts (30-day retention) for the ADO pipeline to consume.

Python (build-python jobs)

• pip hash syntax: The inline pip install --hash=sha256:... is not recognized as a valid option on the runner's pip version. Switched to requirements file format (-r /tmp/build-req.txt) where --hash is properly supported per PEP 503.

What still works

• .NET SDK build, 560 tests, pack all pass
• Sigstore signing and provenance attestation for Python packages
• NPM build and attestation
• Production NuGet publishing via ADO pipeline (.github/pipelines/esrp-publish.yml) is unaffected

What changes

• /deployments/nuget will show green
• build-python jobs will succeed (sigstore + provenance + artifact upload)
• Unsigned packages are NOT published (publish step is properly gated)

[github-actions]

🤖 AI Agent: security-scanner — View details

No security issues found.

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

Docs Sync

• README.md -- deployment section needs update to reflect changes in NuGet publishing workflow.
• CHANGELOG.md -- missing entry for behavioral changes in NuGet and Python build workflows.

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

API Compatibility

No breaking changes detected.

[github-actions]

🤖 AI Agent: code-reviewer — Review Summary

Review Summary

This pull request addresses two key issues in the CI/CD pipeline:

1. Fixing the ESRP signing stubs to prevent workflow failures while ensuring unsigned packages are not published.
2. Correcting the pip install --hash syntax issue in Python build jobs.

The changes improve the stability and correctness of the CI/CD pipeline while maintaining security controls. However, there are a few areas that require attention, particularly around security and potential breaking changes.

---

Feedback

CRITICAL

1. Unsigned Package Handling:

   • While the PR ensures that unsigned packages are not published to NuGet, the use of ::warning:: messages instead of failing the job could lead to complacency. If the ESRP signing process is not implemented in the future, this could result in a false sense of security.
   • Recommendation: Add a clear comment or mechanism (e.g., a scheduled reminder or a CI/CD check) to ensure that the ESRP signing implementation is not overlooked.

2. Artifact Upload Security:

   • The uploaded .nupkg and .snupkg files are retained for 30 days. If these artifacts are not signed, they could be tampered with or misused.
   • Recommendation: Ensure that these artifacts are stored securely and access is restricted to authorized users. Consider adding a checksum or signature verification step before uploading.

WARNING

1. Backward Compatibility:

   • The change to the pip install syntax (switching to a requirements file) could potentially break workflows or scripts that depend on the previous inline syntax.
   • Recommendation: Document this change in the release notes or migration guide to inform users of the updated syntax.

2. NuGet Publish Gate:

   • The Publish to NuGet step now depends on steps.sign-dll.outputs.signed and steps.sign-nuget.outputs.signed. If these outputs are not correctly set in future changes, it could inadvertently block publishing.
   • Recommendation: Add tests or validation to ensure these outputs are correctly set and that the publish gate functions as intended.

SUGGESTION

1. Code Comments:

   • The comments in the ESRP signing steps are helpful, but they could be more explicit about the risks of not implementing signing and the timeline for addressing this.
   • Recommendation: Add a TODO with a specific deadline or link to a tracking issue for implementing ESRP signing.

2. Pipeline Documentation:

   • The changes to the pipeline are significant and may not be immediately clear to all contributors.
   • Recommendation: Update the repository's CI/CD documentation to reflect these changes, including the new artifact upload step and the use of the requirements file for pip install.

3. Hash Verification:

   • While the use of --require-hashes is a good security practice, consider adding a step to validate the integrity of the requirements file itself (e.g., by storing it in a secure location or verifying its checksum).
   • Recommendation: Add a mechanism to ensure the integrity of the requirements file used in the pipeline.

4. Error Messaging:

   • The ::warning:: messages in the ESRP signing steps are helpful but could be more descriptive.
   • Recommendation: Include a link to the ADO pipeline or documentation for further guidance in the warning messages.

---

Conclusion

The PR addresses critical pipeline issues effectively and introduces necessary safeguards to prevent unsigned packages from being published. However, there are some security and backward compatibility concerns that should be addressed to ensure the robustness and maintainability of the pipeline.

[github-actions]

🤖 AI Agent: test-generator — `.github/workflows/publish.yml`

Test Coverage Analysis

.github/workflows/publish.yml

• Existing coverage:

  • CI/CD workflows are generally not directly covered by unit tests, as they involve external systems and infrastructure. However, the functionality they trigger (e.g., package signing, artifact upload) may be indirectly tested through integration tests or manual validation steps.
  • The ESRP signing stubs (exit 1) were previously blocking the workflow, so no tests would have validated the signing logic or gating conditions.
  • The Python pip install syntax change is unlikely to have direct test coverage unless the CI/CD pipeline itself is monitored for syntax correctness.

• Missing coverage:

  • No automated tests validate the correctness of the ESRP signing logic, gating conditions, or artifact upload steps.
  • The gating condition (steps.sign-dll.outputs.signed == 'true' && steps.sign-nuget.outputs.signed == 'true') is untested for edge cases, such as incorrect outputs or missing environment variables.
  • The Python pip install syntax change is not validated for compatibility across different runner environments or pip versions.

• Suggested test cases:

  1. test_esrp_signing_outputs: Simulate the ESRP signing steps and validate that the signed output is correctly set to false when certificates are missing. Ensure the workflow skips the publish step in this scenario.
  2. test_publish_gate_conditions: Mock the outputs of sign-dll and sign-nuget steps and test the gating condition for the Publish to NuGet step. Include edge cases like signed=null, signed=false, and missing outputs.
  3. test_artifact_upload: Validate that the Upload NuGet artifacts step correctly uploads .nupkg and .snupkg files as artifacts. Test for scenarios where the artifact directory is empty or contains invalid files.
  4. test_pip_install_hash_syntax: Create a test to verify that the pip install --require-hashes -r syntax works across different runner environments and pip versions. Include edge cases like malformed requirements files or unsupported hash algorithms.
  5. test_missing_esrp_configuration: Simulate a scenario where env.ESRP_CONFIGURED is false and ensure that the ESRP signing steps are skipped, and the workflow does not attempt to publish unsigned packages.

By implementing these tests, the repository can ensure robust validation of the CI/CD workflow changes and prevent future regressions.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	❌ Failed	Issues detected
🛡️ Security Scan	✅ Completed	Analysis complete
🔄 Breaking Changes	⚠️ Warning	See details
📝 Docs Sync	✅ Completed	Analysis complete
🧪 Test Coverage	✅ Completed	Analysis complete

Verdict: ❌ Changes needed