security: Use governed template for LTS build pipeline #25931
Merged
+95
−97
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the LTS branch build pipeline to use Microsoft's 1ES (One Engineering System) governed templates for enhanced security and compliance. The migration replaces traditional Azure DevOps pipeline structure with the 1ES.Official.PipelineTemplate, which provides built-in SDL (Security Development Lifecycle) features including Arrow service integration for artifact shipping.
Key changes:
- Migrated from standalone pipeline to 1ES Pipeline Templates framework
- Integrated Arrow service connection for secure artifact publishing with
shouldShipparameter - Converted artifact publishing from task-based (
PublishBuildArtifacts@1) to declarativetemplateContext.outputs
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tools/pipelines/templates/build-npm-package.yml | Complete migration to 1ES templates with SDL/Arrow configuration, artifact publishing moved to templateContext outputs, component governance job removed (now handled by 1ES), and template paths updated to use @self references |
| tools/pipelines/build-client.yml | Added shouldShip parameter configuration to control Arrow artifact shipping for release and prerelease builds |
Co-authored-by: Copilot <[email protected]>
alexvy86
approved these changes
Nov 26, 2025
Contributor
alexvy86
left a comment
alexvy86
left a comment
There was a problem hiding this comment.
Looks good as far as I can tell; the PR build will tell us if we missed anything.
alexvy86
approved these changes
Nov 26, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR updates the build pipeline on the LTS branch to use governed templates.
Reviewer Guidance
Misc
AB#53960