fix(ci): use a safe artifact for the hidi container release handoff

.azure-pipelines/hidi-release.yml

@@ -43,7 +43,34 @@ extends:
                 - output: pipelineArtifact
                   artifactName: Hidi
                   targetPath: '$(Build.ArtifactStagingDirectory)\hidi'
+                - output: pipelineArtifact
+                  artifactName: HidiDockerContext
+                  targetPath: '$(Build.ArtifactStagingDirectory)\HidiDockerContext'
             steps:
+              - task: CopyFiles@2
+                displayName: Stage public-only hidi Docker context
+                inputs:
+                  SourceFolder: '$(Build.SourcesDirectory)'
+                  Contents: |
+                    src\Microsoft.OpenApi.Hidi\**
+                    src\Microsoft.OpenApi.OData.Reader\**
+                    src\Build.props
+                    Build.props
+                    Directory.Build.props
+                    global.json
+                    build.root
+                    README.md
+                    Dockerfile
+                    .dockerignore
+                    !**\bin\**
+                    !**\obj\**
+                    !**\.git\**
+                    !**\artifacts\**
+                    !**\*.snk
+                    tool\Microsoft.OpenApi.Hidi.public.snk
+                    tool\Microsoft.OpenApi.OData.public.snk
+                  TargetFolder: '$(Build.ArtifactStagingDirectory)\HidiDockerContext'
+                  CleanTargetFolder: true
               - task: UseDotNet@2
                 displayName: Use .NET 6 for ESRP
                 inputs:
@@ -221,16 +248,19 @@ extends:
             templateContext:
               type: releaseJob
               isProduction: true
-            environment: hidi-container
+              inputs:
+                - input: pipelineArtifact
+                  artifactName: HidiDockerContext
+                  targetPath: '$(Pipeline.Workspace)/HidiDockerContext'
+            environment: docker-images-deploy
             strategy:
               runOnce:
                 deploy:
                   pool:
                     vmImage: ubuntu-latest
                   steps:
-                    - checkout: self
                     - pwsh: |
-                        $version = ([xml](Get-Content src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj)).Project.PropertyGroup.Version
+                        $version = ([xml](Get-Content -LiteralPath '$(Pipeline.Workspace)/HidiDockerContext/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj')).Project.PropertyGroup.Version
                         if ('$(Build.SourceBranch)' -ne "refs/tags/hidi-v$version") { throw "Hidi tag does not match project version." }
                         if ([version]($version -split '-')[0] -le [version]'2.12.2') { throw "Do not republish the migration baseline or an older hidi version." }
                         Write-Host "##vso[task.setvariable variable=HidiReleaseVersion]$version"
@@ -241,12 +271,14 @@ extends:
                         azureSubscription: ACR Images Push Service Connection
                         scriptType: bash
                         scriptLocation: inlineScript
+                        workingDirectory: '$(Pipeline.Workspace)/HidiDockerContext'
                         inlineScript: |
                           set -euo pipefail
                           az acr login --name msgraphprodregistry
                           docker run --privileged --rm tonistiigi/binfmt --install all
                           docker buildx create --use
                           docker buildx build --platform linux/amd64,linux/arm64/v8 \
+                            --file "$(Pipeline.Workspace)/HidiDockerContext/Dockerfile" \
                             --tag "msgraphprodregistry.azurecr.io/public/openapi/hidi:$(HidiReleaseVersion)" \
                             --tag "msgraphprodregistry.azurecr.io/public/openapi/hidi:latest" \
-                            --push .
+                            --push "$(Pipeline.Workspace)/HidiDockerContext"

src/Microsoft.OpenApi.Hidi/readme.md

@@ -79,6 +79,13 @@ Docker builds opt into `HidiPublicSignBuild=true` for the local OData project,
 using its own public-only key without changing normal OData signing behavior.
 Private `.snk` resources are excluded from the Docker context.
 
+The official pipeline stages a separate `HidiDockerContext` pipeline artifact
+in the build job. It contains only the hidi and OData reader sources, required
+build and Docker files, and the two public-only signing keys; build outputs and
+private keys are excluded. The container release job consumes this artifact as
+a 1ES input without checking out the repository. NuGet and Windows release
+artifacts continue to use the separate `Hidi` artifact.
+
 The gated official pipeline retains the consumer image
 `mcr.microsoft.com/openapi/hidi`, backed by
 `msgraphprodregistry.azurecr.io/public/openapi/hidi`. Stable images use `latest`