Scope DLL Signing in MDS OneBranch Job

[samsharma2700]

Description

The MDS (Microsoft.Data.SqlClient) code signing job in the OneBranch pipeline was inadvertently signing DLLs from the
Extensions.Abstractions and Extensions.Logging packages. This happened because:

• esrp-code-signing-step.yml hardcoded the pattern Microsoft.Data.SqlClient*.dll, which matches Extensions DLLs (e.g.,
  Microsoft.Data.SqlClient.Extensions.Logging.dll)
• sourceRoot defaulted to $(REPO_ROOT), scanning the entire repo tree instead of just MDS build output
• The MDS build target (BuildAllConfigurations) depends on BuildLogging and BuildAbstractions, so those DLLs exist in the artifact tree at signing time

Issues

Fixes #4023

Fix

• esrp-code-signing-step.yml : Added a dllPattern parameter (default: Microsoft.Data.SqlClient*.dll for backward compatibility) and replaced both hardcoded Pattern values with ${{ parameters.dllPattern }}.

• build-signed-sqlclient-package-job.yml :

  • Split the single DLL signing call into two targeted calls with exact patterns: Microsoft.Data.SqlClient.dll and
    Microsoft.Data.SqlClient.resources.dll
  • Scoped sourceRoot to $(BUILD_OUTPUT) to avoid scanning the entire repo
  • Narrowed APIScan copy patterns to exclude Extensions DLLs/PDBs

[Copilot]

Pull request overview

Updates OneBranch ESRP DLL signing to be parameter-driven and tightens which SqlClient binaries are signed/copied for APIScan, aligning the SqlClient job behavior with the more explicit patterns used elsewhere in the OneBranch packaging jobs.

Changes:

• Added a dllPattern parameter to the ESRP code-signing step template and wired it into the ESRP malware scan + code signing tasks.
• Updated the SqlClient OneBranch job to sign Microsoft.Data.SqlClient.dll and Microsoft.Data.SqlClient.resources.dll explicitly (and to scope signing to $(BUILD_OUTPUT)).
• Narrowed APIScan file copy globs to only copy Microsoft.Data.SqlClient.dll / .pdb (instead of Microsoft.Data.SqlClient*.dll / .pdb).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
eng/pipelines/onebranch/steps/esrp-code-signing-step.yml	Adds dllPattern parameter and uses it for ESRP scanning/signing when artifactType: dll.
eng/pipelines/onebranch/jobs/build-signed-sqlclient-package-job.yml	Uses explicit DLL patterns for signing and narrows APIScan copy globs to the primary SqlClient assembly + PDB.

[paulmedynski]

Run the sqlclient-non-official pipeline on these changes and paste a link.

[samsharma2700]

Build link : https://sqlclientdrivers.visualstudio.com/ADO.Net/_build/results?buildId=143546&view=results