ci(release): publish NuGet via ESRP and authenticate Hidi Docker restores

[Copilot]

Pull Request

Description

Port microsoft/kiota#8365 to OpenAPI.NET, adapting ESRP publishing and authenticated Docker restores to this repository’s packages and paths.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Other (please describe): Release pipeline configuration

Related Issue(s)

Changes Made

• NuGet publishing: Replace direct publishing with EsrpRelease@14 under openapinet for Microsoft.OpenApi, Microsoft.OpenApi.YamlReader, and Microsoft.OpenApi.Hidi. Retain approvals and deployment dependencies; skip already-published versions.
• Package isolation: Stage each package and its symbols separately, include .snupkg files in the artifact, and replace destructive filtering with explicit exclusions.
• Docker authentication: Pass an XML-escaped private-feed configuration to nightly and release Hidi builds through a BuildKit secret. Keep credentials outside the build context, always clean up, and preserve default sources for local builds.

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• All existing tests pass

Checklist

• My code follows the code style of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Versions applicability

• My change applies to the version 1.X of the library, if so PR link:
• My change applies to the version 2.X of the library, if so PR link:
• My change applies to the version 3.X of the library, if so PR link:
• I have evaluated the applicability of my change against the other versions above.

See the contributing guidelines for more information about how patches are applied across multiple versions.

Additional Notes

Confirm ESRP trusted-publishing onboarding for all three package IDs before production release.

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall line coverage in commit 8ed2fbc in the copilot/replicate-ch... branch is 61%. The line coverage in commit c719c42 in the main branch is 32%.

Show a line coverage summary of the most impacted files.

File	main c719c42	copilot/replicate-ch... 8ed2fbc	+/-
/_/src/Humanize...lePrefixSort.cs	0%	0%	0%
/_/src/Humanize...tes/ByteRate.cs	0%	0%	0%
/_/src/Humanize...tes/ByteSize.cs	0%	0%	0%
/_/src/Humanize...zeExtensions.cs	0%	0%	0%
/_/src/Humanize...ngExtensions.cs	0%	0%	0%
/_/src/Humanize...zeExtensions.cs	0%	0%	0%
/_/src/Humanize...tterRegistry.cs	0%	0%	0%
/_/src/Humanize...orExtensions.cs	0%	4%	+4%
/_/src/Humanize...s/Vocabulary.cs	0%	68%	+68%
/_/src/Humanize...Vocabularies.cs	0%	100%	+100%

---

_{Updated October 09, 2026 13:12 UTC}

[Copilot]

🟡 Changes recommended

The duplicate-version check queries the private restore feed instead of the NuGet.org publication target.

1 open finding

• Check NuGet.org for duplicate releases instead of the private feed · New

What changed in this PR

Migrates NuGet releases to ESRP and authenticates Hidi container restores.

Changes:

• Stages packages and symbols separately for ESRP publishing.
• Adds duplicate-version checks.
• Supplies private-feed credentials through BuildKit secrets.

File	Description
.azure-pipelines/​ci-build.yml	Configures ESRP releases and Docker authentication.
Dockerfile	Mounts the NuGet configuration as a secret.
scripts/​checkNuGetVersion.ps1	Checks whether package versions already exist.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud