ci: migrate production pipeline to 1ES with opt-in release artifacts

.azure-pipelines/ci-build-production.yml

@@ -1,88 +1,126 @@
-# Node.js
-# Build a general Node.js project with npm.
-# Add steps that analyze code, save build artifacts, deploy, and more:
-# https://docs.microsoft.com/azure/devops/pipelines/languages/javascript
-
 name: $(BuildDefinitionName)_$(SourceBranchName)_$(Date:yyyyMMdd)$(Rev:.r)
 
+parameters:
+  - name: publishReleaseArtifact
+    displayName: Publish release-drop for the external release pipeline (manual main runs only)
+    type: boolean
+    default: false
+
 trigger:
   branches:
     include:
       - main
 
 pr: none
 
-stages:
-- stage: "Test"
-  jobs:
-  - job:
+resources:
+  repositories:
+    - repository: 1ESPipelineTemplates
+      type: git
+      name: 1ESPipelineTemplates/1ESPipelineTemplates
+      ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
     pool:
-      vmImage: windows-latest
-    strategy:
-      matrix:
-        Node 22:
-          NODE_VERSION: '22.x'
-        Node 24:
-          NODE_VERSION: '24.x'
-        Node 26:
-          NODE_VERSION: '26.x'
-      maxParallel: 2 
-    steps:
-    - template: ./common-templates/security-pre-checks.yml
-    - task: UseNode@1
-      inputs:
-        version: $(NODE_VERSION)
-      displayName: 'Install Node.js'
+      name: Azure-Pipelines-1ESPT-ExDShared
+      image: windows-latest
+      os: windows
 
-    - script: npm ci
-      displayName: 'npm install for tests'
-    - script: npm run build
-      displayName: 'npm build for tests'
-    - script: npm run test
-      displayName: 'Run the node tests'
-    - script: npm run karma
-      displayName: 'Run karma tests'
+    stages:
+      - stage: Build
+        displayName: Build and test SDK
+        jobs:
+          - job: Test
+            displayName: Test supported Node.js versions
+            strategy:
+              matrix:
+                Node22:
+                  NODE_VERSION: '22.x'
+                Node24:
+                  NODE_VERSION: '24.x'
+                Node26:
+                  NODE_VERSION: '26.x'
+              maxParallel: 2
+            steps:
+              - checkout: self
+              - task: UseNode@1
+                inputs:
+                  version: $(NODE_VERSION)
+                displayName: Install Node.js
 
-    - task: PublishTestResults@2
-      displayName: 'Publish Unit Test Results'
-      inputs:
-          testResultsFormat: 'JUnit'
-          testResultsFiles: '**/testResult.xml'
-          failTaskOnFailedTests: true
+              - script: npm ci
+                displayName: Install test dependencies
+              - script: npm run build
+                displayName: Build SDK for tests
+              - script: npm test
+                displayName: Run Node.js and browser tests
 
-    - template: ./common-templates/security-post-checks.yml
+              - task: PublishTestResults@2
+                displayName: Publish unit test results
+                condition: succeededOrFailed()
+                inputs:
+                  testResultsFormat: JUnit
+                  testResultsFiles: '**/testResult.xml'
+                  testRunTitle: Node.js $(NODE_VERSION)
+                  failTaskOnFailedTests: true
 
-- stage: "Build"
-  jobs:
-  - job:
-
-    pool:
-      vmImage: ubuntu-latest
-    steps:
-    - task: UseNode@1
-      inputs:
-        version: '22.x'
-      displayName: 'Install Node.js'
+          - job: BuildPackage
+            displayName: Build production artifact
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            templateContext:
+              outputs:
+                - output: pipelineArtifact
+                  displayName: Publish SDK build for validation
+                  artifactName: sdk-build
+                  targetPath: $(Build.ArtifactStagingDirectory)
+            steps:
+              - checkout: self
+              - task: UseNode@1
+                inputs:
+                  version: '22.x'
+                displayName: Install Node.js
 
-    - script: |
-        npm ci
-        npm run build
-      displayName: 'Build for production artifact'
-    - task: CopyFiles@2
-      inputs:
-        sourceFolder: '$(Build.SourcesDirectory)'
-        targetFolder: $(Build.ArtifactStagingDirectory)
-        Contents: |
-          **/*
-          !.azure-pipelines/**
-          !.github/**
-          !.git/**
-          !.vscode/**
-      displayName: 'Copy npm package'
+              - script: npm ci
+                displayName: Install production build dependencies
+              - script: npm run build
+                displayName: Build production SDK
+              - task: CopyFiles@2
+                inputs:
+                  sourceFolder: $(Build.SourcesDirectory)
+                  targetFolder: $(Build.ArtifactStagingDirectory)
+                  Contents: |
+                    **/*
+                    !.azure-pipelines/**
+                    !.github/**
+                    !.git/**
+                    !.vscode/**
+                displayName: Stage npm package
 
-    - task: PublishBuildArtifacts@1
-      inputs:
-        pathtoPublish: $(Build.ArtifactStagingDirectory)
-        artifactName: "release-drop"
-      displayName: 'Publish artifacts'
-
+      - stage: Publish
+        displayName: Publish release artifact
+        dependsOn: Build
+        condition: and(succeeded(), ${{ eq(parameters.publishReleaseArtifact, true) }}, eq(variables['Build.Reason'], 'Manual'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+        jobs:
+          - job: PublishReleaseArtifact
+            displayName: Publish validated SDK for external release
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
+            templateContext:
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: sdk-build
+                  targetPath: $(Build.ArtifactStagingDirectory)
+              outputs:
+                - output: pipelineArtifact
+                  displayName: Publish release-drop
+                  artifactName: release-drop
+                  targetPath: $(Build.ArtifactStagingDirectory)
+            steps:
+              - checkout: none

CONTRIBUTING.md

@@ -136,6 +136,20 @@ To run linting,
 npm run lint
 ```
 
+#### Production pipeline
+
+The Azure DevOps production pipeline in `.azure-pipelines/ci-build-production.yml` extends `v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates`. The official template manages SDL scanning and artifact publication instead of the legacy security-check step templates.
+
+The **Build** stage tests the SDK on Windows with Node.js 22, 24, and 26, and builds the production SDK on Linux with Node.js 22. It publishes an intermediate `sdk-build` pipeline artifact for inspection. Pushes to `main` run this stage without publishing `release-drop`.
+
+To validate the migration before merging, manually queue **Graph JS SDK Build pipeline** against the PR branch and leave **Publish release-drop for the external release pipeline** unchecked. An Azure DevOps administrator may need to authorize the `1ESPipelineTemplates/1ESPipelineTemplates` repository and the `Azure-Pipelines-1ESPT-ExDShared` pool for this pipeline. Confirm that the pool provides the Windows and Ubuntu images used here, including Chrome for the Windows browser tests, and that the template's SDL checks pass.
+
+After a successful validation and merge, manually queue the pipeline against `main` with **Publish release-drop for the external release pipeline** checked. The separate **Publish** stage runs only after the build and tests succeed, and only for manual runs on `main`. It republishes the same `sdk-build` contents as `release-drop` without rebuilding or installing dependencies. This pipeline does not publish to npm.
+
+`release-drop` is now a Pipeline Artifact rather than the Build Artifact produced by `PublishBuildArtifacts@1`. Before enabling publication, confirm the external release pipeline can download Pipeline Artifacts and triggers only on runs with `release-drop` (not build-only runs with `sdk-build`). Update its artifact download and trigger configuration if needed. The artifact name and staged file layout are unchanged.
+
+#### Commit your changes
+
 The files in `C:\Users\<yourusername>\<repo name>` are a working copy of the new branch that you created in your local repository. Changing anything in this folder doesn't affect the local repository until you commit a change. To commit a change to the local repository, type the following commands in GitBash:
 
     git add .