From 1b883545a7ba518e804bf034bf7b61eb961ba784 Mon Sep 17 00:00:00 2001 From: Gaurav Sharma Date: Mon, 2 Nov 2026 19:29:35 +0530 Subject: [PATCH] FIX: Upgrade ESRP tasks to Node-supported versions Replace Node 16-backed ESRP v5 tasks with v6 across the release build stages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- OneBranchPipelines/stages/build-linux-single-stage.yml | 2 +- OneBranchPipelines/stages/build-macos-single-stage.yml | 2 +- OneBranchPipelines/stages/build-odbc-all-stage.yml | 2 +- OneBranchPipelines/stages/build-windows-single-stage.yml | 2 +- OneBranchPipelines/steps/compound-esrp-code-signing-step.yml | 4 ++-- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/OneBranchPipelines/stages/build-linux-single-stage.yml b/OneBranchPipelines/stages/build-linux-single-stage.yml index 3a383d447..0a05b40bb 100644 --- a/OneBranchPipelines/stages/build-linux-single-stage.yml +++ b/OneBranchPipelines/stages/build-linux-single-stage.yml @@ -514,7 +514,7 @@ stages: # Scans wheel files for malware using Microsoft Defender and custom signatures # Only runs for Official builds (production compliance requirement) - ${{ if eq(parameters.oneBranchType, 'Official') }}: - - task: EsrpMalwareScanning@5 + - task: EsrpMalwareScanning@6 displayName: 'ESRP MalwareScanning - Python Wheels (Official)' inputs: ConnectedServiceName: '$(SigningEsrpConnectedServiceName)' diff --git a/OneBranchPipelines/stages/build-macos-single-stage.yml b/OneBranchPipelines/stages/build-macos-single-stage.yml index 901d93de3..cd4acc020 100644 --- a/OneBranchPipelines/stages/build-macos-single-stage.yml +++ b/OneBranchPipelines/stages/build-macos-single-stage.yml @@ -294,7 +294,7 @@ stages: # Scans wheel files for malware using Microsoft Defender and custom signatures # Only runs for Official builds (production compliance requirement) - ${{ if eq(parameters.oneBranchType, 'Official') }}: - - task: EsrpMalwareScanning@5 + - task: EsrpMalwareScanning@6 displayName: 'ESRP MalwareScanning - Python Wheels (Official)' inputs: ConnectedServiceName: '$(SigningEsrpConnectedServiceName)' diff --git a/OneBranchPipelines/stages/build-odbc-all-stage.yml b/OneBranchPipelines/stages/build-odbc-all-stage.yml index a309a2576..ff4ccc8f4 100644 --- a/OneBranchPipelines/stages/build-odbc-all-stage.yml +++ b/OneBranchPipelines/stages/build-odbc-all-stage.yml @@ -201,7 +201,7 @@ stages: # Scan the redistributed driver binaries + wheels for malware (Official only). - ${{ if eq(parameters.oneBranchType, 'Official') }}: - - task: EsrpMalwareScanning@5 + - task: EsrpMalwareScanning@6 displayName: 'ESRP MalwareScanning - ODBC Wheels (Official)' inputs: ConnectedServiceName: '$(SigningEsrpConnectedServiceName)' diff --git a/OneBranchPipelines/stages/build-windows-single-stage.yml b/OneBranchPipelines/stages/build-windows-single-stage.yml index ec6ae6d37..6db191523 100644 --- a/OneBranchPipelines/stages/build-windows-single-stage.yml +++ b/OneBranchPipelines/stages/build-windows-single-stage.yml @@ -502,7 +502,7 @@ stages: # Scans wheel files for malware using Microsoft Defender and custom signatures # Only runs for Official builds (production compliance requirement) - ${{ if eq(parameters.oneBranchType, 'Official') }}: - - task: EsrpMalwareScanning@5 + - task: EsrpMalwareScanning@6 displayName: 'ESRP MalwareScanning - Python Wheels (Official)' inputs: ConnectedServiceName: '$(SigningEsrpConnectedServiceName)' diff --git a/OneBranchPipelines/steps/compound-esrp-code-signing-step.yml b/OneBranchPipelines/steps/compound-esrp-code-signing-step.yml index 5451d5cf8..f1c18fedd 100644 --- a/OneBranchPipelines/steps/compound-esrp-code-signing-step.yml +++ b/OneBranchPipelines/steps/compound-esrp-code-signing-step.yml @@ -67,7 +67,7 @@ steps: # ----------------------------------------------------------------------------- # 1) Malware scan the native extension before signing (ESRP compliance gate). # ----------------------------------------------------------------------------- - - task: EsrpMalwareScanning@5 + - task: EsrpMalwareScanning@6 displayName: 'ESRP MalwareScanning - Native extension' inputs: ConnectedServiceName: '${{ parameters.esrpConnectedServiceName }}' @@ -84,7 +84,7 @@ steps: # ----------------------------------------------------------------------------- # 2) Authenticode-sign the native extension with CP-230012. # ----------------------------------------------------------------------------- - - task: EsrpCodeSigning@5 + - task: EsrpCodeSigning@6 displayName: 'ESRP CodeSigning - Native extension (.pyd)' inputs: ConnectedServiceName: '${{ parameters.esrpConnectedServiceName }}'