From b5736df5e07ee801075f84451313d39d5ff4e335 Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Fri, 9 Oct 2026 07:44:20 -0700
Subject: [PATCH] fix(ci): hand off hidi Docker context through a pipeline
 artifact

Stage only required hidi and OData sources, build files, and public signing keys. Consume the context without release checkout and use the existing protected Docker deployment environment. Keep publishing disabled.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 7410eba7-e02c-4628-aeb3-dca59d99f3f1
---
 .azure-pipelines/hidi-release.yml    | 40 +++++++++++++++++++++++++---
 src/Microsoft.OpenApi.Hidi/readme.md |  7 +++++
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml
index b746bfe3f..67fde2b09 100644
--- a/.azure-pipelines/hidi-release.yml
+++ b/.azure-pipelines/hidi-release.yml
@@ -43,7 +43,34 @@ extends:
                 - output: pipelineArtifact
                   artifactName: Hidi
                   targetPath: '$(Build.ArtifactStagingDirectory)\hidi'
+                - output: pipelineArtifact
+                  artifactName: HidiDockerContext
+                  targetPath: '$(Build.ArtifactStagingDirectory)\HidiDockerContext'
             steps:
+              - task: CopyFiles@2
+                displayName: Stage public-only hidi Docker context
+                inputs:
+                  SourceFolder: '$(Build.SourcesDirectory)'
+                  Contents: |
+                    src\Microsoft.OpenApi.Hidi\**
+                    src\Microsoft.OpenApi.OData.Reader\**
+                    src\Build.props
+                    Build.props
+                    Directory.Build.props
+                    global.json
+                    build.root
+                    README.md
+                    Dockerfile
+                    .dockerignore
+                    !**\bin\**
+                    !**\obj\**
+                    !**\.git\**
+                    !**\artifacts\**
+                    !**\*.snk
+                    tool\Microsoft.OpenApi.Hidi.public.snk
+                    tool\Microsoft.OpenApi.OData.public.snk
+                  TargetFolder: '$(Build.ArtifactStagingDirectory)\HidiDockerContext'
+                  CleanTargetFolder: true
               - task: UseDotNet@2
                 displayName: Use .NET 6 for ESRP
                 inputs:
@@ -221,16 +248,19 @@ extends:
             templateContext:
               type: releaseJob
               isProduction: true
-            environment: hidi-container
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: HidiDockerContext
+                  targetPath: '$(Pipeline.Workspace)/HidiDockerContext'
+            environment: docker-images-deploy
             strategy:
               runOnce:
                 deploy:
                   pool:
                     vmImage: ubuntu-latest
                   steps:
-                    - checkout: self
                     - pwsh: |
-                        $version = ([xml](Get-Content src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj)).Project.PropertyGroup.Version
+                        $version = ([xml](Get-Content -LiteralPath '$(Pipeline.Workspace)/HidiDockerContext/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj')).Project.PropertyGroup.Version
                         if ('$(Build.SourceBranch)' -ne "refs/tags/hidi-v$version") { throw "Hidi tag does not match project version." }
                         if ([version]($version -split '-')[0] -le [version]'2.12.2') { throw "Do not republish the migration baseline or an older hidi version." }
                         Write-Host "##vso[task.setvariable variable=HidiReleaseVersion]$version"
@@ -241,12 +271,14 @@ extends:
                         azureSubscription: ACR Images Push Service Connection
                         scriptType: bash
                         scriptLocation: inlineScript
+                        workingDirectory: '$(Pipeline.Workspace)/HidiDockerContext'
                         inlineScript: |
                           set -euo pipefail
                           az acr login --name msgraphprodregistry
                           docker run --privileged --rm tonistiigi/binfmt --install all
                           docker buildx create --use
                           docker buildx build --platform linux/amd64,linux/arm64/v8 \
+                            --file "$(Pipeline.Workspace)/HidiDockerContext/Dockerfile" \
                             --tag "msgraphprodregistry.azurecr.io/public/openapi/hidi:$(HidiReleaseVersion)" \
                             --tag "msgraphprodregistry.azurecr.io/public/openapi/hidi:latest" \
-                            --push .
+                            --push "$(Pipeline.Workspace)/HidiDockerContext"
diff --git a/src/Microsoft.OpenApi.Hidi/readme.md b/src/Microsoft.OpenApi.Hidi/readme.md
index 498778845..15e267fd4 100644
--- a/src/Microsoft.OpenApi.Hidi/readme.md
+++ b/src/Microsoft.OpenApi.Hidi/readme.md
@@ -79,6 +79,13 @@ Docker builds opt into `HidiPublicSignBuild=true` for the local OData project,
 using its own public-only key without changing normal OData signing behavior.
 Private `.snk` resources are excluded from the Docker context.
 
+The official pipeline stages a separate `HidiDockerContext` pipeline artifact
+in the build job. It contains only the hidi and OData reader sources, required
+build and Docker files, and the two public-only signing keys; build outputs and
+private keys are excluded. The container release job consumes this artifact as
+a 1ES input without checking out the repository. NuGet and Windows release
+artifacts continue to use the separate `Hidi` artifact.
+
 The gated official pipeline retains the consumer image
 `mcr.microsoft.com/openapi/hidi`, backed by
 `msgraphprodregistry.azurecr.io/public/openapi/hidi`. Stable images use `latest`