Prevent scanning/signing of unrelated packages

[samsharma2700]

Description

(Part 1 of 2) OneBranch pipeline jobs download dependency packages from previous stages into packages/, and the build also outputs newly-built NuGet packages into packages/. Since ob_outputDirectory and ESRP signing both operate on packages/ with a *.*nupkg glob, they scan, sign, and upload all packages in the directory, including ones downloaded from previous stages that were already signed.

Solution

Redirect NuGet pack output from packages/ to a new top-level output/ directory, giving each concern its own location:

• packages/: Downloaded NuGets from previous stages (NuGet.config local feed for restore)
• artifacts/: Intermediate build output - DLLs, PDBs (unchanged)
• apiScan/: Signed DLLs/PDBs copied for APIScan (unchanged)
• output/: Built .nupkg/.snupkg - ESRP NuGet signing, ob_outputDirectory, OneBranch artifact upload

Notes

This PR (Part 1) covers the OneBranch official/non-official pipelines, the ones that do ESRP signing, package validation and NuGet releases. It also covers the MSBuild build system (PackagesDir, Clean target) which is shared across both.

Part 2 will cover the CI/PR validation pipelines, the ones that build packages for testing during pull requests and continuous integration, using packagePath and ci-build-nugets-job.yml.

[Copilot]

Pull request overview

This PR changes the build/pipeline directory layout so OneBranch ESRP signing and OneBranch artifact publishing only operate on NuGet packages produced by the current job, avoiding re-scanning/re-signing already-signed dependency packages downloaded from earlier stages.

Changes:

• Redirect NuGet pack output from packages/ to a new repo-root output/ directory (MSBuild + OneBranch pipeline variables/templates).
• Update OneBranch templates to use output/ for ob_outputDirectory and default nuget pack -OutputDirectory.
• Update cleanup and repo ignores to account for the new output/ folder.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/Directory.Build.props	Changes default PackagesDir to $(RepoRoot)output\ so MSBuild PackageOutputPath writes to output/.
eng/pipelines/libraries/common-variables.yml	Updates PACK_OUTPUT to $(REPO_ROOT)/output and documents separation from packages/.
eng/pipelines/common/templates/steps/generate-nuget-package-step.yml	Changes default outputDirectory parameter to $(Build.SourcesDirectory)/output.
eng/pipelines/common/templates/jobs/publish-nuget-package-job.yml	Updates ob_outputDirectory to $(Build.SourcesDirectory)/output.
build.proj	Updates Clean to delete generated *.nupkg/*.snupkg from output/ instead of packages/.
.gitignore	Ignores the new output/ directory.

[cheenamalhotra]

Can you paste link in description to a successful non-official build with this change?

[samsharma2700]

Link to the non-official build : https://sqlclientdrivers.visualstudio.com/ADO.Net/_build/results?buildId=142300&view=results

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.06%. Comparing base (3303d80) to head (3603449).
⚠️ Report is 4 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (3303d80) and HEAD (3603449). Click for more details.

HEAD has 2 uploads less than BASE

Flag	BASE (3303d80)	HEAD (3603449)
CI-SqlClient	2	0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3998      +/-   ##
==========================================
- Coverage   74.38%   67.06%   -7.33%     
==========================================
  Files         287      282       -5     
  Lines       43982    67171   +23189     
==========================================
+ Hits        32717    45048   +12331     
- Misses      11265    22123   +10858     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	67.06% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

[mdaigle]

Looks good. Will also review the unofficial pipeline run before approving.

[paulmedynski]

The Non-Official run's artifacts look better now. Each package's artifacts only contain that package's .nuget files. Well done!

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[samsharma2700]

Latest pipeline run : https://sqlclientdrivers.visualstudio.com/ADO.Net/_build/results?buildId=142444&view=results

[mdaigle]

I do still see extra dlls getting signed in the mds job (for abstractions and logging). Maybe we can correct that in a follow up PR. All other jobs look good.
https://sqlclientdrivers.visualstudio.com/ADO.Net/_build/results?buildId=142444&view=logs&j=67e5cce3-cf4d-502d-4e4e-0012da109ce2&t=faf3e756-f191-5b4b-8a51-37897c063709