From f1e8513d8c6e2c604b43cc775c4360327536729b Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Thu, 8 Oct 2026 13:12:03 +0100 Subject: [PATCH] release: speed up PME approval for release builds Due to the multi-staged setup of our release builds, when we are doing ESRP signing we only get prompted to approve via a PME account when we reach the second stage of the pipeline (build+sign). There is often a long delay to this because stage one agent provisioning can take a long time, meaning the person queuing the pipeline must wait around until the PME approval is triggered at the start of stage two. Once approval has been granted for any stage of the pipeline, the rest can use the same approval. Let's add an arbitrary task to the first stage that would trigger the PME approval - anything that uses the ESRP service connection - so the person queuing the pipeline can work on the approval right away, rather than wait for the second stage to start. Signed-off-by: Matthew John Cheetham --- .azure-pipelines/release.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml index 5e7d153ff6ab8c..07d274c4933f34 100644 --- a/.azure-pipelines/release.yml +++ b/.azure-pipelines/release.yml @@ -151,6 +151,18 @@ extends: echo "##vso[task.setvariable variable=tag_name;isOutput=true;isReadOnly=true]untagged" echo "##vso[task.setvariable variable=tag_sha;isOutput=true;isReadOnly=true]${tag_sha}" echo "##vso[build.updatebuildnumber][UNTAGGED] ${tag_sha} (${BUILD_BUILDNUMBER:-unknown})" + - ${{ if eq(parameters.esrp, true) }}: + - task: AzureCLI@2 + displayName: 'Prepare ESRP connection' + inputs: + azureSubscription: ${{ parameters.serviceConnectionName }} + addSpnToEnvironment: true + scriptType: ps + scriptLocation: inlineScript + inlineScript: | + Write-Host "ESRP connection details:" + Write-Host "ClientId: $env:servicePrincipalId" + Write-Host "TenantId: $env:tenantId" - stage: build displayName: 'Build'