[Ramses Sanchez-Hernandez (ramsessanchez)]

A similar PR may already be submitted! Please search among the Pull request before creating one.

Thanks for submitting a pull request! Please provide enough information so that others can review your pull request.

NOTE: PR's will be accepted only in case of appropriate information is provided below

Summary

Migrate .azure-pipelines/ci-build-production.yml to v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates, using the shared 1ES Windows/Linux pool patterns already used by other Graph SDK pipelines.

• Build: retain Windows tests on Node.js 22/24/26 and the Linux production build on Node.js 22. Publish an intermediate sdk-build Pipeline Artifact for inspection. Remove the redundant standalone Karma run because npm test already includes browser tests; publish JUnit results even when tests fail.
• Publish: after a successful Build stage, transfer the exact sdk-build artifact to release-drop without rebuilding. This stage is disabled by default and additionally requires a manual run on main with publishReleaseArtifact enabled. No npm publishing is added.
• Delegate security checks and artifact publication to the official template instead of invoking the legacy security-check step templates. No SDL checks are explicitly disabled.
• Document initial branch validation, required repository/pool authorization, publication controls, and downstream release compatibility checks in CONTRIBUTING.md.

Compatibility: release-drop changes from a Build Artifact to a Pipeline Artifact. Before opting into publication, confirm/update the external release pipeline's artifact download and trigger configuration so build-only runs do not initiate a release. The artifact name and staged file layout remain unchanged.

Motivation

Explain the motivation for making this change. What existing problem does the pull request solve?

Production build 252816 failed organization enforcement because it did not extend an approved 1ES/OneBranch template. Separate, opt-in artifact publication allows the migrated build to be exercised before handing a release artifact to the existing external publishing process.

Test plan

Demonstrate the code is solid. Example: The exact commands you ran and their output.

Local validation used the available Node.js v20.20.2/npm 10.8.2, not the required Node.js 22+ runtime; the pipeline retains its supported-runtime coverage. An attempt to obtain Node.js 22 with npm exec --yes --package=node@22 -- node --version exited 1 without diagnostic output.

• git diff --check — passed.
• python -c "from pathlib import Path; import yaml; p=yaml.safe_load(Path('.azure-pipelines/ci-build-production.yml').read_text()); assert p['extends']['template']=='v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates'; assert [s['stage'] for s in p['extends']['parameters']['stages']]==['Build','Publish']; assert p['parameters'][0]['default'] is False; print('PASS: YAML parses, official template selected, two stages, publication disabled by default')" — passed. Additional local assertions checked the Node matrix, pool OS selection, matching cross-stage artifact names/paths, and publication guard structure; these do not execute Azure's expression engine.
• npm run build — initially failed because dependencies were absent (gulp not found); passed after restoration.
• npm ci --no-audit --no-fund — passed, with an expected unsupported-engine warning for the local Node.js 20 runtime.
• npm run test:cjs -- --reporter dot — passed: 359 tests.
• npm test — Node tests passed; browser tests could not launch because Chrome is not installed locally.
• $env:CHROME_BIN = 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'; npm test — Node tests passed; browser tests remained blocked by Edge capture/profile-lock failures. Full browser coverage is not claimed.

Azure validation still required: manually queue the production pipeline against this PR branch with publishReleaseArtifact: false. Confirm template expansion, repository/pool permissions, Windows Chrome availability, mandatory SDL checks, and the sdk-build artifact. Private Azure DevOps template expansion and a hosted pipeline run could not be performed from this session. Do not enable publication until downstream artifact compatibility is confirmed.

Closing issues

N/A — no linked issue.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Pipeline behavior intentionally changes: automatic main runs no longer publish release-drop, and opted-in publication uses Pipeline Artifacts. SDK API and package versions are unchanged.

Checklist

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.