fix: remove checkout:self to fix OneBranch signing (FileWatcher .pid deletion) - #58
Conversation
…deletion) The checkout:self step runs AFTER OneBranch Setup Signing, deleting the .pid file. FileWatcher detects this and terminates, breaking signing. Fix: remove explicit checkout:self - OneBranch handles checkout automatically. Ref: https://eng.ms/docs/products/onebranch/faqs/signingfaq/filewatcher
There was a problem hiding this comment.
Pull request overview
Updates the OneBranch “sign-and-release” pipeline YAML to avoid OneBranch signing failures caused by FileWatcher .pid deletion when an explicit checkout step moves/recreates the repo folder.
Changes:
- Removes an explicit
checkout: selfstep from the Windows x64 job. - Updates
featureFlags.WindowsHostVersionparameter structure. - Removes the
ENABLE_PRS_DELAYSIGNpipeline variable.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/sign-and-release.yml |
Adjusts OneBranch pipeline configuration/steps intended to prevent signing FileWatcher termination. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
.github/workflows/sign-and-release.yml:107
- After removing the checkout step, the step header comments are now inconsistent: this block says "Step 1" but later steps still start at "Step 3" (skipping Step 2). Please renumber the subsequent step header comments so they stay accurate for troubleshooting and future edits.
# Step 1: Install Rust toolchain via RustInstaller@1
# Uses the official Microsoft Rust installer task (MSRustup).
# toolchainFeed: dedicated Rust NuGet feed (contains rust.msrustup-* packages).
# Reference: rust.msrustup/.pipelines/build.yml, ripgrep-prebuilt pipeline
# ---------------------------------------------------------------
- Files reviewed: 1/1 changed files
- Comments generated: 3
| steps: | ||
| # --------------------------------------------------------------- | ||
| # Step 1: Checkout tgrep source code | ||
| # OneBranch checks out the repo containing this YAML (microsoft/tgrep) | ||
| # into $(Build.SourcesDirectory)\s (OneBranch single-repo convention). | ||
| # --------------------------------------------------------------- | ||
| - checkout: self | ||
| fetchDepth: 1 | ||
| fetchTags: false | ||
| displayName: 'Checkout microsoft/tgrep' | ||
|
|
||
| # --------------------------------------------------------------- | ||
| # Step 2: Install Rust toolchain via RustInstaller@1 | ||
| # Step 1: Install Rust toolchain via RustInstaller@1 | ||
| # Uses the official Microsoft Rust installer task (MSRustup). | ||
| # toolchainFeed: dedicated Rust NuGet feed (contains rust.msrustup-* packages). | ||
| # Reference: rust.msrustup/.pipelines/build.yml, ripgrep-prebuilt pipeline |
There was a problem hiding this comment.
The PR description says the fix is to remove the explicit checkout: self, but this file still has another - checkout: self in the Job 2 (Windows arm64) steps (around line 254 in the current file). That remaining checkout can still trigger the OneBranch FileWatcher .pid deletion issue and break signing for the arm64 job; remove that checkout as well (or otherwise ensure no post-signing checkout runs).
| featureFlags: | ||
| WindowsHostVersion: '1ESWindows2022' | ||
| WindowsHostVersion: | ||
| Version: 2022 |
There was a problem hiding this comment.
This PR also changes the OneBranch template parameter shape for featureFlags.WindowsHostVersion (from a single string value to an object with Version: 2022), but the PR description only discusses removing checkout: self. Please either (a) justify this change in the PR description and link to the template schema/docs that require it, or (b) revert it to avoid an unrelated pipeline behavior change.
| variables: | ||
| CDP_DEFINITION_BUILD_COUNT: $[counter('', 0)] # needed for onebranch.pipeline.version task https://aka.ms/obpipelines/versioning | ||
| system.debug: ${{ parameters.debug }} | ||
| ENABLE_PRS_DELAYSIGN: 0 # Disable PRS delay signing; sign directly in container (0=direct, 1=requires host watcher agent) | ||
| TGREP_TAG: ${{ parameters.ReleaseTag }} |
There was a problem hiding this comment.
The variable ENABLE_PRS_DELAYSIGN was removed from the pipeline variables, but the PR description claims only the checkout step was removed. If this variable is still needed to force direct signing behavior, dropping it could change signing mode or reintroduce the host FileWatcher dependency. Please confirm it’s safe to remove (and document why), or restore it.
Only change: remove the explicit `checkout: self` steps from Job 1 (x64) and Job 2 (arm64). All other settings (WindowsHostVersion, ENABLE_PRS_DELAYSIGN, etc.) are unchanged from main. Root cause: checkout:self runs AFTER OneBranch Setup Signing, deleting the .pid file. FileWatcher terminates, breaking signing. Ref: https://eng.ms/docs/products/onebranch/faqs/signingfaq/filewatcher
|
Addressing all three Copilot review comments:
The PR now has a minimal diff: only the two |
Problem
The
checkout: selfstep in the user yaml runs after OneBranch's🔒 Setup Signingstep. This causes the.pidfile (created by Setup Signing in the repo root) to be deleted when the checkout step moves/recreates the repo folder. FileWatcher detects the.pidfile deletion and terminates, breaking the signing process.Root Cause
From OneBranch Signing FileWatcher FAQ:
Evidence
Reference projects that sign successfully from GitHub repos:
vscode-powershell(GitHub → OneBranch signing ✅): nocheckout: selfvscode-cosmosdb(GitHub → OneBranch signing ✅): nocheckout: selfOneBranch handles the checkout automatically - no need to specify it explicitly.
Fix
Remove the explicit
checkout: selfstep (4 lines). OneBranch will checkout the repo automatically before user steps run.