Add symbol verification to OneBranch pipelines by paulmedynski · Pull Request #4073 · dotnet/SqlClient

paulmedynski · 2026-03-23T12:09:17Z

Description

We can use the Windows-only symchk.exe tool to confirm that symbols have been published to the expected servers for each DLL that we produce. This PR adds a validation job to perfom this symbol checking for each package's DLL.

Testing

Manual runs of the Non-Official pipeline will confirm the new behaviour.

paulmedynski · 2026-03-23T12:10:36Z

eng/pipelines/onebranch/jobs/validate-signed-package-job.yml

    isCustom: true
    name: ADO-1ES-Pool
-    vmImage: 'ADO-MMS22-SQL19'
+    vmImage: ADO-Win25


I created a new bare-bones 1ES image for tasks like this that don't require the large MMS base images.

@paulmedynski - Confirm that this new image is actually being used. I'm seeing the pipeline claim it will use this image, but then the jobs actually use ADO-MMS22-SQL19 which is suspiciouly the first image in the pool...

paulmedynski · 2026-03-23T12:11:50Z

eng/pipelines/onebranch/stages/build-stages.yml

              - artifactName: $(loggingArtifactsName)
                displayName: Logging Package
-
-  # ====================================================================


Validation has moved to its own dedicated stage.

Copilot

Pull request overview

Adds a OneBranch validation stage to verify signed packages and (when enabled) validate that PDBs are available on configured symbol servers using symchk.exe, integrating this stage into both official and non-official pipeline definitions.

Changes:

Introduces a new validation stage template that runs signed-package validation and optional symbol-server verification.
Adds a validate-symbols job template + PowerShell script to download packages and run symchk against public/internal symbol servers.
Refactors pipeline stage composition to insert validation between build and release.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/Microsoft.Data.SqlClient.slnx	Adds the new validation stage/job files to the solution listing and updates stage template paths.
eng/pipelines/onebranch/stages/validation-stage.yml	New stage template wiring signed-package validation + symbol verification across built packages.
eng/pipelines/onebranch/stages/build-stages.yml	Removes the old standalone MDS validation stage from build stages.
eng/pipelines/onebranch/stages/release-stage.yml	Documentation/comment updates (but still contains stage dependencies).
eng/pipelines/onebranch/sqlclient-official.yml	Inserts the new validation stage template before the release stage.
eng/pipelines/onebranch/sqlclient-non-official.yml	Inserts the new validation stage template before the release stage.
eng/pipelines/onebranch/jobs/validate-symbols-job.yml	New job to download artifacts and invoke symbol verification per package/server.
eng/pipelines/onebranch/jobs/validate-symbols.ps1	New script that extracts the nupkg and runs `symchk` against symbol servers.
eng/pipelines/onebranch/jobs/validate-signed-package-job.yml	Updates displayName formatting and switches the validation job vmImage.

Comments suppressed due to low confidence (1)

eng/pipelines/onebranch/stages/build-stages.yml:211

build-stages.yml removes the dedicated mds_package_validation stage, but the release stage template still lists mds_package_validation in dependsOn when releasing SqlClient/Azure. This will cause release_* to fail with an unknown stage dependency. Update eng/pipelines/onebranch/stages/release-stage.yml to depend on the new validation stage (or reintroduce an equivalent stage name) instead of mds_package_validation.

              - artifactName: $(sqlClientArtifactsName)
                displayName: SqlClient Package
              - artifactName: $(abstractionsArtifactsName)
                displayName: Abstractions Package
              - artifactName: $(loggingArtifactsName)
                displayName: Logging Package

eng/pipelines/onebranch/stages/validation-stage.yml

eng/pipelines/onebranch/jobs/validate-symbols.ps1

…ild stages exist.

paulmedynski · 2026-03-23T13:10:55Z

eng/pipelines/onebranch/steps/compound-publish-symbols-step.yml

-          echo "1	Succeeded; The request has published successfully"
-          echo "2	Failed; The request has failed to publish"
-          echo "3	Cancelled; The request was cancelled"
+          # Poll until symbol publishing completes on all requested servers.


@benrr101 - This will conflict with your changes in #4068. I will wait for that to merge and then address the conflicts in this PR.

eng/pipelines/onebranch/steps/publish-symbols-step.yml

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

eng/pipelines/onebranch/stages/release-stage.yml:17

release-stage.yml still lists mds_package_validation in dependsOn for releaseSqlClient/releaseAzure, but this PR removes that stage from build-stages.yml and introduces the new validation stage (from validation-stage.yml). This will cause the release stage to fail template expansion / stage dependency resolution. Update the release stage’s dependsOn to reference the new validation stage (and remove the old mds_package_validation dependency).

eng/pipelines/onebranch/jobs/validate-symbols-job.yml

codecov · 2026-03-23T14:20:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.67%. Comparing base (40db478) to head (e28a175).

❗ There is a different number of reports uploaded between BASE (40db478) and HEAD (e28a175). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (40db478) HEAD (e28a175)

CI-SqlClient 1 0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4073      +/-   ##
==========================================
- Coverage   73.23%   65.67%   -7.57%     
==========================================
  Files         280      275       -5     
  Lines       43000    65825   +22825     
==========================================
+ Hits        31491    43230   +11739     
- Misses      11509    22595   +11086

Flag	Coverage Δ
CI-SqlClient	`?`
PR-SqlClient-Project	`65.67% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

paulmedynski · 2026-03-23T19:18:04Z

.github/copilot-instructions.md

 - All source code is in `src/Microsoft.Data.SqlClient/src/`. Do NOT add code to legacy `netfx/src/` or `netcore/src/` directories.
 - Only `ref/` folders in `netcore/ref/` and `netfx/ref/` remain active for defining the public API surface.
 - Check for platform-specific differences using file suffixes (`.netfx.cs`, `.netcore.cs`, `.windows.cs`, `.unix.cs`) and conditional compilation (`#if NETFRAMEWORK`, `#if NET`, `#if _WINDOWS`, `#if _UNIX`).
+- Lines of code, comments, and other text should be a maximum of 100 characters (see `policy/coding-style.md`).


Copilot has some built-in settings that specify 80 chars max, and it stores it locally (i.e. somewhere in my user directory). It claims that this will ensure that it generates text with our desired line length.

paulmedynski · 2026-03-23T19:19:32Z

eng/pipelines/onebranch/jobs/validate-symbols.ps1

+    [Parameter(Mandatory)]
+    [string]$SymbolServerName,
+
+    # Maximum number of attempts when symbols are not yet available.  The first


@paulmedynski Move these docs above like the rest.

paulmedynski · 2026-03-23T19:20:48Z

eng/pipelines/onebranch/jobs/validate-symbols.ps1

+
+    # Maximum number of attempts when symbols are not yet available.  The first
+    # attempt runs immediately; subsequent attempts wait RetryIntervalSeconds
+    # between them.  Defaults to 10 (~5 minutes total with default interval).


We will tune these retries once we see how long it actually takes for symbols to become available.

mdaigle

Did you evaluate the dotnet-symbol tool? It's OS agnostic and we can install it via our tool file.

mdaigle · 2026-03-24T21:30:57Z

eng/pipelines/onebranch/jobs/validate-signed-package-job.yml

 jobs:
 - job: validate_signed_package
-  displayName: 'Verify signed package'
+  displayName: Verify signed package


It feels like every pipeline PR is switching these quote types back and forth or removing/adding. I think we should default to no quotes (fewer characters) unless necessary for correctness. Can we add something to the copilot instructions to capture this?

Added validation stage and symbol verification job.

63f38c0

paulmedynski added this to the 7.1.0-preview1 milestone Mar 23, 2026

paulmedynski requested a review from a team as a code owner March 23, 2026 12:09

Copilot AI review requested due to automatic review settings March 23, 2026 12:09

paulmedynski added the Area\Engineering Use this for issues that are targeted for changes in the 'eng' folder or build systems. label Mar 23, 2026

github-project-automation bot added this to SqlClient Board Mar 23, 2026

github-project-automation bot moved this to To triage in SqlClient Board Mar 23, 2026

paulmedynski moved this from To triage to In progress in SqlClient Board Mar 23, 2026

Copilot started reviewing on behalf of paulmedynski March 23, 2026 12:09 View session

paulmedynski commented Mar 23, 2026

View reviewed changes

Copilot AI reviewed Mar 23, 2026

View reviewed changes

eng/pipelines/onebranch/stages/validation-stage.yml Outdated Show resolved Hide resolved

eng/pipelines/onebranch/jobs/validate-symbols.ps1 Outdated Show resolved Hide resolved

paulmedynski added 2 commits March 23, 2026 09:45

Addressed Copilot feedback.

25a53c7

Added dependsOn to the validation stage so it depends on whichever bu…

e28a175

…ild stages exist.

Copilot AI review requested due to automatic review settings March 23, 2026 13:07

Copilot started reviewing on behalf of paulmedynski March 23, 2026 13:07 View session

paulmedynski commented Mar 23, 2026

View reviewed changes

Copilot AI reviewed Mar 23, 2026

View reviewed changes

eng/pipelines/onebranch/jobs/validate-symbols-job.yml Show resolved Hide resolved

Moved polling into the validation step to avoid holding up builds.

3905444

paulmedynski commented Mar 23, 2026

View reviewed changes

mdaigle requested changes Mar 25, 2026

View reviewed changes

Conversation

paulmedynski commented Mar 23, 2026

Description

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

codecov bot commented Mar 23, 2026

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mdaigle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants