From 98b14d845c704ac01fc34c35ca75f7780a5dd60c Mon Sep 17 00:00:00 2001
From: Jeremy Meng <jeremy.ymeng@gmail.com>
Date: Tue, 28 Jul 2026 12:34:09 -0700
Subject: [PATCH] Fix ADO shell-arg sanitizer warning in
 save-package-properties.yml

Copilot agent :copilot: (on behalf of @jeremymeng): The non-PR branch of
eng/common/pipelines/templates/steps/save-package-properties.yml passed
`-AddDevVersion:($env:SETDEVVERSION -eq 'true')` in the Powershell@2 task
`arguments:`. The parentheses, `$`, and quotes trip the ADO agent argument
sanitizer, producing:

  ##[warning]Detected characters in arguments that may not be executed
  correctly by the shell. (https://aka.ms/ado/75787)

`-AddDevVersion` is a [switch] on Save-Package-Properties.ps1, and
`SetDevVersion` is a runtime pipeline variable (set in
daily-dev-build-variable.yml), so a compile-time `${{ if }}` cannot read it.

Fix: split the task into two condition-gated variants keyed off
`variables['SetDevVersion']` -- one that omits `-AddDevVersion` and one that
passes it as a bare switch. Exactly one variant runs, preserving the original
behavior while keeping the arguments free of parenthesized `$env:` expressions
so the sanitizer no longer warns.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 78fef37c-2ea7-4e0f-aa89-a70a62e059b9
---
 .../steps/save-package-properties.yml         | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/eng/common/pipelines/templates/steps/save-package-properties.yml b/eng/common/pipelines/templates/steps/save-package-properties.yml
index d3a1177aced5..f2c4d8ad4c81 100644
--- a/eng/common/pipelines/templates/steps/save-package-properties.yml
+++ b/eng/common/pipelines/templates/steps/save-package-properties.yml
@@ -71,13 +71,30 @@ steps:
         workingDirectory: '${{ parameters.WorkingDirectory }}'
 
   - ${{ else }}:
+      # Split into two variants gated by a runtime condition on the SetDevVersion
+      # pipeline variable. This avoids passing a parenthesized $env: expression in
+      # 'arguments:', which the ADO agent argument sanitizer flags (aka.ms/ado/75787).
+      # Exactly one variant runs, preserving the original
+      # -AddDevVersion:($env:SETDEVVERSION -eq 'true') behavior.
       - task: Powershell@2
         displayName: Save package properties
+        condition: and(succeeded(), ne(variables['SetDevVersion'], 'true'))
         inputs:
           filePath: ${{ parameters.ScriptDirectory }}/Save-Package-Properties.ps1
           arguments: >
             -ServiceDirectory '${{parameters.ServiceDirectory}}'
             -OutDirectory '${{ parameters.PackageInfoDirectory }}'
-            -AddDevVersion:($env:SETDEVVERSION -eq 'true')
+          pwsh: true
+          workingDirectory: '${{ parameters.WorkingDirectory }}'
+
+      - task: Powershell@2
+        displayName: Save package properties (with dev version)
+        condition: and(succeeded(), eq(variables['SetDevVersion'], 'true'))
+        inputs:
+          filePath: ${{ parameters.ScriptDirectory }}/Save-Package-Properties.ps1
+          arguments: >
+            -ServiceDirectory '${{parameters.ServiceDirectory}}'
+            -OutDirectory '${{ parameters.PackageInfoDirectory }}'
+            -AddDevVersion
           pwsh: true
           workingDirectory: '${{ parameters.WorkingDirectory }}'