Skip to content

[EngSys] Restrict docs release jobs to public repo only #48123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danieljurek merged 2 commits into from
Mar 5, 2026
Merged

[EngSys] Restrict docs release jobs to public repo only #48123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6af74e4
Initial plan
Copilot Feb 25, 2026
1bc5208
Add public repo condition to docs release jobs
Copilot Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions eng/pipelines/templates/stages/archetype-java-release-batch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,7 +344,7 @@ stages:
- ${{ if eq(parameters.PublicFeedUrl, 'maven.org') }}:
- job: PublishDocsMs
displayName: Docs.MS Release
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'))
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'))
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These conditions only block a single known mirror repo (Azure/azure-sdk-for-java-pr), but still allow docs publishing to run from any other repo name (e.g., other mirrors/renames) if the pipeline is executed there. If the intent is truly “public repo only”, consider switching to an allowlist check (e.g., eq(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java')) or combining both: allowlist the public repo and explicitly exclude known mirrors.

Suggested change
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'))
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), eq(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java'))

Copilot uses AI. Check for mistakes.
dependsOn: PublishDevFeedPackage

pool:
Expand Down Expand Up @@ -382,7 +382,7 @@ stages:

- job: PublishDocs
displayName: Publish Docs to GitHubIO Blob Storage
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'))
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'))
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These conditions only block a single known mirror repo (Azure/azure-sdk-for-java-pr), but still allow docs publishing to run from any other repo name (e.g., other mirrors/renames) if the pipeline is executed there. If the intent is truly “public repo only”, consider switching to an allowlist check (e.g., eq(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java')) or combining both: allowlist the public repo and explicitly exclude known mirrors.

Copilot uses AI. Check for mistakes.
dependsOn: PublishDevFeedPackage
pool:
name: $(WINDOWSPOOL)
Expand Down Expand Up @@ -465,7 +465,7 @@ stages:

- job: PublishDocsToNightlyBranch
dependsOn: PublishPackages
condition: and(succeeded(), or(eq(variables['SetDevVersion'], 'true'), and(eq(variables['Build.Reason'],'Schedule'), eq(variables['System.TeamProject'], 'internal'))))
condition: and(succeeded(), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'), or(eq(variables['SetDevVersion'], 'true'), and(eq(variables['Build.Reason'],'Schedule'), eq(variables['System.TeamProject'], 'internal'))))
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These conditions only block a single known mirror repo (Azure/azure-sdk-for-java-pr), but still allow docs publishing to run from any other repo name (e.g., other mirrors/renames) if the pipeline is executed there. If the intent is truly “public repo only”, consider switching to an allowlist check (e.g., eq(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java')) or combining both: allowlist the public repo and explicitly exclude known mirrors.

Suggested change
condition: and(succeeded(), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'), or(eq(variables['SetDevVersion'], 'true'), and(eq(variables['Build.Reason'],'Schedule'), eq(variables['System.TeamProject'], 'internal'))))
condition: and(succeeded(), eq(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java'), or(eq(variables['SetDevVersion'], 'true'), and(eq(variables['Build.Reason'],'Schedule'), eq(variables['System.TeamProject'], 'internal'))))

Copilot uses AI. Check for mistakes.
pool:
name: $(LINUXPOOL)
image: $(LINUXVMIMAGE)
Expand Down
4 changes: 2 additions & 2 deletions eng/pipelines/templates/stages/archetype-java-release-patch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ stages:

- job: PublishDocsMs
displayName: Docs.MS Release
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'))
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'))
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hardcoded repo name string is repeated across multiple jobs/files. To reduce duplication and future drift, consider defining a single variable/parameter (e.g., PublicRepoName or DocsPublishingAllowedRepo) once in the template and referencing it in conditions, or using a suffix-based check (e.g., not(endsWith(variables['Build.Repository.Name'], '-pr'))) if that better matches the intended policy.

Copilot uses AI. Check for mistakes.
timeoutInMinutes: 180
dependsOn: PublishDevFeedPackage

Expand Down Expand Up @@ -274,7 +274,7 @@ stages:

- job: PublishDocs
displayName: Publish Docs to GitHubIO Blob Storage
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'))
condition: and(succeeded(), ne(variables['Skip.PublishDocs'], 'true'), ne(variables['Build.Repository.Name'], 'Azure/azure-sdk-for-java-pr'))
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hardcoded repo name string is repeated across multiple jobs/files. To reduce duplication and future drift, consider defining a single variable/parameter (e.g., PublicRepoName or DocsPublishingAllowedRepo) once in the template and referencing it in conditions, or using a suffix-based check (e.g., not(endsWith(variables['Build.Repository.Name'], '-pr'))) if that better matches the intended policy.

Copilot uses AI. Check for mistakes.
timeoutInMinutes: 120
dependsOn: PublishESRPPackage
variables:
Expand Down
Loading