From ab8a918f9f4938016f1eff4a224a3ff5f1215792 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:50:52 -0700 Subject: [PATCH 1/8] Use Azure Pipelines app for version bump PRs Check out rushstack through the GitHubProjects service connection while preserving the source directory and triggering commit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- common/config/azure-pipelines/npm-publish-rush.yaml | 6 ++++++ common/config/azure-pipelines/npm-publish.yaml | 6 ++++++ .../templates/bump-versions-stages.yaml | 12 +++++++++++- 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/common/config/azure-pipelines/npm-publish-rush.yaml b/common/config/azure-pipelines/npm-publish-rush.yaml index 2bf716b191..e76a5f45f9 100644 --- a/common/config/azure-pipelines/npm-publish-rush.yaml +++ b/common/config/azure-pipelines/npm-publish-rush.yaml @@ -29,6 +29,11 @@ resources: type: git name: 1ESPipelineTemplates/1ESPipelineTemplates ref: refs/tags/release + - repository: rushstackGitHubApp + type: github + name: microsoft/rushstack + endpoint: GitHubProjects + ref: refs/heads/main extends: template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines @@ -44,6 +49,7 @@ extends: VersionPolicyName: rush StageName: BumpRushVersions StageDisplayName: 'Bump Rush Versions and Create PR' + CheckoutRepository: rushstackGitHubApp FeatureBranch: 'automated/bump-versions-rush' PrTitle: 'Bump Rush package versions' PrDescription: | diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml index 9b252348ab..24ae85e01a 100644 --- a/common/config/azure-pipelines/npm-publish.yaml +++ b/common/config/azure-pipelines/npm-publish.yaml @@ -29,6 +29,11 @@ resources: type: git name: 1ESPipelineTemplates/1ESPipelineTemplates ref: refs/tags/release + - repository: rushstackGitHubApp + type: github + name: microsoft/rushstack + endpoint: GitHubProjects + ref: refs/heads/main extends: template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines @@ -44,6 +49,7 @@ extends: VersionPolicyName: noRush StageName: BumpRushstackVersions StageDisplayName: 'Bump Rushstack Versions and Create PR' + CheckoutRepository: rushstackGitHubApp FeatureBranch: 'automated/bump-versions-rushstack' PrTitle: 'Bump Rushstack package versions' PrDescription: | diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index 3dc1291c8c..f1c22673df 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -12,6 +12,9 @@ parameters: type: string - name: StageDisplayName type: string + - name: CheckoutRepository + type: string + default: self - name: FeatureBranch type: string - name: PrTitle @@ -50,12 +53,19 @@ stages: targetPath: $(Build.ArtifactStagingDirectory)/package-versions artifactName: package-versions steps: - - checkout: self + # Keep the repository at the traditional single-checkout location so existing scripts and + # $(Build.SourcesDirectory) continue to resolve to the Rush Stack repository root. + - checkout: ${{ parameters.CheckoutRepository }} + path: s persistCredentials: true - template: /common/config/azure-pipelines/templates/configure-git-user.yaml@self - bash: | + # Repository resources resolve independently from the self trigger. Restore the exact + # commit that selected this pipeline YAML before creating the automated branch. + git fetch --no-tags origin "$(Build.SourceVersion)" + git checkout --detach "$(Build.SourceVersion)" git checkout -b ${{ parameters.FeatureBranch }} echo "Created feature branch: ${{ parameters.FeatureBranch }}" displayName: 'Create Feature Branch' From 8fb1f83b9ca589911568272d51d0faa939b14c6b Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:09:17 -0700 Subject: [PATCH 2/8] Include GitHub App checkout in SDL scanning Declare the new repository resource to the 1ES pipeline template so YAML preview and source analysis accept the checkout. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- common/config/azure-pipelines/npm-publish-rush.yaml | 4 ++++ common/config/azure-pipelines/npm-publish.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/common/config/azure-pipelines/npm-publish-rush.yaml b/common/config/azure-pipelines/npm-publish-rush.yaml index e76a5f45f9..942b256ac7 100644 --- a/common/config/azure-pipelines/npm-publish-rush.yaml +++ b/common/config/azure-pipelines/npm-publish-rush.yaml @@ -40,6 +40,10 @@ extends: parameters: settings: networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny + sdl: + sourceRepositoriesToScan: + include: + - repository: rushstackGitHubApp pool: name: Azure-Pipelines-1ESPT-ExDShared os: windows diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml index 24ae85e01a..7d59c64c23 100644 --- a/common/config/azure-pipelines/npm-publish.yaml +++ b/common/config/azure-pipelines/npm-publish.yaml @@ -40,6 +40,10 @@ extends: parameters: settings: networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny + sdl: + sourceRepositoriesToScan: + include: + - repository: rushstackGitHubApp pool: name: Azure-Pipelines-1ESPT-ExDShared os: windows From 198d0e15f6b231a7a373a8f1759772c0cce38c61 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:19:31 -0700 Subject: [PATCH 3/8] Rely on the standard single-checkout path Azure Pipelines already places the sole repository checkout at Build.SourcesDirectory, so no explicit path override is needed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../config/azure-pipelines/templates/bump-versions-stages.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index f1c22673df..d0431f9e13 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -53,10 +53,7 @@ stages: targetPath: $(Build.ArtifactStagingDirectory)/package-versions artifactName: package-versions steps: - # Keep the repository at the traditional single-checkout location so existing scripts and - # $(Build.SourcesDirectory) continue to resolve to the Rush Stack repository root. - checkout: ${{ parameters.CheckoutRepository }} - path: s persistCredentials: true - template: /common/config/azure-pipelines/templates/configure-git-user.yaml@self From 90d7b39fdd5929aa8862e624f207d9d8c42a79ff Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:25:18 -0700 Subject: [PATCH 4/8] Generate change files for version bump dependencies Add none-type change files for downstream dependency range updates so automated bump PRs pass rush change --verify. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../templates/bump-versions-stages.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index d0431f9e13..9d7395f3fd 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -92,6 +92,16 @@ stages: fi displayName: 'Commit Version Bumps' + - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self + parameters: + Arguments: > + change + --bulk + --bump-type none + --commit-message "chore: generate change files for version bump" + DisplayName: 'Generate change files' + Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js' displayName: 'Prepublish workaround for rush-lib' From 472300f74854717923b318fc3b6471d9ce9586f2 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:25:59 -0700 Subject: [PATCH 5/8] Verify generated version bump change files Run the same change-file validation as CI before publishing artifacts or pushing the automated branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../azure-pipelines/templates/bump-versions-stages.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index 9d7395f3fd..cabc237130 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -102,6 +102,14 @@ stages: DisplayName: 'Generate change files' Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self + parameters: + Arguments: > + change + --verify + DisplayName: 'Verify generated change files' + Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js' displayName: 'Prepublish workaround for rush-lib' From 37efe493c06ba2a1a72291ef8d356c71812f9dd9 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:37:17 -0700 Subject: [PATCH 6/8] Keep version bump change handling unchanged Remove the exploratory change-file generation and verification steps so this PR remains scoped to GitHub App identity. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../templates/bump-versions-stages.yaml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index cabc237130..d0431f9e13 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -92,24 +92,6 @@ stages: fi displayName: 'Commit Version Bumps' - - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self - parameters: - Arguments: > - change - --bulk - --bump-type none - --commit-message "chore: generate change files for version bump" - DisplayName: 'Generate change files' - Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" - - - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self - parameters: - Arguments: > - change - --verify - DisplayName: 'Verify generated change files' - Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" - - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js' displayName: 'Prepublish workaround for rush-lib' From c2a8e77d6ec37ca7323413ce45c7d5a86c660260 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:25:18 -0700 Subject: [PATCH 7/8] Generate change files for version bump dependencies Add none-type change files for downstream dependency range updates so automated bump PRs pass rush change --verify. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../templates/bump-versions-stages.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index d0431f9e13..9d7395f3fd 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -92,6 +92,16 @@ stages: fi displayName: 'Commit Version Bumps' + - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self + parameters: + Arguments: > + change + --bulk + --bump-type none + --commit-message "chore: generate change files for version bump" + DisplayName: 'Generate change files' + Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js' displayName: 'Prepublish workaround for rush-lib' From 3ce49d105c368e84545236aed2db7816981cb990 Mon Sep 17 00:00:00 2001 From: Bharat Middha <5100938+bmiddha@users.noreply.github.com> Date: Fri, 4 Sep 2026 14:25:59 -0700 Subject: [PATCH 8/8] Verify generated version bump change files Run the same change-file validation as CI before publishing artifacts or pushing the automated branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../azure-pipelines/templates/bump-versions-stages.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml index 9d7395f3fd..cabc237130 100644 --- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml +++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml @@ -102,6 +102,14 @@ stages: DisplayName: 'Generate change files' Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self + parameters: + Arguments: > + change + --verify + DisplayName: 'Verify generated change files' + Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))" + - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js' displayName: 'Prepublish workaround for rush-lib'