Migrate Azure DevOps CI/release pipelines to azdo-pipelines v2 (.config model)

[Copilot]

This updates the repo from legacy .azure-pipelines definitions to the new azdo-pipelines model used in recent vscode-containers migrations, while preserving existing CI/release behavior and wiring. It also aligns compliance/config placement with the vscode-azuretools migration guidance.

• Pipeline model migration (.azure-pipelines → .config)

  • Added .config/build.yml using azdo-pipelines/1es-mb-main.yml@azExtTemplates
  • Added .config/release.yml using azdo-pipelines/1es-mb-release-extension.yml@azExtTemplates
  • Kept template source pinned to microsoft/vscode-azuretools azext-pt/v1
  • Preserved existing build/release intent (main/rel triggers, nightly schedule, manual release, build-artifact-driven publish flow)

• Compliance + deprecated legacy cleanup

  • Moved TSA config to .config/tsaoptions.json
  • Removed deprecated legacy files no longer needed with v2 templates:
    • .azure-pipelines/SignExtension.signproj
    • .azure-pipelines/compliance/CredScanSuppressions.json
    • .azure-pipelines/compliance/PoliCheckExclusions.xml

• Packaging/config follow-up

  • Updated .vscodeignore to exclude .config/** (replacing .azure-pipelines/**)

• Repository-specific parity choices

  • Preserved the existing long-running test toggle by conditionally passing testARMServiceConnection from enableLongRunningTests
  • Updated release approval wiring to use ${{ variables.extensionReleaseApprovalEnvironment }}
  • Removed redundant TeamName declarations from build/release pipeline files since they are already provided by azcode.variables.yml
  • Added npmFeed: ${{ variables.npmFeed }} to both build and release template parameters
  • Updated federated-credential detection and service-connection env-var handling in code/tests to support the new FC_SERVICE_CONNECTION_* variables (FC_SERVICE_CONNECTION_NAME, FC_SERVICE_CONNECTION_ID, FC_SERVICE_CONNECTION_TENANT_ID, FC_SERVICE_CONNECTION_CLIENT_ID) while retaining fallback compatibility for legacy AzCode_* env vars where values are consumed

extends:
  template: azdo-pipelines/1es-mb-main.yml@azExtTemplates
  parameters:
    npmFeed: ${{ variables.npmFeed }}
    ${{ if eq(parameters.enableLongRunningTests, true) }}:
      testARMServiceConnection: ${{ variables.testARMServiceConnection }}

• Validation summary
  • Repo-level lint/build scripts complete successfully in this environment.
  • Test script is currently blocked by external VS Code download DNS resolution in the agent environment.

Original prompt

Migrate this repository to the new Azure DevOps pipelines model in the same pattern used by microsoft/vscode-containers PRs #365 and #471. Use these references for implementation details and parity:

• Try out the new pipelines vscode-containers#365
• Use internal NPM feeds vscode-containers#471
• https://github.com/microsoft/vscode-azuretools/blob/main/azdo-pipelines/MIGRATION.md
• https://github.com/microsoft/vscode-azuretools/blob/main/azdo-pipelines/README.md

Scope and expectations:

1. Identify and migrate existing pipeline definitions/templates in this repo to the new azdo-pipelines approach.
2. Apply equivalent structural changes seen in the reference PRs, adapted for this repository.
3. Update any supporting config/docs in-repo that must change due to the pipeline migration.
4. Preserve existing behavior and release/CI intent.
5. Validate by running the repo's relevant checks/tests where feasible in the agent environment.
6. In the PR description, summarize what changed, note any intentional deviations from the reference PRs, and include a brief validation summary.

Constraints:

• Keep changes focused on pipeline migration and directly related follow-up edits.
• Avoid unrelated refactors.
• Ensure YAML and template references are consistent and non-breaking.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• update.code.visualstudio.com
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-azureresourcegroups/vscode-azureresourcegroups/node_modules/.bin/vscode-test (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[bwateratmsft]

@copilot both pipeline files need to use the npmFeed parameter (as in microsoft/vscode-containers#471)

[Copilot]

@copilot both pipeline files need to use the npmFeed parameter (as in microsoft/vscode-containers#471)

Updated in 1e7e925: both .config/build.yml and .config/release.yml now pass npmFeed: ${{ variables.npmFeed }} to the template parameters.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• update.code.visualstudio.com
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-azureresourcegroups/vscode-azureresourcegroups/node_modules/.bin/vscode-test egroups ode-azureresourcegroups (dns block)
  • Triggering command: /usr/local/bin/node node /home/REDACTED/work/vscode-azureresourcegroups/vscode-azureresourcegroups/node_modules/.bin/vscode-test (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[bwateratmsft]

Example build including long-running tests: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14125017&view=results
Example dry-run release: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=14127840&view=results

[Copilot]

Pull request overview

Migrates this repository’s Azure DevOps CI and release pipelines from the legacy .azure-pipelines definitions to the newer azdo-pipelines v2 “.config model”, and updates federated-credentials detection so long-running pipeline tests and subscription provider initialization work with the new FC_SERVICE_CONNECTION_* environment variables.

Changes:

• Added .config/build.yml and .config/release.yml using azdo-pipelines/* templates pinned to microsoft/vscode-azuretools azext-pt/v1, and removed legacy pipeline/compliance/signing files.
• Updated packaging ignore rules to exclude .config/** from the VSIX.
• Updated code/tests to detect federated credentials via FC_SERVICE_CONNECTION_NAME and to read FC_SERVICE_CONNECTION_ID/TENANT_ID/CLIENT_ID (with fallback to legacy AzCode_* env vars).

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/nightly/crud.test.ts	Switches federated-credential detection to FC_SERVICE_CONNECTION_NAME for nightly long-running tests.
test/global.test.ts	Updates long-running test enablement logic to also key off FC_SERVICE_CONNECTION_NAME.
src/services/getSubscriptionProviderFactory.ts	Uses FC_SERVICE_CONNECTION_NAME (plus legacy flag fallback) to decide whether to return the AzDO subscription provider factory.
src/services/AzureDevOpsSubscriptionProvider.ts	Reads FC_SERVICE_CONNECTION_* env vars (with legacy fallback) for AzDO federated credential initialization.
.vscodeignore	Excludes .config/** from the extension package output.
.config/tsaoptions.json	Adds TSA configuration under the new .config location.
.config/build.yml	Introduces new build pipeline definition extending azdo-pipelines/1es-mb-main.yml and wires npmFeed + conditional long-running test service connection.
.config/release.yml	Introduces new manual release pipeline definition extending azdo-pipelines/1es-mb-release-extension.yml and wires release approval/service connections + npmFeed.
.azure-pipelines/SignExtension.signproj	Removed legacy signing project (no longer needed with v2 templates).
.azure-pipelines/release.yml	Removed legacy release pipeline YAML (replaced by .config/release.yml).
.azure-pipelines/compliance/PoliCheckExclusions.xml	Removed legacy compliance exclusion file (handled by new pipeline model).
.azure-pipelines/compliance/CredScanSuppressions.json	Removed legacy cred scan suppressions file (handled by new pipeline model).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.