Prevent scanning/signing of unrelated packages

.gitignore

@@ -198,6 +198,10 @@ PublishScripts/
 **/[Pp]ackages/*
 !**/[Pp]ackages/.gitkeep
 
+# Most of the output folder can be ignored.
+**/[Oo]utput/*
+!**/[Oo]utput/.gitkeep
+
 # NuGet v3's project.json files produces more ignorable files
 *.nuget.props
 *.nuget.targets

build.proj

@@ -344,7 +344,7 @@
       <TestCommand>$([System.Text.RegularExpressions.Regex]::Replace($(TestCommand), "\s+", " "))</TestCommand>
     </PropertyGroup>
     <Message Text=">>> Running unit tests for Windows via command: $(TestCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(TestCommand)"/>
   </Target>
 
   <!-- Run all unit tests applicable to Unix. -->
@@ -445,7 +445,7 @@
       <TestCommand>$([System.Text.RegularExpressions.Regex]::Replace($(TestCommand), "\s+", " "))</TestCommand>
     </PropertyGroup>
     <Message Text=">>> Running Manual test for Windows via command: $(TestCommand)" />
     <Exec ConsoleToMsBuild="true" Command="$(TestCommand)" />
   </Target>
 
   <!-- Run all Manual tests applicable to Unix. -->
@@ -484,10 +484,12 @@
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "bin", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", ".nuget", SearchOption.AllDirectories))' />
     <RemoveDir Directories='$([System.IO.Directory]::GetDirectories(".", "obj", SearchOption.AllDirectories))' />
-    <!-- We keep packages/ but remove all of the generated files. -->
+    <!-- Remove generated .nupkg and .snupkg files from packages/ and output/. -->
     <ItemGroup>
       <PackagesToDelete Include="$(RepoRoot)/packages/*.nupkg" />
       <PackagesToDelete Include="$(RepoRoot)/packages/*.snupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.nupkg" />
+      <PackagesToDelete Include="$(RepoRoot)/output/*.snupkg" />
     </ItemGroup>
     <Delete Files="@(PackagesToDelete)" />
   </Target>

eng/pipelines/common/templates/steps/generate-nuget-package-step.yml

@@ -12,7 +12,7 @@ parameters:
 
   - name: outputDirectory
     type: string
-    default: '$(Build.SourcesDirectory)/packages'
+    default: '$(Build.SourcesDirectory)/output'
 
   # The C# build configuration (e.g. Debug or Release) to use when building the NuGet package.
   - name: buildConfiguration

eng/pipelines/onebranch/jobs/build-akv-official-job.yml

@@ -101,15 +101,22 @@ jobs:
                 $jsonParams | ConvertFrom-Json | Format-List
             displayName: 'Output Job Parameters'
 
-          # Download SqlClient (MDS) and Logging packages from previous stages into
-          # packages/ so that they're available via the local NuGet feed when restoring.
-          # AKV Provider depends on both SqlClient and Extensions.Logging.
+          # Download SqlClient (MDS), Abstractions, and Logging packages from previous
+          # stages into packages/ so that they're available via the local NuGet feed
+          # when restoring.  AKV Provider depends on SqlClient, which transitively
+          # requires Extensions.Abstractions and Extensions.Logging.
           - task: DownloadPipelineArtifact@2
             displayName: Download SqlClient Package
             inputs:
                 artifactName: $(sqlClientArtifactsName)
                 targetPath: $(Build.SourcesDirectory)/packages
 
+          - task: DownloadPipelineArtifact@2
+            displayName: Download Abstractions Package
+            inputs:
+                artifactName: $(abstractionsArtifactsName)
+                targetPath: $(Build.SourcesDirectory)/packages
+
           - task: DownloadPipelineArtifact@2
             displayName: Download Logging Package
             inputs:

eng/pipelines/onebranch/jobs/publish-nuget-package-job.yml

@@ -64,7 +64,7 @@ jobs:
 
     variables:
       - name: ob_outputDirectory
-        value: $(Build.SourcesDirectory)/packages
+        value: $(Build.SourcesDirectory)/output
 
       - name: artifactPath
         value: $(Pipeline.Workspace)/${{ parameters.artifactName }}

eng/pipelines/onebranch/steps/compound-build-csproj-step.yml

@@ -48,6 +48,3 @@ steps:
 
   - script: tree /a /f $(BUILD_OUTPUT)
     displayName: List Build Output Tree
-
-  - script: tree /a /f $(PACK_OUTPUT)
-    displayName: List Pack Output Tree

eng/pipelines/onebranch/steps/compound-pack-csproj-step.yml

@@ -35,6 +35,7 @@ steps:
       msbuildArguments: >-
           -t:${{ parameters.packTarget }}
           -p:ReferenceType=Package
+          -p:PackagesDir=$(PACK_OUTPUT)/
           ${{ parameters.versionProperties }}
 
   - script: tree /a /f $(PACK_OUTPUT)

eng/pipelines/onebranch/variables/common-variables.yml

@@ -41,10 +41,11 @@ variables:
   - name: BUILD_OUTPUT
     value: $(REPO_ROOT)/artifacts
 
-  # THis is where our C# projects place their NuGet package outputs (see Directory.Build.props
-  # <PackagesDir>).
+  # This is where our C# projects place their NuGet package outputs.  This is intentionally
+  # separate from packages/ (where downloaded pipeline artifacts go) so that ESRP signing and
+  # OneBranch artifact publishing only operate on packages built by the current job.
   - name: PACK_OUTPUT
-    value: $(REPO_ROOT)/packages
+    value: $(REPO_ROOT)/output
 
   # C# assembly versions must be in the format: Major.Minor.Build.Revision, but
   # $(Build.BuildNumber) has the format XXX.YY.  Additionally, each version part

output/.gitkeep

@@ -0,0 +1 @@
+# This directory must exist for OneBranch pipelines that set ob_outputDirectory to output/.