From 413e39d36eba08f65f29eac7fc60e72d2c9c9b64 Mon Sep 17 00:00:00 2001
From: Saransh Sharma <sarasharma@microsoft.com>
Date: Wed, 4 Mar 2026 09:38:09 -0800
Subject: [PATCH 1/5] Isolate built nuget packages

---
 .gitignore                                                 | 1 +
 build.proj                                                 | 6 +++---
 .../common/templates/jobs/publish-nuget-package-job.yml    | 2 +-
 .../common/templates/steps/generate-nuget-package-step.yml | 2 +-
 eng/pipelines/libraries/common-variables.yml               | 7 ++++---
 src/Directory.Build.props                                  | 2 +-
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index b5dc09c716..52caa0a353 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,6 +65,7 @@ BenchmarkDotNet.Artifacts/
 project.lock.json
 project.fragment.lock.json
 artifacts/
+output/
 
 # StyleCop
 StyleCopReport.xml
diff --git a/build.proj b/build.proj
index ac5fd03c03..a13a1635ed 100644
--- a/build.proj
+++ b/build.proj
@@ -483,10 +483,10 @@
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "bin", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", ".nuget", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "obj", SearchOption.AllDirectories))' />
-    <!-- We keep packages/ but remove all of the generated files. -->
+    <!-- We keep packages/ but remove all of the generated files in the output directory. -->
     <ItemGroup>
-      <PackagesToDelete Include="$(RepoRoot)/packages/*.nupkg" />
-      <PackagesToDelete Include="$(RepoRoot)/packages/*.snupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.nupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.snupkg" />
     </ItemGroup>
     <Delete Files="@(PackagesToDelete)" />
   </Target>
diff --git a/eng/pipelines/common/templates/jobs/publish-nuget-package-job.yml b/eng/pipelines/common/templates/jobs/publish-nuget-package-job.yml
index 3d194cfb97..e7f4c6655a 100644
--- a/eng/pipelines/common/templates/jobs/publish-nuget-package-job.yml
+++ b/eng/pipelines/common/templates/jobs/publish-nuget-package-job.yml
@@ -62,7 +62,7 @@ jobs:
 
     variables:
       - name: ob_outputDirectory
-        value: $(Build.SourcesDirectory)/packages
+        value: $(Build.SourcesDirectory)/output
 
     pool:
       type: release
diff --git a/eng/pipelines/common/templates/steps/generate-nuget-package-step.yml b/eng/pipelines/common/templates/steps/generate-nuget-package-step.yml
index 6e51adeeb6..46c5c61492 100644
--- a/eng/pipelines/common/templates/steps/generate-nuget-package-step.yml
+++ b/eng/pipelines/common/templates/steps/generate-nuget-package-step.yml
@@ -12,7 +12,7 @@ parameters:
 
   - name: outputDirectory
     type: string
-    default: '$(Build.SourcesDirectory)/packages'
+    default: '$(Build.SourcesDirectory)/output'
 
   # The C# build configuration (e.g. Debug or Release) to use when building the NuGet package.
   - name: buildConfiguration
diff --git a/eng/pipelines/libraries/common-variables.yml b/eng/pipelines/libraries/common-variables.yml
index 4037feea25..97e3694f4c 100644
--- a/eng/pipelines/libraries/common-variables.yml
+++ b/eng/pipelines/libraries/common-variables.yml
@@ -32,10 +32,11 @@ variables:
   - name: BUILD_OUTPUT
     value: $(REPO_ROOT)/artifacts
 
-  # THis is where our C# projects place their NuGet package outputs (see Directory.Build.props
-  # <PackagesDir>).
+  # This is where our C# projects place their NuGet package outputs.  This is intentionally
+  # separate from packages/ (where downloaded pipeline artifacts go) so that ESRP signing and
+  # OneBranch artifact publishing only operate on packages built by the current job.
   - name: PACK_OUTPUT
-    value: $(REPO_ROOT)/packages
+    value: $(REPO_ROOT)/output
 
   # C# assembly versions must be in the format: Major.Minor.Build.Revision, but
   # $(Build.BuildNumber) has the format XXX.YY.  Additionally, each version part
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
index 5152ce6065..1cd4c3b5ab 100644
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@@ -55,7 +55,7 @@
     <BinFolder Condition="'$(TargetsUnix)' == 'true'">$(Artifacts)bin\Unix\</BinFolder>
     <ToolsDir Condition="'$(ToolsDir)'==''">$(RepoRoot)tools\</ToolsDir>
     <GenAPISrcDir Condition="'$(GenAPISrcDir)'==''">$(ToolsDir)GenAPI\</GenAPISrcDir>
-    <PackagesDir Condition="'$(PackagesDir)'==''">$(RepoRoot)packages\</PackagesDir>
+    <PackagesDir Condition="'$(PackagesDir)'==''">$(RepoRoot)output\</PackagesDir>
     <NuGetRoot Condition="'$(NuGetRoot)' == ''">$(RepoRoot).nuget\</NuGetRoot>
     <NuGetCmd>$(NuGetRoot)nuget.exe</NuGetCmd>
     <!-- Respect environment variable for the .NET install directory if set; otherwise, use the current default location -->

From cd8c910d35963a453034994e825586cb14a40c31 Mon Sep 17 00:00:00 2001
From: Saransh Sharma <sarasharma@microsoft.com>
Date: Wed, 4 Mar 2026 11:52:01 -0800
Subject: [PATCH 2/5] Feedback update

---
 build.proj                                                  | 4 +++-
 eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml | 1 +
 src/Directory.Build.props                                   | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/build.proj b/build.proj
index 4dd2d3f6fc..f7ab4112e3 100644
--- a/build.proj
+++ b/build.proj
@@ -484,8 +484,10 @@
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "bin", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", ".nuget", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "obj", SearchOption.AllDirectories))' />
-    <!-- We keep packages/ but remove all of the generated files in the output directory. -->
+    <!-- Remove generated .nupkg and .snupkg files from packages/ and output/. -->
     <ItemGroup>
+      <PackagesToDelete Include="$(RepoRoot)/packages/*.nupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/packages/*.snupkg" />
       <PackagesToDelete Include="$(RepoRoot)/output/*.nupkg" />
       <PackagesToDelete Include="$(RepoRoot)/output/*.snupkg" />
     </ItemGroup>
diff --git a/eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml b/eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml
index 5198b405e3..db9b9a8237 100644
--- a/eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml
+++ b/eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml
@@ -35,6 +35,7 @@ steps:
       msbuildArguments: >-
           -t:${{ parameters.packTarget }}
           -p:ReferenceType=Package
+          -p:PackagesDir=$(PACK_OUTPUT)/
           ${{ parameters.versionProperties }}
 
   - script: tree /a /f $(PACK_OUTPUT)
diff --git a/src/Directory.Build.props b/src/Directory.Build.props
index 1cd4c3b5ab..5152ce6065 100644
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@@ -55,7 +55,7 @@
     <BinFolder Condition="'$(TargetsUnix)' == 'true'">$(Artifacts)bin\Unix\</BinFolder>
     <ToolsDir Condition="'$(ToolsDir)'==''">$(RepoRoot)tools\</ToolsDir>
     <GenAPISrcDir Condition="'$(GenAPISrcDir)'==''">$(ToolsDir)GenAPI\</GenAPISrcDir>
-    <PackagesDir Condition="'$(PackagesDir)'==''">$(RepoRoot)output\</PackagesDir>
+    <PackagesDir Condition="'$(PackagesDir)'==''">$(RepoRoot)packages\</PackagesDir>
     <NuGetRoot Condition="'$(NuGetRoot)' == ''">$(RepoRoot).nuget\</NuGetRoot>
     <NuGetCmd>$(NuGetRoot)nuget.exe</NuGetCmd>
     <!-- Respect environment variable for the .NET install directory if set; otherwise, use the current default location -->

From 3fb28233ffed7b8a39abae985b7b81e43b26a5f4 Mon Sep 17 00:00:00 2001
From: Saransh Sharma <sarasharma@microsoft.com>
Date: Wed, 4 Mar 2026 15:01:08 -0800
Subject: [PATCH 3/5] Explicitly download Abstractions

---
 .../onebranch/jobs/build-akv-official-job.yml       | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/eng/pipelines/onebranch/jobs/build-akv-official-job.yml b/eng/pipelines/onebranch/jobs/build-akv-official-job.yml
index 51d8d85964..8c75295f0d 100644
--- a/eng/pipelines/onebranch/jobs/build-akv-official-job.yml
+++ b/eng/pipelines/onebranch/jobs/build-akv-official-job.yml
@@ -101,15 +101,22 @@ jobs:
                 $jsonParams | ConvertFrom-Json | Format-List
             displayName: 'Output Job Parameters'
 
-          # Download SqlClient (MDS) and Logging packages from previous stages into
-          # packages/ so that they're available via the local NuGet feed when restoring.
-          # AKV Provider depends on both SqlClient and Extensions.Logging.
+          # Download SqlClient (MDS), Abstractions, and Logging packages from previous
+          # stages into packages/ so that they're available via the local NuGet feed
+          # when restoring.  AKV Provider depends on SqlClient, which transitively
+          # requires Extensions.Abstractions and Extensions.Logging.
           - task: DownloadPipelineArtifact@2
             displayName: Download SqlClient Package
             inputs:
                 artifactName: $(sqlClientArtifactsName)
                 targetPath: $(Build.SourcesDirectory)/packages
 
+          - task: DownloadPipelineArtifact@2
+            displayName: Download Abstractions Package
+            inputs:
+                artifactName: $(abstractionsArtifactsName)
+                targetPath: $(Build.SourcesDirectory)/packages
+
           - task: DownloadPipelineArtifact@2
             displayName: Download Logging Package
             inputs:

From bb217068081b1a6c0dcfb836649a8e9b2502e47b Mon Sep 17 00:00:00 2001
From: Saransh Sharma <sarasharma@microsoft.com>
Date: Wed, 4 Mar 2026 15:27:25 -0800
Subject: [PATCH 4/5] Ensure output directory exists

---
 eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml   | 5 +++++
 eng/pipelines/onebranch/steps/compound-build-csproj-step.yml | 3 ---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml b/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
index 3eaf5657b6..f0890f1bd4 100644
--- a/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
+++ b/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
@@ -87,6 +87,11 @@ jobs:
 
     steps:
 
+      # ob_outputDirectory must exist for OneBranch even though this job doesn't
+      # produce any new artifacts.
+      - pwsh: New-Item -ItemType Directory -Force -Path "$(ob_outputDirectory)" | Out-Null
+        displayName: Ensure output directory exists
+
       # Artifacts are downloaded via templateContext.inputs per OneBranch requirements.
 
       - ${{ if eq(parameters.isDryRun, true) }}:
diff --git a/eng/pipelines/onebranch/steps/compound-build-csproj-step.yml b/eng/pipelines/onebranch/steps/compound-build-csproj-step.yml
index 7d0d04c079..1f1fee00c4 100644
--- a/eng/pipelines/onebranch/steps/compound-build-csproj-step.yml
+++ b/eng/pipelines/onebranch/steps/compound-build-csproj-step.yml
@@ -48,6 +48,3 @@ steps:
 
   - script: tree /a /f $(BUILD_OUTPUT)
     displayName: List Build Output Tree
-
-  - script: tree /a /f $(PACK_OUTPUT)
-    displayName: List Pack Output Tree

From 3603449d879b58848385ba96d7778b9da150a48d Mon Sep 17 00:00:00 2001
From: Saransh Sharma <sarasharma@microsoft.com>
Date: Thu, 5 Mar 2026 08:57:35 -0800
Subject: [PATCH 5/5] Consolidate directory creation

---
 .gitignore                                                 | 5 ++++-
 eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml | 5 -----
 output/.gitkeep                                            | 1 +
 3 files changed, 5 insertions(+), 6 deletions(-)
 create mode 100644 output/.gitkeep

diff --git a/.gitignore b/.gitignore
index 52caa0a353..3597befb53 100644
--- a/.gitignore
+++ b/.gitignore
@@ -65,7 +65,6 @@ BenchmarkDotNet.Artifacts/
 project.lock.json
 project.fragment.lock.json
 artifacts/
-output/
 
 # StyleCop
 StyleCopReport.xml
@@ -199,6 +198,10 @@ PublishScripts/
 **/[Pp]ackages/*
 !**/[Pp]ackages/.gitkeep
 
+# Most of the output folder can be ignored.
+**/[Oo]utput/*
+!**/[Oo]utput/.gitkeep
+
 # NuGet v3's project.json files produces more ignorable files
 *.nuget.props
 *.nuget.targets
diff --git a/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml b/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
index f0890f1bd4..3eaf5657b6 100644
--- a/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
+++ b/eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml
@@ -87,11 +87,6 @@ jobs:
 
     steps:
 
-      # ob_outputDirectory must exist for OneBranch even though this job doesn't
-      # produce any new artifacts.
-      - pwsh: New-Item -ItemType Directory -Force -Path "$(ob_outputDirectory)" | Out-Null
-        displayName: Ensure output directory exists
-
       # Artifacts are downloaded via templateContext.inputs per OneBranch requirements.
 
       - ${{ if eq(parameters.isDryRun, true) }}:
diff --git a/output/.gitkeep b/output/.gitkeep
new file mode 100644
index 0000000000..3da8f2b5b0
--- /dev/null
+++ b/output/.gitkeep
@@ -0,0 +1 @@
+# This directory must exist for OneBranch pipelines that set ob_outputDirectory to output/.