[Gaurav Sharma (bewithgaurav)]

Work Item / Issue Reference

AB#49814

---

Summary

Upgrade all five EsrpMalwareScanning tasks and the shared EsrpCodeSigning task from v5 to v6.

The v5 tasks use a Node 16 handler that is blocked by the current agent EOL policy, causing Official Build-Release runs to fail before release artifacts can complete their compliance gates. Version 6 uses a supported Node runtime and is already used by the related mssql-rs release pipelines.

Validation:

• 142 pipeline and runtime-selection tests passed
• 16 tests skipped
• All five modified YAML files parsed successfully
• Definition 2199 Official compile-preview expanded with zero ESRP v5 tasks

[github-actions]

PR Performance Report

✅ No regression detected

No consistent slowdowns detected across all 2 environments.

0 IMPROVEMENTS 0 SLOWDOWNS 2/2 ENVIRONMENTS

Coverage: 2 of 2 environments completed. Advisory result; does not block merging.

Performance diagnostics

Phase times are inclusive diagnostics and must not be added together. They identify where measured time changed, not why it changed.

No affected phases or call-count changes were recorded.

All database tasks and timings

Unix / SQL Server 2022

Database task	Before	After	Paired change	Result
Connection opening	10.023 ms	10.329 ms	+1.2%	no signal
SELECT queries	1.017 ms	0.992 ms	-3.1%	no signal
Row insertion	31.866 ms	31.612 ms	-0.8%	no signal
Executemany inserts	155.786 ms	155.909 ms	+0.5%	no signal
Fetch-all queries	119.001 ms	120.942 ms	+2.0%	no signal
Row-by-row fetching	14.408 ms	14.530 ms	+0.8%	no signal
Batched row fetching	117.556 ms	117.808 ms	+1.0%	no signal
Transaction commit and rollback	105.554 ms	104.072 ms	-0.5%	no signal
Arrow row fetching	89.407 ms	90.138 ms	+0.5%	no signal
100,000-row insertion	434.208 ms	431.588 ms	-0.6%	no signal
Row fetching in batches of 100	121.365 ms	120.868 ms	+0.3%	no signal
Row fetching in batches of 10,000	125.888 ms	137.800 ms	+1.0%	no signal
Repeated positional queries	31.713 ms	31.377 ms	-1.6%	no signal
Repeated named-parameter queries	33.785 ms	33.379 ms	-1.0%	no signal
Legacy 100,000-row insertion	342.137 ms	341.984 ms	-0.7%	no signal
Insertion with explicit input sizes	475.369 ms	475.020 ms	+0.7%	no signal
Joined aggregation queries	180.602 ms	177.626 ms	-1.6%	no signal
Large joined-result fetching	182.664 ms	187.150 ms	+0.5%	no signal
1.2-million-row fetching	3389.739 ms	3384.148 ms	-0.0%	no signal
Common table expression queries	5.298 ms	5.284 ms	+0.4%	no signal
256 KiB VARCHAR(MAX) / fetchall()	1.556 ms	1.335 ms	-13.0%	no signal
10,000 scalar values / fetchval() (debug disabled)	106.696 ms	107.616 ms	+1.0%	no signal

Unix / SQL Server 2025

Database task	Before	After	Paired change	Result
Connection opening	97.948 ms	98.264 ms	-0.0%	no signal
SELECT queries	1.023 ms	1.011 ms	-1.7%	no signal
Row insertion	31.931 ms	31.768 ms	-0.5%	no signal
Executemany inserts	151.378 ms	151.613 ms	+0.8%	no signal
Fetch-all queries	122.169 ms	122.121 ms	+0.1%	no signal
Row-by-row fetching	14.388 ms	14.519 ms	-0.0%	no signal
Batched row fetching	117.609 ms	117.745 ms	-0.7%	no signal
Transaction commit and rollback	106.535 ms	106.693 ms	-0.3%	no signal
Arrow row fetching	88.391 ms	90.435 ms	+2.2%	no signal
100,000-row insertion	424.529 ms	424.933 ms	+0.1%	no signal
Row fetching in batches of 100	123.589 ms	123.809 ms	+0.2%	no signal
Row fetching in batches of 10,000	122.903 ms	126.759 ms	+1.4%	no signal
Repeated positional queries	31.585 ms	31.542 ms	-0.2%	no signal
Repeated named-parameter queries	33.850 ms	33.888 ms	+0.2%	no signal
Legacy 100,000-row insertion	340.318 ms	343.823 ms	+1.0%	no signal
Insertion with explicit input sizes	477.872 ms	479.122 ms	+0.1%	no signal
Joined aggregation queries	162.419 ms	161.768 ms	-0.4%	no signal
Large joined-result fetching	180.677 ms	179.724 ms	-0.5%	no signal
1.2-million-row fetching	3485.466 ms	3472.230 ms	-0.5%	no signal
Common table expression queries	5.027 ms	5.097 ms	+1.4%	no signal
256 KiB VARCHAR(MAX) / fetchall()	2.033 ms	2.009 ms	+14.2%	no signal
10,000 scalar values / fetchval() (debug disabled)	106.179 ms	108.056 ms	+1.6%	no signal

Build and measurement details

ADO build 188309

PR head: 1b883545a7ba518e804bf034bf7b61eb961ba784
Base: 7465c93aedb0465b08899601f8d061384fafc30a
Measured merge: 641042327ab3b6b9c32c6d4d0d0da3980b0c5d2e

• Unix / SQL Server 2022: Python 3.12.3, x86_64, SQL 16.0.4305.5; 5 paired comparisons and 1 warmup.
• Unix / SQL Server 2025: Python 3.12.3, x86_64, SQL 17.0.5035.5; 5 paired comparisons and 1 warmup.

A consistent change requires more than 20% median paired movement, at least 1 ms between the median runtimes, and at least 80% of pairs exceeding the relative threshold in the same direction. A slowdown without enough pair agreement is reported as inconsistent.

The displayed change is the median of paired before-and-after ratios. It is not recalculated from the two displayed median runtimes.

Both revisions use profiling-enabled builds on the same agent and database, with alternating order and discarded warmups. Results are diagnostic and do not represent production-wheel latency.

Raw samples and logs are attached to the ADO run as profiler-* artifacts.

[Copilot]

🔵 Needs a closer look

The ESRP v6 upgrade affects release compliance gates, but compile-preview does not execute these tasks, leaving authentication, malware scanning, and signing unverified in a live pipeline across affected agents.

No open issues 🎉

What changed in this PR

Updates ESRP compliance tasks to v6 to address the Node 16 end-of-life policy blocking Official release builds.

Changes:

• Upgrades all five malware-scanning tasks from v5 to v6.
• Upgrades the shared native-extension code-signing task from v5 to v6.
• Leaves task inputs and execution conditions unchanged.

File	Description
OneBranchPipelines/​steps/​compound-esrp-code-signing-step.yml	Upgrades native-extension scanning and signing tasks to v6.
OneBranchPipelines/​stages/​build-windows-single-stage.yml	Upgrades Official Windows wheel scanning to v6.
OneBranchPipelines/​stages/​build-odbc-all-stage.yml	Upgrades Official ODBC artifact scanning to v6.
OneBranchPipelines/​stages/​build-macos-single-stage.yml	Upgrades Official macOS wheel scanning to v6.
OneBranchPipelines/​stages/​build-linux-single-stage.yml	Upgrades Official Linux wheel scanning to v6.

_{Review effort: Balanced}

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 85%

📈 Total Lines Covered: 9624 out of 11318 📁 Project: mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.performance_counter.hpp: 0.7%
mssql_python.pybind.logger_bridge.cpp: 57.9%
mssql_python.pybind.ddbc_bindings.h: 62.6%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.pybind.connection.connection_pool.cpp: 81.3%
mssql_python.pybind.connection.connection.cpp: 82.5%
mssql_python.logging.py: 86.2%
mssql_python.pooling.py: 90.1%
mssql_python.pybind.fetch_temporal.hpp: 92.1%
mssql_python.cursor.py: 92.5%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report