[Dan Legg (danlegg)]

Description

Upgrade EsrpCodeSigning@5 to EsrpCodeSigning@6 in the test-bundle, Rust, macOS, and .NET build templates. The v5 task uses Node16; the installed v6 task uses Node20. This keeps signing enabled while moving it to the supported runtime.

The only source changes are five task-version references across four files. Signing inputs, sign/verify/notarization operations, file patterns, service connections, and Windows/official-build conditions remain unchanged.

Dry-run expansion of the official build showed that updating only the bundle and Rust tasks would leave four Node16 signing steps in its macOS and .NET jobs. The macOS template has two signing references; the .NET reference expands once for each target framework. These are included so the same official build does not retain the runtime blocker.

No design spec is required for this CI task runtime upgrade. There are no product, schema, public API, package dependency, or build-command changes.

References

Refs #1662.

Validation

• Parsed all four updated templates as YAML.
• Compared each file against the exact upstream base: only the five task-version replacements, with all other bytes unchanged.
• Compared the parsed structures: inputs, conditions, and all other steps are unchanged.
• Checked the installed ESRP task metadata: v5 uses Node16, v6 uses Node20, and all input names supplied by the upgraded steps are accepted by v6. The pre-existing v6 package-signing step is unchanged.
• Successfully dry-run expanded both consuming producer pipelines against the published PR commit: the bundle pipeline has two ESRP v6 steps and the official build has ten, with no remaining ESRP v5 steps in either expansion.
• Live validation at the exact PR commit passed all eight executions of the upgraded steps: both test bundles, Windows x64/arm64, macOS signing and notarization, and .NET net8.0/net10.0. Their logs confirm ESRP 6.1.1 selecting Node20.
• The complete test-bundle build succeeded. The official build failed in Linux SDK integration tests because native stdio requires Node.js 24.0.0 but those tests ran with 22.23.3; its signing steps succeeded. This is not a claim that the full official build is green.
• No release or package-publication pipeline was queued, and no signing or runtime-policy bypass was introduced.

Docs/skills/memories reconciled against the affected configuration: no canonical documentation or agent-guidance change is needed for these task-version substitutions.

Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Explained why no design spec is required
• Tracking issue remains open pending implementation and pipeline validation
• Documentation and agent-guidance applicability checked
• No Cargo.lock or dependency changes

Issue Type

• Bug fix
• Feature
• Task

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

The ESRP major-version upgrade affects official signing and macOS notarization, which dry-run expansion cannot verify; an authorized maintainer must validate both producer pipelines with live signing before merge.

No open issues 🎉

What changed in this PR

Updates MXC’s Azure pipeline signing tasks to ESRP v6, moving from Node16 to Node20 as requested by #1662 while preserving signing behavior.

Changes:

• Upgrades five task references across the test-bundle, Rust, macOS, and .NET templates.
• Leaves signing inputs, verification and notarization operations, file selection, service connections, and execution conditions unchanged.

Reported validation covers YAML parsing, input compatibility, and pipeline dry-run expansion. Live official signing and publication remain pending.

File	Description
.azure-pipelines/​templates/​Rust.Build.Job.yml	Upgrades official Windows Rust signing to ESRP v6.
.azure-pipelines/​templates/​Mac.Build.Job.yml	Upgrades macOS signing and notarization to ESRP v6.
.azure-pipelines/​templates/​IsolationSession.TestBundle.Build.Job.yml	Upgrades staged test-bundle signing to ESRP v6.
.azure-pipelines/​templates/​DotNet.Build.Job.yml	Upgrades SDK assembly signing for both target frameworks to ESRP v6.

_{Review effort: Balanced}

[Dan Legg (danlegg)]

Agreed that dry-run expansion cannot validate the ESRP major-version upgrade. Both live producer validations are now running at the exact PR commit, covering bundle signing plus Windows, macOS signing/notarization, and .NET signing. Results are pending; I will record the outcome before treating this feedback as satisfied. No release or package-publication pipeline was queued. Also corrected the stale draft-status wording in the description; the PR remains ready for review.

[Dan Legg (danlegg)]

Live validation is complete at the current PR commit. All eight executions of the upgraded steps succeeded: signing both test bundles, Windows x64/arm64 binaries, macOS signing and notarization, and the .NET net8.0/net10.0 assemblies. Each task log confirms ESRP 6.1.1 selecting Node20. The complete test-bundle build also succeeded.

The official build is not fully green: Linux SDK integration tests failed because native stdio requires Node.js 24.0.0, while that job ran with 22.23.3. All upgraded signing steps succeeded; the failure is in unchanged Linux test/runtime configuration, not the signing upgrade. I have kept that separate failure explicit in the PR description rather than widening this five-reference signing change. No release or package-publication pipeline was queued.